67e21a2dc127a97e92943e9a00d749664b312d807d21430b11b4f97971751dc9

Analysis

max time kernel
135s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72e5d94e5b3f1cdb49ffe317617dee63_JaffaCakes118.html
Size

27KB
MD5

72e5d94e5b3f1cdb49ffe317617dee63
SHA1

ae73faa870ca4169654a64db49e2516b9fad06f4
SHA256

67e21a2dc127a97e92943e9a00d749664b312d807d21430b11b4f97971751dc9
SHA512

1fc01c3ece0b51d797c5addaf97a9cd2e865db9e3a50c774a55d2056952dbce88cf943bb4b4c5b567dda7dea643bccdbb63ba7f2c98569ba4a3274d99d7e1902
SSDEEP

384:Szx48kGsxdjqfpowvq4/aqN+Lc1KWE0nv8X8aD/sYe8R3LQS+COlUt+Q5dfgl8cH:SO8kxjGxo0kWDnv8X8ar3jSUnPft+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004b25d3cac77fa445afc2d6fd981b88450000000002000000000010660000000100002000000008df5417222214c0de7ee2f1d35bc3a177aa9f27559a26a9bfe3ebc4eb298dc4000000000e8000000002000020000000c7395118d58bb7ef5067a4889fb0d46267fc2ae7d5ce9c879dbb1772921a6d0d2000000007d07ef321d23b3373b18c6ee210522b4c17ff8f6ce143226b699ff7d5b13948400000004839685b14b346f1e00d50de28309846629bf4f71f8a23718297ab7582cab764c8a2c98cb82bda3e687e72091395d422544b7af7fdd05d8858dc1a8bf5bcfda7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004b25d3cac77fa445afc2d6fd981b8845000000000200000000001066000000010000200000001a237e6d2abdcef0b8bd169049ab268c44a6ef578b3fe62bdf04790a74cba503000000000e80000000020000200000009c78bd4c477d08de1eee3f781ab26ae8676ab42b02b1322ee4510c557259e89390000000e957ef1f5c21fe062821c6476648ea886d541ce0dc30cf26c2492de15a45bdd20d7e679f81ab5b7c9d53e3face4b76bf86728003592ec213804bfa0baf8a0c6caba9dfbbcd55d8978b57f3de079e99072d0b2e75af81023179ccf713984db64654fd5b28fa66f7e2ec22e03b3c949ab6cafaba8f4cfafd36ab1cbfed77d4b4a4d395aacb8b89c7e12213014395d1d611400000001fd2a68e0c653cca902fb3a3ece9bd6aef3c849f33c7938de8601db0fec3ceb21f99d5b88de3468ef4b6e546b00c6bed3b2ab5bd2e79a1e7b7ab510f11c41fc7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422824374"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E6FE381-1AC6-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b9fb48d3aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72e5d94e5b3f1cdb49ffe317617dee63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82e8b662e0ed8c33d4552e57290f2bbc

SHA1
c90d8b88566780b6b1bdef9fec49e8d1094174f6

SHA256
23ed753ac6ea7ce1360589c02f136b3163a097fdc945c497acb90e1c5760697c

SHA512
08e38fd123d3c22a582864332823e637af15e8ea31f527c0061e57292d424f8c96fcdf79aee7daaa157700b8ce3b5f22c789eda645d17af776500fc16005ff0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d60b409fe02771f5860f3b8685bc5d9

SHA1
88f7ed5225bbbb830ee8f1ade6a7d25383835cbc

SHA256
f206fa26682d46735ce70aa42b27d2c7d2e34635757b4a4dc70298fb581b239a

SHA512
d278b197eb00ef5c515c5ab23394dd26e3c372d18c21fa03f4da12451e4308af1deb7fa86be0b51f3cf5c21a0c2701fe414cf9c1dd5adf2de98b9a1e3434c339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8774a95ff4c51e511892e5cf45c95926

SHA1
41e24dee8b87a936d9f79a78df99f3b2f1145914

SHA256
a3e4b12418bfe25f8dbe013c55ddc2f88b0f294cc720144afb9fc01449f5b781

SHA512
c5ed691f7e78f78ba839e7ff45b2cfa6a3c8b472e0fdc58b41e89419080626199f7dd295f866b8acca5d513673aab868a3023c98a4c3410e820577d9afa6dfbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a516e334f668b8576250ef04a16a87ce

SHA1
56876cb2affd78968fd498505d1c73e2857cc20a

SHA256
e3c7f6a098cf88d532fbec9a9d72c623406b841ae63ee3681334bc30d7d45a19

SHA512
d4b457a07dfc06a40b27fc35cb17fc754f985ce412af2ed4ecd8cf28f0f8d63a2d8921675f271a10cb9fced931d0af244fa7154ad13db726b82e2464c761efa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f99e14402a0de4c0565d32deb077ffba

SHA1
a1b073fc8a9e800a066e47737f2185ea0148e694

SHA256
50c60afb1ab5456158d4cf701be01d6aeb9982d5349cefd6a8b32c95383c004d

SHA512
f07b939acd55721af1c95488de5636d47952a7d2e9fbb7186826e8a12c5f0f7774ce1d9877c378bc29cd711314a08a66e6e56bed0d68d24f225cdb3d0dca1b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0427502d1399565bda4e33410f84bbb

SHA1
4dc410e6226c2c15df1979dae87b470e624e8ffd

SHA256
09ac1e5dd9d3cd2194100b2b9f001ce549c11e865c522abc0e365546b96d8802

SHA512
e4e2b356e78a3716eb820cc906ebc5c20c6292bda8c059230b4e4a8ffd21a0876825f4f0a56c86524a52880837b386e544be88631daa82648f4a3f5ba346a4e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
760719be23b096e9df3ace9a30589252

SHA1
66d8f62950e6e8347790479ebebe3792e6a620bc

SHA256
aafbb56f7b4ad819dc40a773929db15a41af68e7c3864aaba8465095872bf78b

SHA512
d27c11eaf57227ed819c6b8a1c3457963fdadf9762c8402ec77f1bfa0ecb2687087f2881675b3f4e22f17c86bff75d182d54d859edda2397b0bc575d49e3f8fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7437f4d508e594a5ad5c251195b406f2

SHA1
d6a1df63f8a99d9ceb34211fa4253428645bb23c

SHA256
469cf5b848aeba578902f2ff2a6bd1ee72bda06911d682924c2af94eddd8ae50

SHA512
0909a2bc177b690b9e3aab9b4d2077d41980a9d3bbb02b0df34a4ffc46a8b37376ea4f857eabcfb6cf51fe669d09de8ea9a0efb1587e35d43699448559b2dbef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0dba532f6c369a36ecad5d1b2de9cc8

SHA1
b8ed1d75899a53939b9165526998c687761caf23

SHA256
a102c4a4dfd38568d237f4f7c2a1d9bb2e611cbb08827a291f5fb045ca5e0525

SHA512
df6a6368ef5099b0fb3b725b7599ad6fdd4a017478cabeda6da8f5a7467d8e5646ae920b430a3bfbf17b4196f162331bb89fa3a193faff30bfb3dc330bc6e08d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
982053432632514c520cc64992fac145

SHA1
81900781e88ec796fd09e48d488390925d218978

SHA256
6bc5729e9dc4f1fdace0d1188c21c4719a8a2d4f302528b450eb0c434b2a696e

SHA512
7b813e1379c22d65e64b9403b9fabe75f88896b7527733c42e7e056f3182d343acbc3259e006b4c6fd4354abdb0080c6acbf5670a8405ea91aaca450979bde11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
176435520823b7a0bd07ab4324095317

SHA1
b0aea225758468cf3415832562a1147541741053

SHA256
a0224e683a7e43fd1463ab60ccef82989288071006d4093c66e052108f211a21

SHA512
d416754db8791abd79f192e85f35b7a24d7c6f7331e3a857936de86e646c8f2f37e88042ddd18d00febb585d91ff0a36692ae31837874f1d2b2a8386ebae1513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\facebook[1].htm

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\jquery.easing-1.3.pack[1].htm

Filesize
124B

MD5
53be825ff0691f64fbda7e366a369a1d

SHA1
2cfaf25ec5c55604e4abc11d058af5245ec82793

SHA256
b466d6388b84655901bcd30202addbf8f919de2b859e087f9bada86782afdbc8

SHA512
26547c734ccdd00863c0ad1a0188a412211cb3a951ba47d49e793c3c996c9956768165d999e5ec0cc9f734641ba2d3e8051f318e0a11dd2b332feb28f79d2b5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\et_shortcodes_frontend[1].htm

Filesize
122B

MD5
a89c43bff6448106fe939d7ed63aa5d6

SHA1
c8409decca3894746b586cc44acf18a0a43a5654

SHA256
54e4f2a9b12500cf2444f8fa8d3071646b04f8b8d4339cdad6ffd6d720e0eb66

SHA512
e566694a3b44885eb35f03260ab2c7ec48701b5841372ff927fa403d1916c6442b0d5687ab854e0d9e80a45418971357b14793a822f6dc0c9cd9f11c84507271

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD58A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD717.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit