76067b3bc4abe6db7596c3e269ada9f550465e87d6770cd1797c610dd8b83589

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a73539438e3359dacfcd4c282ce2290_JaffaCakes118.html
Size

29KB
MD5

6a73539438e3359dacfcd4c282ce2290
SHA1

7eb1d039f9223d2a6f60ae6b7cc9766994e22e94
SHA256

76067b3bc4abe6db7596c3e269ada9f550465e87d6770cd1797c610dd8b83589
SHA512

8b492dba5e631ad73d92ee7f5c0626794fd70e761145d7416207ba4d048247ac070a77cd482f865670a23790802c2a59014a3bce3f0bac3ace0718fddb9e3780
SSDEEP

768:S3etZRsV2+6IkPENbbJZYDN4n+Gy1JlW8WEObQjam2CAcQ12X6:S3wZRsV2+6Ik8FbJyN4nCWEObQjam2CC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422617468"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70454a8af1acda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000399d3164a22746d0726587633af6698679410ca2c7f549524f581de0b3b0e0a0000000000e800000000200002000000091223485e0c6d11316e141d3029509da7b7c4037f90b0c7a5c4969b26b02b2d2900000000a25aaefee379f5d9d79cd6a8ecc837a542f1a0eef818061ef5f177fadf122d4582fc341d48c1550583730bff9172005ff3925c13be00d0adafb2e41ab61aecf9854c14e2efa7e0749cd30fa3afa03e9c3023835f735cea9c0a4c066233a521420073bca7b961ac9a6a0b026fb669cac91dbd69948a8b61690b0c0893804c226971d6da5094f9df6659b6b006cb05a3040000000106d585bf7c6bca86db079f6dd3b52298b38fdb7620a95a9f29664ba2ca8e5d7ee0e5b0106d4b4eb00839332b2d20cec7b427044e443f3ce11e25e85c847a197	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2CBAF71-18E4-11EF-8C93-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000bdc0271bb49550e7a2a5db17853d69577709f6707dc1b1352d652c4a8742e760000000000e8000000002000020000000d206397f35ad389753674d57dbe13fe364021c049477d4a848f093bb9c0cac5420000000bee3b78a12ceb0b70eab9c56573e90f3a70a821a5adae910024a8b33e0dc3dc040000000be7425576cbae68f416b2bcaaa79c839f87ff921e08cff13ef7bccbd09d3d83c6423494a0601175f4db0553b698014ea512ddbb130275c80d85ce9027f039884	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2548	2380	iexplore.exe	28
PID 2380 wrote to memory of 2548	2380	iexplore.exe	28
PID 2380 wrote to memory of 2548	2380	iexplore.exe	28
PID 2380 wrote to memory of 2548	2380	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a73539438e3359dacfcd4c282ce2290_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d716384215900f7453d7b02fb15542ec

SHA1
a2198cf76ee1c6f5c7b7ac1479c5423d731a12c2

SHA256
45a70f168dc7aa74fb978470e1ff999b9b589b3dd6792de30bed8aeaacc216b4

SHA512
1f1efe727fb0145c14a94c8379bdacacc3936f710ed4dee54047dffbb378de0c3c9726cc7bafe5da1f8f1df70772f1799c0112cb1fc36fa7f235c68ab3e84b1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
325ec82df1fb7b7585a0c60380476ac8

SHA1
c4032547e03323efaa6ca408e8cfb503afe85bdb

SHA256
169081a40875e967d699619d726273e5fcf904898a91b762635decdfef431a39

SHA512
78e229ccaa438005167795b07d4e22639be25e7b57e54e4c5844724005b442737485901327375f87c974a5ad4849d3bbf227e46d03e7dd2b80c712c9e35efece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90451082a2844e0c4cecc2406a382697

SHA1
13896271bee6272ac6250df74c3fd6677b99b94e

SHA256
72951eb973e7e5f25136e0875ab6af9dc03fd505e843cdff4a8649b480e5a8d4

SHA512
e336dc18444222aa2a27a46f35833ec75c7ad52f0c8a71a4e32061df1998416a2654347775231c7b92571b6b2e67f2fc89704a3c83c3d950f2c22deb6ecb8a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e0d323339a88d482605cca9ecd8fe8

SHA1
baa84a194a074d5b9cfb74dfa1517e987436ec2e

SHA256
57d4bdabdf013806bf8d67156850ef17a2a0b7814c329d9311ee9510df576f0a

SHA512
a8eab2f8a44ffe4aded45414b295dbb0f71a7f7b4f631e29ea53cd8fe497ffb6536dd60b744ff2d329f6a90f65550f5c1e01749ce44675b55befe6e02aac0fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
724e58da4124eb85b1447082d7b7fe67

SHA1
4f3015071cd6a3094e615a117c491ebc8093505e

SHA256
c3f19ebfa4963f3c498c00b1a34d0b20728b86a6999cbaec824c1d1a2da6e90f

SHA512
d2ed7c35eb89075db4a5cb8bf7f58d30b824d6b0bfa26a6f5b043132a8f76cccb630cf7f478ae9ef3c3a5b8fe3428443d37dadaa9b9472a44ed7d5163223b025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
898ecf61d6bf75e6c5df825631619146

SHA1
a631bb7f04206a5a78c5607b5f7fe1d86dd819b0

SHA256
fa81d9ca21ac341298b97b64e02429b51a29ca02f10c4b86441533ab614b7447

SHA512
d802d3797522e35bccd268e9e876858565cf1d7c26a5819b704736cf81bca6eb6b13eafedf7995c47e8c2aafa5744c291dde21c2d4e1d663d4576519c7bab676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c104e488ab6df513ec04295dd3258cd8

SHA1
524f82a7ad105cd86e9c005b481bed3559178996

SHA256
16fa842bcc758784634d5d84c687ccbf2eaa3dcb68f48da36e8659cfd0c4a195

SHA512
b2cdc0016f72a58888a35c91412895b80d74e4e0b8fea859b92d03d7ca14644199eb890f1942380cf43ab8d92ee7a022ce1b3fbae00e32aad562a69feb55cc4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd9ccf1eb6f5e245aaedb9649b212bc4

SHA1
6f7c75669897c3418fb092c7a1bbe79c2e856839

SHA256
9f5210e1f10c06888973066430225ffe8bb33f92153f539049a91175dbc54f00

SHA512
aa2b106ce69ffdc68b06e8460a87b24d42dd23cc22ba9f24a9ac05fb28585653ca4acfe68ed764af50090f961228805038259f3fdaebfff8ffbfc6164882cf8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7279c565fa05ad3d91b3759027ee0ed

SHA1
1de95f6cc6958f21fe6069c35f86e0c1ddf1afca

SHA256
ee1bfd7cf81780b9f02c1d9afddc4fbf4b60de9dc5f1efb614307cb51e6a204c

SHA512
01ce0ddd4398824563e23ee68adbd9c81ae43a63832540f161a5379faf155a48c65df31c94483f92c5d366914647b7f0a98d56ff3ba0e9503b3a43bdaf4cdb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c98f2d8b7c667351d4ad74382f6ba94

SHA1
5ebfd03e18d5f95aa904671ad7b57972d874f3df

SHA256
659d2edb2aa00324cc4b270bded3bd93bb77002fb14b290d4d5ab0d3db7688e6

SHA512
4b83cf139008d9891189ee10052d09d5bd0be4e1c1f200e4f973e2d0a745432c43feb7bec495d07d6b85d07f8f3e57eef64a0e403b2e01e0ca3e386343912cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8796232ea839595a14e6e9332aeda7d

SHA1
74a9e14aa31b59e19c31fad8df786ce1257cf458

SHA256
097521c07a138bd293ab5991201ce08ba32504013cc55704aec23c1359befb1e

SHA512
cef7efe0ae523a5bd8fa8be8e9ab69faa187df5aefa512924720894ba9e7dfaf8587e1c5bbc2d3b1cd8c5e13c539fbab534a711e62c8657b0c92d56bfee2e05a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94d9e7ae09ed28d136951f59a4bc4787

SHA1
15055dbd74870fd83c2190afb68b1b0ae44f020b

SHA256
2235cbd910d01092b751270c0b44ade230bc5d89ff90aec62ebad370d6222686

SHA512
6beb723681273206728a67f03dc72b53f513b43a9772da58e9b09c1759f56e8a6e3aee5f2709fb62d0617c23d694c8a0e856c7eab374dd7d9cdf788047ee8098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e85d5b04279fdde794cf634eb20c534

SHA1
ebe83ee0d2fe978d4262ca973e11cf0a2775cce5

SHA256
af84cb58e0f93ce22e503ea89b1f8c553875af6dd3d44e6d128087f31ec855b4

SHA512
cea66fa15cd889f892a897a00e18f62d15e6fa34075d45d4b619f9a3ab312315c478888d1e7d346a88baf07bbd86cf5788e3f8a7a8c25ec5a08926ba583b8baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
701a08807865535efafdf409682ec585

SHA1
d71d05dfbb3421dd5d1328f16e35525783fbd7ec

SHA256
e3f9c8309de88e9167cceae597474663ba1e92930f62dcf1986302b9738953e6

SHA512
450839428c03f3dede577de6a6e63eb2cdd4f4139fae32294940d75581207e9b70b58850c26c2165649d49ff790194ca31a532988f0a63ebb1e388e086789fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e81554886aee486ac45e89cb03cdf30

SHA1
9d6e29d63cefdb5ee90559e953f779bf7375258b

SHA256
c389bf01fc7c4f3b25ac369ad6bd09e3ee96b38dafaaa74fd9e858e473605378

SHA512
c4995fe66900424e39f80c45b6568ef30bb4071f9edb5f91c82d24e4fd8ffd09b1727f0ff0bb6ba899d80de7923e755712dce2c3db4256af4f39ac339fc93fa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F1C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F7D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit