5650bd67b2605780668be4fbf39fcceb3ac99ff9ebf71e9853493c9eeec17716

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75c9de98e7abaa3cab59a890ada1ef6d_JaffaCakes118.html
Size

68KB
MD5

75c9de98e7abaa3cab59a890ada1ef6d
SHA1

869391bb567d5f4dcd5875cd3126c1bd1507bbb3
SHA256

5650bd67b2605780668be4fbf39fcceb3ac99ff9ebf71e9853493c9eeec17716
SHA512

7196dd2a69e23dd205c011c5004578b5b5e558f8da39db7fb6e2965baa7897323a26a4099972e57f164d096f48646cca3192dc4211c7e044597d85796fdcba3c
SSDEEP

768:JiqjgcMiR3sI2PDDnX0g6Bp7Oj8MoTyv1wCZkofyMdtbBnfBgN8/lboi2hcpQFVh:Jvs/ABTcNeD0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000000ec859dce6a8a3ed5ccf4328f11dd19814f94d4089ff2b936273b91d7629c63e000000000e80000000020000200000001bdfa811dcfc00d48a16d91669e5925e61227d0c66e32bcb183a249e663cbaf890000000472a865ebf530d527a44485106170dba03d532615cddfa072988248d1e3a3d0628bf90f74fecb87587ea7be447f88b51a1f35423efdc8f6b50bef899768074c0cbe77aa12e8540d4475258391822f361e38e6dbecb818f0f637a5d1c5134fe481a89decd4f1386a6c1af9c64058c21a0c371523f0d466143b4400cec693e3e223251d13429a4b98e73087a111765ca64400000005b7949e3b13e055a292e9388c29b009332423970bfe421951acfe362783b200e906a205d21b2d872cd3a84f92f0eb0a06965928bfc6b9f2b1606a4cd204418ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422895624"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54B235F1-1B6C-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009a719feab7963c08205782632f2d82b804c8c3602ae174b4f6abf17f09b28e90000000000e800000000200002000000090d06bdd03e19e988af2c314d7e2307143a370389b403326194aed7861e03e4220000000fc1f19949c1c645f95c3362d5d30d3140979f98bd59107e33679cb3bc971283c40000000b0e518beb7dfc1027b93f688ab30b7e19414cf5eb7e40c7bca3846cc0b91e7a46ba0bb11e6565f3d1b8bcdd9b9f6db50b4a97f67cfc0ce2320b7e05b65dac9ae	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b9452979afda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75c9de98e7abaa3cab59a890ada1ef6d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a3ce95a8ad1c5aa1b7fd4c648cc32f1

SHA1
c4608dc3b1b6339a1dfb4ba35b605d4eea848594

SHA256
e0373a0ec713824c1e43a294769ced196dba2f82b6e9a16ffcd2ac87881dfa1a

SHA512
526b3b50b770dcaeb088b3ecca91d3c955c4f7eed9e59d6f32e15ecd03549896940c2a0b5c68a1a5f59c28aad2189cccf53b5267eb0ce39de1a5500b7cb7d8f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28576397cc81bfff59cc49f9d7d2cc37

SHA1
655de2c7237943eba4c23a1f2767ace484fe7e82

SHA256
0d956397a0257d7b5f3dfae4e9dc8adf3565242d0da8585af0f83d66602c64bc

SHA512
82590dcb746653bd69f15f47c5f4cd94d457751dd23acd295adfaa4797380be48f7d1ae24ff9825cd5d94fe77fd2f4636d941c1eb5e24ba7888d3c22befb1c99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcc49138ce32918f658bd5a765d96da6

SHA1
032b6267b73622bd75641dc997bdac14757ef08f

SHA256
7fe8f0c43ebb5e2f591039aa7ad0607ed9e1971a59d8c9ca8f6e6d68536d2ffb

SHA512
d13b0bc42068188eb4fa0c5819bbd18e469646a9aa221cf96d6f798fce079cd621032fa8212b37a3ff67736c83234b16430da9885561a3a7242ef93c5d07163c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bf0e29f55ec93d1d4a80145988f6518

SHA1
4aed16d73d9ab424cf28077bde1cf3533e227cb0

SHA256
f9167c9da8d7b3bb3b4c7419a8402113c4cda0f3adb50357dbeb7bc5862422aa

SHA512
d7f16db1602ade4bd49aa6e6e4ff96a14dd48aa530a42f76d8099f48f1a7b4a2fcc59f0950571e505a7c0362aac1966e06859523b2347cdc73057bedc44a0ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
986ebb14f23a2b281a9c4ea27027d93e

SHA1
bc20835c1427ffa1d316db4830c22daf53d4e33a

SHA256
f7470335a43f6edbebcc47a80c4b8204844ad13b9ffbc3e8d40b354d4d0cc563

SHA512
0ed7dd5b312c48782dc1d8431f4d37e9ab8de15676a5268856e00dcbf0a02aa957857855d3601e5f3b46315cdbc8bdc5427b147e5f7a58e11ba44cb1b6dafe37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00816042a4b0616555cfc1b67da01e6d

SHA1
ab3ffab37e416b136e948b2f918ef608d53d1d33

SHA256
d2e775062a337d07471559e7e76a4d109512a27b240394463f7c72e338b3bcdc

SHA512
8f5038b23304043a8d21a3a259aa68f12e6383ab96ce82fb4fbeb55c0f7209c161c24f83e095392bd4b8bb621091f741852b44e92a53f2b1f457b6427e788b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd4e8d779c2919ac00c025c4b37de8b1

SHA1
bb9e44958582c1aa94f58322828a3429e9a3688f

SHA256
acc7a57f2b4414b97ee2fe89f68f53f4f1fe12b106d30e8b078aa25c525576c4

SHA512
a8761bd3917e1b5a2384792725b63bdc28f975d0cd8aaea8437146ddfac5bfca44de5a4cf19bd580e0ad1c814f2d01d8b5dbd011cdedaa20eb19fe478a8c4113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd49a723cb3a2aba1f091bd7cd92e780

SHA1
28f3fb6cddfff1db538cfa6068e3b8f10fc33f55

SHA256
1e8d50072a49f1dfc342f1304e23516711769ee29545573fceefe288037e371c

SHA512
0b7ec6fba66070b3b1448b9748040f7587d5269a4df0732cc946cdb04efdae098355867c0c2131cdb9af9120432e25b562626cb9eb8158d94ca442147ae9859c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be6a6f7bc261776bca43e6f1312d6f0d

SHA1
c5424e44bcce3c981fdb472daa837c314cfde0c8

SHA256
db8988d0f63cf481559e15b50dfb5051c8e75278efa53b8161be154130c33b35

SHA512
99eeafdf539c22a086f83295690e08e5e22e4ba3d1c88adebe0c03514c780014f8e40de91291abad85fb1158bfa692f534874bc326991e46e869c741f0a2d338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ca86372999773653a2965816e81d372

SHA1
ba1ed4a419c5f939325e9a405ac67fc30d675bab

SHA256
2804365296d667b189dca6665931718ffb104b4ec653079c34050dbfe2feae6f

SHA512
ec38010de6a55131f6edd705c90483261c0ac3e2d911cc63247876efed3967301628b0ffb5d09603b64998866e89283c0869159c0d6fdd7e7b944449b4a56c3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3c890ba66d83f7b811e06be59b34a94

SHA1
9b5b9c001c71f6d56c8e78fadb34ff73a87daaef

SHA256
42716942dca663ab058516fbbcc5f2a693e94f65bca3bca2df09d9662417589d

SHA512
40340c52ff88513c96612cad39c8147a761f72611e04800e5ead382a53e8e306dea91ca1ecf4b56b0f04a3b372af85976f9333c038af141203068773d558c659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16c3426609e6cf0765a511ddba7e97b7

SHA1
98415b2bdfe0850e52fd93b386fa7e7eb4588422

SHA256
48dcb32b6c3b6e3c85f2d8455d5b02f4791b855f9a0968c0efecdd622d502337

SHA512
812f9e532544c607f60d9d6d8500dabe6440e2c2b50669e73d6f2d2a33d6e9cba584d5bd32120380a1f5fb9a2ca7e0b1dcba4454fa777bef5f5d3f429661022a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75a171156318060abaa7fa9da1a487bf

SHA1
3e80dd60b0d10fff3547075ce01dd712ad113267

SHA256
4539fbb6e8b761e0d73956273fcbd4e20af65588f6ed5c748f4584f707792132

SHA512
f3bbcdd6eab87266570438a8df19131328222e7c111f65ae67351d329cfe94123130ba11603cdd69a7fbdc926d2b215e745fdcd2c939bd2c07cc35afd9824973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc4ac166015978a9e83e6a091204a351

SHA1
e8761da60834d7dfe8def4427db8ce595fc8bb01

SHA256
e93b42a3bfc66379fc5c5032d9a3ce22fe73f60acf8bc279782e7d48407c5ea4

SHA512
67f45b1239c56f9096c7a0783e88a21b1d670f8f8ced6a1a83fad78d2c2cc63450d0a2eb8a5629a17c5f5059e6548aee8a16c891844f4fb71ff8f173ebbc26bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
306f41814b725f5ead303b5e8b06db3d

SHA1
8dfddf728b4642209eaf3206353a9e435b9aca14

SHA256
03140cfc7bbad609ef7273a00a3a9e9cd88059f78376e5a7f48bfe6bdaaf0929

SHA512
67d39983475261ba1218354fb7b78749dd7d361cb3fd81ab17c7e4f0b302ff47d75cb5a40fe2cad6d496fa943122dcc8bf2fb4f05448dc5e2d4aa17ec964a39e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56b82d2469792d2b5651044507858c9e

SHA1
9d4bc947e078f22d38940b9569efb1e871cf1e11

SHA256
c5f962f784df0d2f21268a038ea14bc8e2dfc3b86f303efff1d23b5787cc80bb

SHA512
b84194201ef674d13e90dd91e862e32563010fe0539142b958f8e31c17fbc2a4f4dd3aa5ed5648fbd73243a6124537e80beaf9a93c3c62f7d6823d8e4bc2c9cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1da8d30aea488e17f38edd93cc22701f

SHA1
8bbcd572451c6af38d57f4edaf4f3a6af9605116

SHA256
d89269b8bae0ce94d1a931a9937e479328b0dbd99b0eceabac019e59f54076ec

SHA512
ff680748d237140071eccb3f9ebd9158f125e635c45c5a50dd1105f5dd08077635c15f996b89ab1accf6c6e50d6ab7b6c0a15e6ce5691078809f5e1cf93611aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2214.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2275.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit