3c55038649e2876cd2699e3799f60fb902ee58a4b04b000c62fc02e51fc91659

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e889dc01da4778a59bff7856aaaffd8_JaffaCakes118.html
Size

462KB
MD5

6e889dc01da4778a59bff7856aaaffd8
SHA1

9a13ade7aca3ff9c108d5bf0237fe856bde3b32b
SHA256

3c55038649e2876cd2699e3799f60fb902ee58a4b04b000c62fc02e51fc91659
SHA512

12ec4a196afac0f631dcbdee9815f9c8f09abcec7b6e47ece56dda628b90e198be649679469c4f190adde59e6332dbbc224fb2dd0ca30eb1d3803c2b03d40e76
SSDEEP

6144:SfsMYod+X3oI+YnnsMYod+X3oI+YZgsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3h5d+X3y5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003ca963be8fbcb09c89a5dbc94081ee89702955d85f73c823525ac29655b76d7e000000000e80000000020000200000000612a8a365370c7c056573adcc36c5f1555f0f7680ad99f5e6a5d1d1636645ff20000000f5009ce640b97a7089a48aa2a561cb99286763e6f20a9b67b9a2e5172f36505d4000000015f4062328decebe10e5998eb3967ee242409e94ebf586a03e275ab7fd676bebac489ec61ee23ce6ead5b0ee1bac89d796bbfc8099438252220cba6921a17511	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a095d264d6adda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a24786953965a109ada16d75d80ff28e5cfa72baae7a9cc6d3f8181a29c831ec000000000e80000000020000200000009c181dffb3efd3e7a0f5e7be46159a045708c4a6db01300aa9888d26509a7f1490000000ad83ad2d17117bf476b148cbb9ffc728c2d57e68b08f390e90f876382d807c247f06b1c5e26141b1876f216c402d1f7a5c1016dc1cc290901cc64d12a51a92d53a02148e76fd07bacdb733a924e11702265653ebacb1761f558b1b834bd0ef7ed8e6c2e9e4f607cdb083bfafa002f5855db470afb3746a3aba4303f20e26487f146a99cca88087b391b7a3d9cf7e771840000000fe4bdce2a00504a5c8e76cae773b791efa7dda74b05b91556fe047459290cc640b38a80b4881943b282d8946812d367a6c8398dcc984483b99f427f5f8d1e60c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422715757"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C347641-19C9-11EF-9449-6200E4292AD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2108	1736	iexplore.exe	28
PID 1736 wrote to memory of 2108	1736	iexplore.exe	28
PID 1736 wrote to memory of 2108	1736	iexplore.exe	28
PID 1736 wrote to memory of 2108	1736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e889dc01da4778a59bff7856aaaffd8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bbcdfea63636f826dff894b4dc33b12

SHA1
722d50c08c51cfa352e79b23239cb69c9ec8ef33

SHA256
29a905de8d974bd300df0d49f95efda55a80dc3cef4bed959c019abcd7a7ec56

SHA512
57ce4832b0b466d5e81f2943361ac8a2f62e89083da3bdb0ad495133ba15afdb01a3823bfc74fe863f0e560892eb6580c780e92422108f6e173fce10a173940f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e11b068fa9c61cd15ecf7e1176f2c17e

SHA1
aa95eab507904423da3bae2936a21cb0b2f91c43

SHA256
5f746c4c75d39b8fcd528823b105a1def896f37cd53982a564c3e228535db019

SHA512
5df321e0d4ca2815c76528fd30dfc58d240068490365fa9e69500fc55305e10cc344f0d2c0c448eb705edf0d3d883c7308ed016fb6453f4c4104162cfd78f8d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ced0450a7340ae14301eeab4f1db41

SHA1
ac4714409000ce1eb32c46794b5877225488fc46

SHA256
b83a84a0e1d7c22f5d5e7c50b4992d9501edd809d7e37ab18fb8802b84765023

SHA512
3236a078ab0dc0f096ddc2d9685f9039a572270983828060a4f7cbb8cc747681ec8eb646812f2bc584ab8c2eeac1b96fbe0882ea8e9c9680706cfe7ac8cea0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60842da31b25fe5b8bb849046b41269b

SHA1
292bd3e89212a3c9b4e2936e8e4e38ab7663f442

SHA256
2895c12855d307a8ffa6d724f0244bd5acdf23d9c52aa42d4c5fdf6b582361b9

SHA512
dcec26986d3057efac3f517a67cd1d105ad62296f675f0011609588632f70c5622ddefd36150a8d299650de068cf4abda7a873438d85fbf9c90d61e10d632e08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d28ae003a88f94c3f98c975c5f7dd639

SHA1
4c148d7e98de55bc7e6eecfb7a583952638a624f

SHA256
a14ae3735495a2cb2d3fab46e0b5cd18e6a5711310414223193034760a48c22a

SHA512
a007216c9265f86ec539a32d995977c0576e78e914f15ee525fe0c4e4b7f12726617bffb7ebe49562fc169298db3540435be91510cf3805354d74c3c11de3149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b24119f1c0c367a7d92d4c4cb4dbcd2

SHA1
cb72e2d11f61871319836078a5553691d7f077ae

SHA256
f5e0b45e5c425d7902e7c96074dcf33f8bee61338d36a61d19490e1fc6be0140

SHA512
7643b2970019cc400e0a2466194f21a28ed97639868d071709065f5322a4ec733d480066b9d3ec5f010ef8d8026b4618398254d75ab1dee3e8f304967ad399a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e56f575a211f2992962035cac9bfe54f

SHA1
a19705db07012f923adb88deb7c44d1e55169a78

SHA256
2d6ef7ceb4305342dd7ba5ba40cb1236b49839bd5f22d8546be4f045f98e605e

SHA512
c39f2e953a426c9dc65e24581160e55a0d20b9c43e42cba94d026b30de8aafeb7b3cf9acef27c2647fd4a0e8c326caead04099faba0f8d1d24ce5ac20cb1bb7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20194f43d9d7cce41be61326e2b58a1e

SHA1
c6304a8ae20b3941a7fac4f8f70ca72c58e381cc

SHA256
82bd4b3bcbae8b12d1488a599959782201705ed15b0630f8014b7cbe24042766

SHA512
1e7808cf6ec8948b5ac41a7cd9d873d7ff9ccfcb10bcb738fbd07565ae86e4099bdf4b7ecb423f731de270b707f6c0a6430508b6c32bbded1a9a01491723d147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f5e31f7b2ed8b401a7e30441b262cbc

SHA1
96df4fe7d4cf24eb75e0b086ff30fe4279dc77d2

SHA256
3c61d2be01cae08691359d80c7c85724b9732682f0bc6d09dfabb0a7cff6f397

SHA512
72c03edd4bf15f1330bb2cfb44e92d9ca6f9679361bb4dd10be0169351ee4fd50922ab5fe07319eb3a4d3f12ed2c5642c26562bf9ac4b455679fa49250ee6d2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
580510b50628d016215bc868dda69072

SHA1
abd4945dd80b3d1d2c5df06a6011f91d1b94edf4

SHA256
68514b553c880a2e112a0d8b77b8db005192a35974d4243bdd37f2e380cbb6da

SHA512
df1b23855c7801abc6f26cb7b361247e8a0c9cba7370d2455b7ed4cdfdc973d31c2e3d44ff8e5401919f4b36c8746a3130d59fa3acc93192be0344eeddc6c079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7533d7008ca8337cc15c89ba2123143e

SHA1
2a541ee90a80dd6345944bf4f0d0fc0e417535c0

SHA256
73e0f692537d9f27c70956774b6f105c6a2253db5a618b973b855124c2bdb041

SHA512
01520f9ee9838be756de0c78ce7d420f12dacdf40bfd106dcce022999949fb2f73bef408dba96c368e5a4dd95fdf0efa8bab9a95164a92c0b9499c76b1061965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88a293867c09f516079cbce990c8a065

SHA1
4258cb4e2be5b98cb08ecd8cc46c657e9bc98922

SHA256
18b4289f2a7b386ba04a8fc286f123a54d2df6b75d8eff793a555e546af4bf32

SHA512
a4d6bd20f594b899b974fb980d2000672ec3a7229d2d5894e7b3d9636ca896b55342b2ec6442580a836985cfbc3d21dc5c2acdc522877c1c6390bd070dbcd42b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be3dd24127d34e7236dfc8617375f6f0

SHA1
bca41e4a433c84d4877e5d55d18309af58b8a171

SHA256
44a4836c462be5c45991a656a2f9651ed3b272f0c459a6d87136f61d3dc40634

SHA512
d3763ce0db7ae2cf4666969646a67ca1fcff555ca2293eee8040494d5246317844dd437dd2af0f866b6f559d6865db1960813424a7147ca237e94f656b47175e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08b5929090cdb953146b7271b62113a9

SHA1
473874cb7eb14f2c908113a301924afa548f8410

SHA256
24e0922e34854497e4803ea082c2f3fcf0c95952c0991389cf9d976ccf60089a

SHA512
495259dc73dd6648ef55e365e333f8e546a546623fd7b82ba98e89200ecd3caf415ef9ade91ad88941bc0cbb1f694de54cf2910f76839f962cfe3baf7c0b4645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b10db295314f62af62e04979036d5b6

SHA1
b5c795603602df5b4018dc026e95fd192d40d7a3

SHA256
5f3c7d94d0c807f4b647f7cb4f647e84235f86b657853759218e8c7e2b77bef4

SHA512
14785baea88cecda9c541517868435ae852bd73eeae2a4496e38280951daa3a0bf8baa14a77619d3323d09b2fe061854bcccf184d1a7d76db55ad5724117bf23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dadb15ebf495bd932351a52912e39f2

SHA1
d91a10f7ea4e946900fda97b332265f4e4708f27

SHA256
57bde8f050c1bf2e1e0b8a322b377fa8bdec56e992cf0c9c50e19a351458cb80

SHA512
94a5956f06e53d1f8401b68fb545b2dc8262ea4d391f8d805c14815573d9cf201d22000d444fea3b200584ee5dec0b3af222a99a0e4a01fb1ecb52bb534a2a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
619c347f9e9ad0f6d75c815e06dc277e

SHA1
cffa3ebfb0ffad7178a4b9e9cdc3e8dddabc18c3

SHA256
83342813c603aba44962190b3a02bb93a46bab76d7c6e2a36773e21093bdb941

SHA512
e7ef93ee1732c5d904c5c26d5c6c4579d414f2d13bee6c83083ed32fab737ba2ec4a030e858efa0a6122e0ba7bafc325937bb4580d9fc94e1321b29fbac0ee8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B73.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4BE7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit