dabed473497535f98953105bc2488eb3e5edd2abd87176b646b1bc58a6cdc396

Analysis

max time kernel
139s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74d5f0df7bd91f6e8af950541f44ed36_JaffaCakes118.html
Size

67KB
MD5

74d5f0df7bd91f6e8af950541f44ed36
SHA1

550488b4165781c058cab4cf34e0a87e49c4b8f8
SHA256

dabed473497535f98953105bc2488eb3e5edd2abd87176b646b1bc58a6cdc396
SHA512

b3362cd36ec6a49cfe27bb299f37c8cfb50c9626b589f81df9dd68a3bf576f14485d675dbfbc157581ad673c684bf05fca0552317f87b24df0588c50ed8dd0f2
SSDEEP

768:Ji/gcMiR3sI2PDDnX0g6ZE6sqVKoTyXqwCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:JdRGzT04en0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b7b1d2e91fae0c4fa8e4542b7c8ef37200000000020000000000106600000001000020000000a11a50b25af75055aed328c163149cf0ad1838c18ad94f207ad877c071f6d5af000000000e800000000200002000000005197ea13f59d12dc18ffc8dc09d50e3c9033331392eb92c67919294842c5f0690000000f0ac88960ce76f9e89e22f681cedb29f7e067f52df3181304bbfbe1f9a1a5d9ccdefe200545f8f3ba1e3e1e002aa52cb0edd444bba0cc071bf5773f42b26132a4f06bb59f99c0b3cb421acfc10db8e1470378e382010fb3fd30b848390a9fc2b05226420a90efb0e61aa6b375e7e97b49b70a48602e4baca267510f9c153b7f2f86b4a3ecd436d05d78e93eaaa0b2ada40000000ffca6b3496072432fe5d7de25a09bf6eca546ec85ffd4551679da658057ccb5d87620aadd4b63f4604d5715c93f24a7c1a0eef0a8e92ce3c41d56e598dce641f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422872746"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F0C1CD1-1B37-11EF-9511-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b7b1d2e91fae0c4fa8e4542b7c8ef37200000000020000000000106600000001000020000000f13fb485d548b1b816f9bcbe1f3c368d5b9bfe0f070202745791bfc174fb2d50000000000e8000000002000020000000b1931bfbfd8e7fc905e8c6968983e8c70c11e2562b406ffd17295a78ad5d1fd020000000c75af4788d74dcc467c7e602e27ba89a0f0eb93ac81d90e9ab8af33816ad124d40000000c6794bd2449bfaeb4e1f1e4bb10ef573517a68c11ae16c7c5f409e7322c4103ecae4006b67998a736ce0fe26a5718b9688fc3c38b4a633a829a9ce452ac249ec	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fef6e543afda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2232	2188	iexplore.exe	28
PID 2188 wrote to memory of 2232	2188	iexplore.exe	28
PID 2188 wrote to memory of 2232	2188	iexplore.exe	28
PID 2188 wrote to memory of 2232	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74d5f0df7bd91f6e8af950541f44ed36_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a583b21030aea263c9a3ce7f0c5967bb

SHA1
335b7060ec0cc2967fb4f1750c602f50bfae6744

SHA256
f5525db976e113a1e0dccdf67dcd92aa2d4c6f90d839d2af201eb1df2983668d

SHA512
9029208f1f8d57fcb8ab9583141a94889dac47bd4f3414fe2d633f11df50c49444a70d01f2de564b56ef63cfe4fd5647165427cb00856e54724f71c0a403244a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35934944fa74720feed29f823d8b8d0b

SHA1
3c16fd1f245fadf8f3722d4002ab876055adc92a

SHA256
6672b509685cc615e9d4c191addba48f7ba5a2e7bf5e926fe460bcd4b88de9e0

SHA512
96bb171a48ae506b804569562c44197347893cb634b5479bbaba74d010f462c7435d873850c817388ef91f46877d3b5908f1912364c9555ae4e42ccc847e811d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
656b9452b130e2e0cd95eb69dc328760

SHA1
c0ceaa6b5bf25b87071ad6b54e723d1188b1312a

SHA256
eecc9a9d74718d1fdfa1cdf69de16f55ba13567eea7e1e4807abe39351a4a597

SHA512
57d2f0751d5c5b05d5373826c5cda3015b76473155a796ffe7b21c2d18e223413e7adec6087125d586921c45a245d65a42f68eb6b03ea14176d4dc5968ec3042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e230e10ec679fef32f5504f3c08cec87

SHA1
12ea9603d27e83143814565dd46131901b6cbed3

SHA256
5ae11d921ee8d0d2779d1fda9881b00a8bd2686dabacb82a0f1e28943a663313

SHA512
aa21fc1c54c4236962dc34f3bbf1c7cae1134db7e0949a9e936742f730399e97f593067e9d0f5ed245dd24f2f571e8587c562c10b0fa6c56ccdfee6cee41063a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
876502a8c4b90c3a988cc3ca751ed118

SHA1
ac7f3c60e854c0fef64cdd7ef7a4e04378760fd6

SHA256
9688440de751b5ba106fedbbc12bfdfcbbcb8e1a229d45c4f17e869fc2be073d

SHA512
919986bb17774065a2558863dc586ed0dac38ca65869d3efa7d3f803908a0f0f933dfc816206a0d06318300d03e14f494bf550cc8963c193bc8ba514246629d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8280a9d42d18f87a17cfdad35715f7ad

SHA1
5d6433822c26c66a24a287e11e4bd747c4695775

SHA256
1674444112ddc72f0ebc224baaa9134c3780828a6b469cc5435e05fb026f2125

SHA512
85af3a249bd0e52acb106337469df9f25c5b8d086e08cd00b7dcf1caf433e78f4d18d3fd0d3532d58bf60646f5468be595d32819a9134ea83f7ea5814bed0fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7395ee7d54f49c5d0033132d2fbc544

SHA1
1296f7d270551e9662b0c6533ca70983917327fc

SHA256
3b539c5fe05d7469c901ee834f05502ecdf721293b6fc434adc30596d859d5bd

SHA512
7637ce79eb36cdf63b57475983884846b5adb706eaf268087e581a49f6b1f6d55d4e4ac749fcf3a323480def8b9623a3aa26d870d8199b1d60ed447bcf60f882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b295daa73f6783bcbe081579f9cdb581

SHA1
51c39c67e24e0f4ee30cce514ef33d1e66727e0e

SHA256
3b04f66be392b2f2a836c5813fc29ac90ab37d41421bfa2075ee8e50b11cf01a

SHA512
d570abbbe722e44ce7ee72b62c7cc40519fa2315923fb79dd6df3d148753437b75cbcb7b6d5e750d85eb0e6a86005ef2708cfc883fb922c7f1768f88e7102eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da3664f49dff880042872b27a962de6e

SHA1
39552bbe62c163b356bdd915ec9972fa20e899b6

SHA256
834c353b45969b6aa5cc6ae005d7c38583203f3b49f503dee44add7186b4f482

SHA512
225f1645cdbf80d24e1cf7e52a916b8b316bad2d335315d8c9ac6f2e88f0d4fd72c6bc80c1211e052b7f87afd7acb50e19302cc38c8fd439f3303b1222d01177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803fd2a6d89afef2095ba84f373d71e6

SHA1
e0273bc0166d54762e174f9502eba99b627d4750

SHA256
73a03a5448d3e5f9f8c2676701f8541bc4297b6950c959280361dcbadd724d3e

SHA512
03f204ae803e54b1a096c76e806ebd60be753134ea93f7c879fe3db8fb25f995c31ded4f3e5368db1f78b65fc446592fa103a4135549ff903cbd02c85b84e13d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
837f3c01fc51ae586942f3f8c9827533

SHA1
919b8d6414cd248ebf851597b18efb630e8641ca

SHA256
b6dc64db45b1e74cfa453ba177e895686041c064280f0ecc7f2ee21a7874f6ad

SHA512
2ebb5a61e8db55d2c070dc5b0872c79e15afb0a1247d140226177433a4b703e7bfcb170d203aa125e22148243c30d737382b5cd1a49369098d198758b52b71d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
807b55c68551f4158923db70d71c22e4

SHA1
a8e396614b0e12bc3309b1a22438555fef62b0fc

SHA256
d2629847de0c037b0fe7418c4f0217d1beea05850a4406adf0cd27719e6358d7

SHA512
f287ba77282c0cd999576fe093e48f519b23b4fac6affac9d2ee95cd1d1415e5de64f97afaca3532ec9a94f56c76b2fd3b94b997d00cb4abc2eeb915edc78984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fc9597f80b1a2c580121b2470ff2949

SHA1
7c5642a3ae0d66e2348028534d16d82330cd2c1d

SHA256
7f9ab7cc716f16265ade3fc41ad1fcb19cdb9e3caa55fa130de226a33f8d86e1

SHA512
91ae039a4794c2b5f56603a06adeed85b6f879045fcd54df407d58ab013af05451f6e52c48d990eb7251493d0b3970c674c0ae240837ea95d83b3bf8e84a1d77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d33e36e96de44e0b97fc3481087d6ec5

SHA1
720b74de4ab87eea417ccee24c0c2b4880bf2bf7

SHA256
f8e03f7c0c7ad54f4125250d62b76d3dc53b69fa27b46b490b23982d89a048bb

SHA512
c1f83d21db7b051928c78e2f674f31eb9d836e505862bba1615dee3347811723827f486bc74ebcde24a53a504338b68f76ab9b852eb3aba8db25f13e25387092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa7916b9fb35dcf06733b914d5fb3d4d

SHA1
23c04be9377e5ec4499168b9718aac3e261f8979

SHA256
d3625743d8e189075b92b49acd36358d5c2390cccf2bc4a22142f383de5707eb

SHA512
8f5cbefbd571037e4e9c306ba9a31c4a35b5e8336d1dbb14b33882eb86884bb351938a045eb84d981b5a7d5aac4ad9709b44123acf7f94aa473f0c93d88a2b3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fb72eebddf723f6ac99863fa18341dd

SHA1
4c2d32bb18b561909d97b70921a89688121b28a8

SHA256
e9ff33ea70b7b5cd61e281064549044ab5a2b9a09841e746ec47e0f8ec85685e

SHA512
bf9652885cfcc98b49ab892505a81d98bf0fcee6a1a2de33b41f52dce48bc6cf1e043044a5d71dbd8739f065a289b834ce445a4bd96a6cdc8a2abd2bf194fc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCF33.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD092.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit