e9c24165693979004d4dcad80a9ff036733161125847ce1c4b4d1daa8b04824d

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75b7e92d29cd9f78cc1d08a742a25315_JaffaCakes118.html
Size

14KB
MD5

75b7e92d29cd9f78cc1d08a742a25315
SHA1

7484d99e82d35ea8b970b5d9da31f0042991da6d
SHA256

e9c24165693979004d4dcad80a9ff036733161125847ce1c4b4d1daa8b04824d
SHA512

3846e8c457c02b6153f60548a869fa263158b394e87f5299173165a4b52104c36b36a8481a27e83daa823efd48a0f1b6d5308556b15a9738f374f7180d2abe6a
SSDEEP

384:CyisfvB/FMiaiAi7hy1w6MX2NB1xlizUB:Cyish2iAi7hI5Mg1xsy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7CFEEE1-1B68-11EF-91D8-D6B84878A518} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000076a677c140bc7a206956bb06dbb890130c8f3b896fec19c2ca017cb2ef5547d3000000000e8000000002000020000000c167b5b989190a155a5588b1110d67a29aa3839de90127a92206d874d83c5c4920000000e5145bf6973c3398d044d77fb3450db3089c433ae0517dc090b96610d9ed6ead4000000018c19e25ce6759fc456364c782b95aad4894f6f97f72bb6627621777a15d22673dddf27239d355d0bb6b6c80967fa0befe410e17511d4a642d8b03f1b81c596a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422894125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05a9fac75afda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005fe85fd1d940db9c2820268f3f5e32c7a64192cf59f5e168bb50976038b4d8ac000000000e8000000002000020000000e825e64863874ad8f2ef3105489e9285d30c587dae7bb56b53a4038942672d9c90000000d964ed595fc46b38c095660edd66fb1d85c75af25fe819a8e3c400ba20ae718d16966868390e0db366b1187aa16fc01c790731ed43f95687c4ddf6a98e96618d40b3b39fa1688afeb8daea8286c78a0786d81188dcee3e89abb61b6414924854f9bfe71e1c184c45212cb8a44608ef0e10a7b350c130f2565b7ad78dfe54973353e3bb96b5bac47aae2e7afac868090b400000000b02c63df1e572a6661b236298e93553e5f41915c594ae656616008f0579033badaddecb8ef978a0fd41997cd2f795307f65e694f61415b9f86499d129a96c20	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2820	1680	iexplore.exe	28
PID 1680 wrote to memory of 2820	1680	iexplore.exe	28
PID 1680 wrote to memory of 2820	1680	iexplore.exe	28
PID 1680 wrote to memory of 2820	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75b7e92d29cd9f78cc1d08a742a25315_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0763de31e49e56b05c209450e35175fb

SHA1
fb3ae749da26a7725d7af9702d68d3296e73cc89

SHA256
84581bca9f38ac5824e899b6b80bb90cdf36b20a10c825cb8f652392e6d6813e

SHA512
6c89f1f908cc4c98085c41f09c665a324b068289017bc3f838af40c8fe8b6aa305fe40ba3ff290807d113fe65936e2ecade66b6eab57ef1f29ea84d313631668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c362aacf1801bd606d0612f082404e1e

SHA1
b57c24a40df2e4acd60d22f9933ba2bd9e9130ac

SHA256
0d7e73439ede0bf10c06c41efa298456b70c83d52986bba3c7778e771d6dac45

SHA512
3f2ec0cc9985815d9a0101e4b6420f3cd8c67be57773429a728a8cae1de68d63caabf520fbaa23bfc44934df5c3a92c7fa6e3546a98e9b6ef9a88abb09d998ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23d33858c53288dcef0956dcc90da171

SHA1
90acb5c8fcaf99a16526fd4bd002a99707b6f13a

SHA256
db300ac3c618043a104c464319c06b595e8152bb6e900e184e8d4c4fd5c4542b

SHA512
7f7ce97e2667c784ef9114d9ccccb1708dcf64d9f94f0d4d478bb03554872a812c8c956954edaf9fa0ceb2d6f85d0496da9f67e8233f8e675ca07793c2b8c890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9a96730d6bd1423313f9d03fc211454

SHA1
b2d62f4485044c48643ef45c759d1f9291e6fb94

SHA256
27c929eaa3bc1a5de40b3fb74944884ab3e050a2c604a35d91b5740d0bdf7637

SHA512
ce3e5bdab629f02ffb9d84fd0bbad86adfaf9269e2b9cf35213684408f8c389f17cd07624cb47eebabecfadd7973cd2c149f7e326377e55d91e7fa15a29a3973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ad002d3c802b39af26247d20f43e174

SHA1
cd9fad7222ef089b103ffd32dad020b99d0c764b

SHA256
6dcbacc3afff7a5f80e8279859c60137676e068552b8d981adb818f82fd18b38

SHA512
25574d0c7982c4e9d863be32082678a1bab7da092f32c07cd36b6729a419584e8e0b17bbd32a31b6754a28c2477df489ff8683b8d9dbfebe2daee25f7951a348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26734b664605a49c147df65fe91bc7e5

SHA1
0e8e84d12d504c5cc2cefb0411b785b8b32e8d73

SHA256
ec8577aa3d14eb1fe106cd68a276f404260bd2763ad3d006ebfeb56218909242

SHA512
875b4cdf0c208553fcdbc78f133591494ffe19e30544a75a80c9065dcf13cfe9b371191a2e088f352659ff3f602b247920b1972f5d174296d4c09fb4c1e3c458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3314006e1292e514c63f3ecb553f3760

SHA1
8cd55add9d8a4e456fe38d70f6432214eaf9029d

SHA256
db57005c213ab5e4380d25c4caeab2fbf5194909e2206fecde0033027b5a5290

SHA512
466d5685ff13e2e057a3a8d7d1798032e0763508e7e2a359fa8c0972745a27ef5fa366b8c00e938182d88800eaaed059078b578efbca2e13f464c296c3b99c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bcc4250003ff5b04050ff9df4d43d7e

SHA1
96c5e5176cf38cdc209c11e848170ee7e5fc5a04

SHA256
abe3b4d59314e0c51dd72ed65216ba9abcd6a5fa03a989df8d0c7700e7bca05d

SHA512
2e201e98d94a2b37cd1b39449f42ef1f21e349bac05add32cee74b9f8d464e3687448365294778a1362dbe426eff7b1a7099a374a56b938d3a2efdd1906e6595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ad5cf02be0d2ade6eacdf0bc45c54d4

SHA1
0874a13c01a59f63b30954b78bc0f5fefffbda01

SHA256
4d88e779b2a62f2b8b07744aea3d6363984d292934c6b7270b0ccdfbeb7b487c

SHA512
50e16c3980e41a6855eca2d787d7ec825fe74c577142a213813161fb3dd1ae10a01bf33d01986df63819e4f734f6b23544573194fc4ab3e12fac64f4a0bf990c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35343b5772d32519f73e681e68a7e1f3

SHA1
dcbd9d59995bf9322cd11d4290079a67804996b6

SHA256
3faa69b79cf557b38d5c926bbad1b1119d21076476fe21a66833e8775a627f53

SHA512
90e74abf7abb1747d71f962c3e56c58543a6bd170d56fbf910e9c088f69f46103715ae4b37782fc951713d51343d6e21524bfa3d0970f6ff93a619714874e32c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803d3a05a1263185af5f6dff659c5cf0

SHA1
ac3f19a9209620ad0728a06c00053a747009b556

SHA256
0766383b6fbc7ebea71741e2bbfc6e377f3c3f6744007b9b2ad1ea0daec3e2a9

SHA512
eb178923b517a9e15447284b20092abf922b6268d6d2350d716bbfcad659b779d97f195e63a0104e87e10e68a0aeef199c90b589f0599a4222eccf85a347479d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d7fb68691313d65d290c3dbb08b2a5

SHA1
0344111b0dfcc9c763ad8d3269d5fcece731de0a

SHA256
bf0df12f9a8c4265cc5c6809bd423906c0e0f5527d765106f3052c429de056cd

SHA512
cff968c87309e43d3184795d93b19df923d01a200b5adcec02c4134dae9260f7f925c7c6891064237c55398cd3e38c9bd49a8e9c04d18fcce09f48539369f80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e7884599e72a9e5c2545cf7d05ed375

SHA1
6c55f95ed62f4c5b4f56882fbd3daea88a7679f2

SHA256
358c185675e3c9a61442946234dd8a326e5eb1e7c92d5ecd8db2336b589fc6ef

SHA512
1547059326d6cbffc66702b8e360c7c8e42a546a54900227128aa4dcc94d13581380d1229ce3f2ee1e83d27287e337fec1ae0db78cdf11c84d94577f63d7815a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab340E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3421.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit