18cbb3f90e40dbb4f31cb5585763c1d01b2e429147bb076d219daa013887bedb

Analysis

max time kernel
134s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

748a99da0739abf5a0f1492bcf0c32f9_JaffaCakes118.html
Size

213KB
MD5

748a99da0739abf5a0f1492bcf0c32f9
SHA1

fb8fa1ae18fb6f1bab0221c2bd0e3b99d54a911f
SHA256

18cbb3f90e40dbb4f31cb5585763c1d01b2e429147bb076d219daa013887bedb
SHA512

72e417ec74a5313e75ecdea4e4e9d3007bc070bbb2657cc85eaa1015d72437e58a6fc5f91878bbdfae73b7fd24fe20626a26a0e2163207649492b22325d00cf9
SSDEEP

3072:SSYYIniTQbRyfkMY+BES09JXAnyrZalI+YQ:SSgtUsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0257D301-1B26-11EF-9449-6200E4292AD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422865421"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1520	iexplore.exe
1520	iexplore.exe
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1532	1520	iexplore.exe	28
PID 1520 wrote to memory of 1532	1520	iexplore.exe	28
PID 1520 wrote to memory of 1532	1520	iexplore.exe	28
PID 1520 wrote to memory of 1532	1520	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\748a99da0739abf5a0f1492bcf0c32f9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b5c341849e716bbcea3ca55318d7b18

SHA1
aaa4070f279183bafd9bf2c08f4b14d11988aea0

SHA256
ae80a061abddbd4f96a2688eef0dec943c16fc1ff02214ffa6838989b9db1429

SHA512
4f3d07c8ca781444f37345522d69b5bd224193970144194cf16a118181c68e9309b1a16424a29929818316d60b806627a0fb04c31d02a108ecf3e6fcaf607b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
175732c83c3cdcf43de705fecc7963cc

SHA1
1e767ca7244b3b4f616812200eb41950608decbe

SHA256
9e7a1399fe30b6ead0e79ffabe7e2bcadb918b7cefd16d6c0dba15e6c52caeae

SHA512
68b60e81f751d76e91e74ef29c1d94c0a52d05b997cedd9522c4f8250767e201c64ee7818d8f89367acb2be13364a47f3f9f37c14968484b37055dd438a04a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
033c71aa8a2d3b36117e7f8b4ab84fa5

SHA1
0f66f1099fbd07813c18747ecefd2a443415ef2a

SHA256
d6d89db958fc1d112066d5b8fda1ba134c8af2a899dc46a7d3359825eb640df4

SHA512
27af8d08e4d4c52825805fc9142154b42801656be08aed1a0615f89f0621f97c7b6785bd28749fc85bc6fa3fab12f8efc40b4fab8833f6cb06a43ea73b902fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00adb5249be777a73115f4b3cca18097

SHA1
cf6041f66319a3b9975306e8d416a00a2fc1f9f5

SHA256
ff26db15def18f16f2abbf832c1ccac3ad94d22d2176a01f149dafd721a23bda

SHA512
2a991e9d371e14b2bda284394f701f6d31d3e9eb88c4420a9b9ce8474387504e95b5d61e7b495ca04101a49888c7e667743a9447edd53f82d227c8428a855fea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2a4b20caf8a9664143b0f19e19f5b19

SHA1
7bc24a776564aed3f5467bd8b38c9fcbf64dc818

SHA256
32589a33e2159b8a4935c8f2d18f0d7f1ee320b5a150bfb541e3ff045e23b0e0

SHA512
054617ba8e1f00b372a47941a2cb9575d723290b8adf9a851b7de7d356039b28a05b0ce8e48b88a029ebed6e2bbbdffde7b563db383eb734968596edc7def0cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3387f1848977247efed807fd9847204

SHA1
1375c4e4f4e2f10272274e35dfd3b0338abb5c36

SHA256
c822359c9ae44f79e765ba6b6f467426f30398c1a9c1e3f7b12698d7737471c8

SHA512
89c1858cc62282eac5318d28e3e93a172df7dcb1045931a691467a768864a05821928195c8f45ffe82573b9d36355849efe45e8931ea06d22bb2f51bc7a08618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc396c9ed4cd5554bbf2df0675038884

SHA1
554f9b3c67f23375ca6b568d68825f040352840c

SHA256
48051d22407e3e44f1807d1f589c8dd0b20e363ee32f77064acc0778561aee99

SHA512
68f8be7b00cc81dd2c495a344e4b20ca59645588e7b26999522dab32baa218158cda0ba8ff5eba31f7c283d14960657e06c183768b53cd891021b06c7db29572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f52c352c932569fa13f0037979fcfa8

SHA1
b322f0fa65cfad2272827a5f867c82da3f1837fd

SHA256
434cf45f92eea89603a1b5975243ab5c61ca401a1d7b4d8f882cd5271fa908d1

SHA512
ab6b3ec33e883171aa70fcd2dac3b627a94d4784b83d352deae3a2d62fcfc4238a1cbd1ba61b7a2e8eb4697e95510b1afdc884310755107e1f83d98cbceee0e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce95da431b462f97f198d9a4dc4de568

SHA1
bdba435a374cdf17204586475165865ab2fc5650

SHA256
6818003f75d8ad4e6fbc816bff1bddfe8c65935e56298232e1b05c2be6af0f0b

SHA512
6e9654c25f727cd55997df10a341160134bf2be6b8b4a56b8befd0f7865d9839b9c56da60999852c98d84fdb83e542b4a68e72083a3122d89c7ebf59fdbfb62d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c0a2bfcb24b664c64874738a63f4ee2

SHA1
d53770f585aa5938f128075c453d8a15e1812863

SHA256
0c37ae6913fa1a5672a7017453cd29371636591fc2877d189ec33d6816aa3d3c

SHA512
e93080289db56b9e0b213a2ffefae67b435b964bf03bbc63427a06702fa2f1a8ca9add1324185fe9060e17147e21d411b19b7b429b272f1c47d8486177319957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63c7953c8465c0d111824aa9fb7282bb

SHA1
393abcbcfddece028824639ee3e0dc00f7f98383

SHA256
6fd3d30837e7f15b7494eb5509b828b7c6abd74c265cad4760e29a3a48b8390a

SHA512
c29e8d996e2e1481abb72ec2b41ba0ee6441e1ad1174fa58677b0c737d465aa51cad30d20b6a5fd343a61d37dedfc6e5003dd28466cd858b8346153e724dfc17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
154e00b078c73cd4ddde8bd8f3b10466

SHA1
5376d4f844e1841728690c6d7f98e00d6bfeb90e

SHA256
cc60fd284d82f98b47c504a563945292c515c957e687949956b66d4d4dc65c07

SHA512
3fc95d62136ab1c214e202b769d9d48d40e7872b096b3659ec86bb01a8d2a89c80e751e84bcd8c050de3ed09bc74f0d248344b7c53b2639204926370648bd283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4697bcc14b85a81b9c22cf7882ff59cc

SHA1
7fbf4358163be7726232ea4fc36d858b184c364c

SHA256
e5e13e65f95ac7a8a7e36370c082bf9711d13edd695a5a0292b6b07d76746dcb

SHA512
54c0ee983467e923f3a4dc3c1c7dda43198dd5c35fc517230e914317ca6cfc3c12ae64ed8cbf0226fa595eff8ff51fa3e465598b3ea4c8b5cc3fd7fda5bd17df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c97ff2148edcf88272e02ccec04d702b

SHA1
3e6e2d64895b039a131764f92ca804671193929e

SHA256
a60296b9d4db5545447e0aa32dec4ad21e5f09f1310e9850d4024f4f85b60b33

SHA512
7ff4e7f43405d388e4a3daca60d828c44c7de42e7806a203513f85c36cd7ae685fd6170b8f5e24e6079587cce74d4718c6007a54190aa86badbb458b71cd3eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65fa06b84e4ffa2f79d96225fc2981b4

SHA1
97d1886138a45395b26c137e38cb24a9f4c7f5b1

SHA256
754085f46e96a9ab61283f39eb608014c9b55329ae76cd90d9125d6a54afd4c6

SHA512
3e00dea91473f18718e296d025abc19d22a0d3d6460b32f12a659c2ba284d8be872520956a9f3f3d79b3d3b0b03924df74e8dc6ea6f122d2705f470d02f49e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7700beab5fa21a07b8c5d4aa7da70ef4

SHA1
8b9b58252cc81dab46b018611309301c09ec7436

SHA256
6a50a6653a36bcae6365bb0797874067e6b24ad527b43eed30cea0545358427b

SHA512
e89ee338f0e0359ff848df902a1f42281300b65f8a571ce4156c36be8e3950f8766e8a7345dcb1b903180c15faeabe23a3ac9689f70fb9576b641762c8166f12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
025c5939cc3834575b8c2cfc50d509cd

SHA1
e089e137153f5cd8bca3abd056da4d4d95517239

SHA256
3f025c6e5e294b93f5ea91eb392f682fa60305f616fd18dc088d28fa86bb8d20

SHA512
7094da2d5053432d30022a2175e4c82ae0b4df2762e07e566197b271ad226494c98c4022859516e8c4889868840b41cdbce0725af8dd1b12572b28fd6d13219a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c1aec354fa256928dfab68bc9697f9f

SHA1
a19ef6f2cd0e51cf9268e8cd68b517f438310746

SHA256
104ffc4586a97e1728233d941f6e08f51042099c43d8f5d764bf5a94252f95cf

SHA512
3520ae9a57a4b81244cd07cd452d609b0de77c1a16fa4fe90554ee09688aaeb222d825d229cc79a8176a34f24df128340ee49813de86a9111c17793e5d6646ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a89eb7299646979778ff4516355742b1

SHA1
480009ce0827b957b551fec4cb162a7076310252

SHA256
ff38909d81745d0e161d6068954a3aeaac64cb95faac84aa23aeed8e0612aac9

SHA512
4ab8c8e2418b4b2c3e0091ac8c1b93f75f0313ae6223a9d77533c316a19211491544caee73b4253838765a45a3bcfec143aa4b72d09ecef2eb4537213bddb09f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FA2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2004.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit