37882db2637f902f5d022a856cef3c97f7fa2f3432f7efefc20e1a8c5ced435e

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7abccf31d242b5b9ac54e6c0b8be7b25_JaffaCakes118.html
Size

28KB
MD5

7abccf31d242b5b9ac54e6c0b8be7b25
SHA1

ed03b797679430655877fae3c35de44440e09bae
SHA256

37882db2637f902f5d022a856cef3c97f7fa2f3432f7efefc20e1a8c5ced435e
SHA512

4c1dced13873dfeb23d132e5be857c7d98c93f139d35d6f3f3e2d82a4efa28789a27fb3b5573ed355de1f255023da3d89678da7615026808658fe2edef0155f0
SSDEEP

768:9IjTrf5tARKptf7eegVOXXuJSLMRpJTT+h7:9IjP5tAgpF7eegsXXuJDdq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CC3BB41-1C77-11EF-8F47-7A4B76010719} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f04a4284b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f50d6d6aac1e62b1ff98cb72869c90032f958b8a3d14474870f9542a31b6e6e3000000000e8000000002000020000000816ea2b344fe7b897892f70b5bd8443a6c3ef01abf17320e877276680b17a85820000000c75a3a7151c7b4bff7980f2c5510c34c4dccee2f9b50ca2d4ce5fc5b81b73ce240000000e217095abdcea3fa5574e92d0c83994dfe752f5e92b245ea0b0b3e9b44431a53392845893aede969d00093a05a2afcd8aee59e1107d45a3301558605377512f7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423010313"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006134727c6a9001dc216e1946bd26bb86591f21548eda0f4ad296681785eb9a97000000000e8000000002000020000000d4734fb7b3b364d079eda7e7f62c22bfffbceff01f50e0ec1a52ac5febe1e178900000002bb4e76ea71e1025252504d2760dd016e6ac6f888e2cbcfcc6ff384670449d99f82f90a5b9cac59869ca4ab6f864ba8565237794e75dcff27ee9a755e2ac77eae8d7bdbe8963aa664b388370e33a8c70b1baf48700a296767783b84f9a484c1e9dbb18fed8b1c435fe5768d6365ae834e66d23f36fa1b4475c266a12c639dde0b7dd622145b7a409ef22ac539c215b02400000007dcca0ccbec36d63bdcd19599919f8ef3c999115b7f3181e1efed195060eef53f0f243a7ceb05ef17de4ad7d043a9fb9b2bbb10c76ecb163a8cd33e63767f65a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2144	1728	iexplore.exe	28
PID 1728 wrote to memory of 2144	1728	iexplore.exe	28
PID 1728 wrote to memory of 2144	1728	iexplore.exe	28
PID 1728 wrote to memory of 2144	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7abccf31d242b5b9ac54e6c0b8be7b25_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7214098959addd68b1c524c32bc55fff

SHA1
20f1def1b710f572875f86b049c774d3e98735b4

SHA256
c2a745a248ae0a8f1a9fcd3089ad33f7fe2793587bdf82261b63e5fd6ee25d0a

SHA512
c9776731a3d6d40f83868fe0889676aa5de6c5d13ab35a3bb7f3d9c6e0abc0a5c0ed4836395e4de049269e78a9435e29a48b81c10e37a2bf2a2859f8afcb8190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f36edbe9579db855b25e9706da411ab

SHA1
bae2463dda25a45d9dc65ca35c3c58c494cc95d0

SHA256
42028999dcec530cf64a6d52ae4948ee2649ae936ae0a5a8b438220ae9ee0b79

SHA512
0ecc76bd46f7a10bcea0d236b072489eb077e6118b7e1848a71ccd806898c3aafab0cb63664f1a3d34ef20b9bac5c5c680f1a7db5a2bb32ca03e0813c817d3ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a72fda08d563593f0b97cc0701e5fdb

SHA1
7612944cedd695cc54b038d3d5c8112bde96a6a2

SHA256
f2c13e6ff2a1c46851618df38df3a6ddfb268bef55d6f5438b225e00927edc1b

SHA512
3235f9f22dce95d3f53a0c524efcb3e73a627aeab594f3cdc32478ea5d294a5e483d9f3d1a32ea7de163f872980454ae6562f68a337c2ab756cd6b840a1ff985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a53a87bcced733e9ad47b4f79f63f1c8

SHA1
fc9cc5f5b88dadaf711c1c6c18ffc698e613a420

SHA256
313f3515b0366b226cbace32b5ed2c7eb740f14e57accdf20eae35610ed0532e

SHA512
4307dd02ab3aea42936326eafcb082a6250856ea557c521422b32f02c31c25325dffec833a1b5ffc25d1118bb6bd201715e6c078a9f83a1f302c2d4d663eaac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99df03c12bc31a54a6bd34edecf4075c

SHA1
ab3f99b203326ee447d818e9d4d85253c1368268

SHA256
f02a27f7835c3eac65e4bc55ccca16fc4376faa38f278a2e53e65e5e3514f376

SHA512
f88a9daeae14da33943f13f19b52c7564b27c156db54e5977c3b871061e1f3bcf9dae1dec6886547a047fe204a7bbe86820adf7d6d5198ea14fa436965ed5e98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3840547b3f3e92900359d130f57f197f

SHA1
834b2f92ff74f8669e76636a08bcabdf27921f9b

SHA256
5e2d8618110ff63af65c5c189294c1181bf08dce0d376c933a592817afa3636e

SHA512
5781173db9f0003d4f72eb1bacdca2dc40b51732fd598939803bd1b63427a51079e5ebd19555d14dcab14e93c3f53dd1829bcd0c0f5bd2ef8c710249cb0a95d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a052b1a6d7bd57c4634f7043b199edb

SHA1
b90da0870144e70575a8f6237ec98fdfed136a77

SHA256
4baa03f110bc74c42b6db31526dddb376261ee67c8c2d5cfe8af1bb4d3446f94

SHA512
3c9c13322b881e16742511af9b38591275fe2dac2b3178125a314143ff423ad9183f997c68c85c6099757368e1123085f9c660482a9fcf0a1c7a1d301e436cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4985cacdab2efcd52a8d5bb6b4351a2c

SHA1
79a23b449db4939686008ced5d19b009152537fb

SHA256
5d9c513e5b05d675503eea321d6a5efe480fb40139e7c5055d401d3fd8917f3a

SHA512
25de3fa9f3c30169873b485788587179ba63bec776483e35dbc3d4fd29a567155c6e6955d70fbf273ff27ef7219fbf5b6a84b1f69de469a5eed10a96e88c2287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
327f76bf55b5a31071b6e59a19975b8d

SHA1
38e0be518408c95fb5e82e7ca5caf6954d6e2bfe

SHA256
b401b1d632cced566346082b601383eaac58e047ab343be85ba79a08759804ce

SHA512
b9d1a5096842b13802cbabce2ec05a190214d24579e6f9f7331fd9e4e2b7a3218b7bf8afaa6f8eeaa72f34e376fdd5e8421179782d5fac98d8c0027dd167bad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0969012c61214fe439eb7ffc5a41a4b4

SHA1
18a2f247714a4da3dbf95d8477b48b0927021046

SHA256
8a32c48d5473823b3722cbcbebc23e48df06178e550b2f5543df864b76ea17f3

SHA512
77d7f8075ffb224a40d2268a8faa62dabf44ca8302fc312cb7067136840346f2d72675d71cfa6c31553524e8adaa5796c195318d959716648bc9da1ff7e8a508

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
596a1e66ab114c64d5345edcf8d865e1

SHA1
8b681660a0fb6b7e21663a57a18ba62c41d413c3

SHA256
802f9a85d8ff8577f0dcc1c50ed9ea89e2a6131fd3f16f4a5d93b809ba164135

SHA512
ea66eb983cb3c9a42390d6660718ac8c23172fdc8536bc037e01e621664f4f994f9f290186c416ade8ee23efb4fdf145543662298f85f3d0a9a304dc861db6be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9da3e2a2ada4bc753ae491089fc10b1f

SHA1
92bed453a13e5860183dab521a290c0e471f5958

SHA256
6c7fbb492f68df9aa7e16981f95de5b8463509579afb14b9d3f32b657701f43e

SHA512
95435a428394e3791bf5aef1a0662f49c589fe31296be13c5f80f3883fbaf1252e7e7afb86afaf301e7496f630377f778bfcbc3e3d4458c01a2cd1e35da37cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f00f1d706bb2f7ad6e155710624f291

SHA1
a2b626bc8274facd163f13c69712fed829c62459

SHA256
8ce612926b2b34710c87d1d858f9dc910b3503398d616c2d272271633f3a23c2

SHA512
acf0c0a61a19454963a9352132c8c6726e7979aea5993e767132373856d1afd321239e3eb0e0cbb051dbed9c7ea45fd71ccb7a204b1b1140ede914424852f65b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e811ca6f3b4670293ee603f456de634

SHA1
2893558ea5a050a779a81bf3c172315eb18dd041

SHA256
8aac67b0a93e51850d3ca5c5197dde09f51b2b9869c451edff902c88f60c359f

SHA512
5a45979e30981103735cca164f6febca3fbb6d012ea0c5dc60f52ca71935428c62ad23fcedca5c98dca78b1756d5708304d0f74dbec5d92735aefa480bd3675f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d444f76d9ca56c15b4e783f854da44c

SHA1
13af58f07cca498fc95b00fd62d8ea361570d232

SHA256
d89921b7dd50a2bfe890619190305a98ae383f2f4fe2ca4f59d0444ef6311a81

SHA512
f591758b8707285b90684b466b02be585c2c97f01d963d6cc97abd0b50bac1dc48563b555164258bf8a284f5874f6241f059852823a82d0bf430c1a9030fc041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
70d904b5d518d81a0ded0b3bad28abae

SHA1
3037f962e016b13adfc821f8f32017a61d5dca73

SHA256
45125ee4326ee6856fa1dccc35cb80f163336004e6fb63b81351f4883fb09c9c

SHA512
c7b40588a895893af2b11eae979b372896141ae16b89acfcacd4c2645f48af295773bd12169fdb72489ff06263d18bb2d191f5a691adf087a126fc291b26a52b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\jquery-1.12.4-wp[1].htm

Filesize
167B

MD5
0104c301c5e02bd6148b8703d19b3a73

SHA1
7436e0b4b1f8c222c38069890b75fa2baf9ca620

SHA256
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

SHA512
84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DF4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E08.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit