74bed3875cd72a1121b0f990e59a1ed5f87aa42a42ca20684ce98cc2ad44171b

Analysis

max time kernel
148s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aa2f5624a1bfd3a312e35d9e7acec1e_JaffaCakes118.html
Size

122KB
MD5

7aa2f5624a1bfd3a312e35d9e7acec1e
SHA1

5201531bfe37bf5415b9955faea1fff4dee971b3
SHA256

74bed3875cd72a1121b0f990e59a1ed5f87aa42a42ca20684ce98cc2ad44171b
SHA512

96d5c05172b67744e24f93b07d5df9bc1df5ed92899292ace8cf729fa44e5819d2a5a2bfd32fa70643fc2fdd6072b3bf30e5a5b88d8dc1fd418f805dd5e2b183
SSDEEP

1536:SC+utaEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:SCmEyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{317177C1-1C72-11EF-B837-5AD7C7D11D06} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f86666815e6f32c89fc8f34558908980bfea751c1d9b0f11c6790502aa7d3604000000000e80000000020000200000000a3efa6e17addd43f46aaf5e073d8d55c2463be4fbcf72c72b63570f4cc85c22200000004436034f18a6ed17ca20a70210b71338bae6d04627afbdf02651fba9ab08018d400000008869c2e7dacb5f2f370d88bcf31b874453e2845a790aca175d27bcb2318b718bf12d8e246d08935a9c6d19c6b6a0484590bb46041e57ddfb2def79e6deacb042	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423008095"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b06f3582819ddae16441dd151a0e5a3071c7c8b76778852c07701bf5807c33f6000000000e8000000002000020000000a06cc0f0f7ed4c737f7697ff93399724a2741eb9360cceb4fc0a3afb25cd9c6990000000424d9238715498e8f486b80b8a9584286ce7887ed4c2b535c7815a96d4f4703113f5509fb56d4cfaf9db2df6bae339273c549f040fa40c8cdbbc9abfc89d605a4808ec200bec934a18fd1cfc0ea5843311e6a00fe4d7680ac3715adc18d690681469f2a5d8ffbafa3fbfc313b6bbf07a5031e7a0add6c3226a4334868edbbf684d57299bed7a9df63906664a670329a9400000007ab02856b1a2c357b3e26fdcee3eaa230083d2406d894c78049ef811d1ea27c00e6a355c50c931321e348e46d7e2f20f1ec82f9e9357441e80eaa9d01f1d5979	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07ffc057fb0da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7aa2f5624a1bfd3a312e35d9e7acec1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2bc4684809a747901089b895a829602

SHA1
7daa585aa0e011607d4abeaa005c50e2d520cbf8

SHA256
6f6ae628480e50cbd567ce9e42aa474eda7e87749ab4208549c1c11f100ef56b

SHA512
1a5eec34851316b3ee512dfcf4ca165547881b1d846ef2597fc9ce2a4b720f43baba9429c6d72ad282a958995249b1af8faf1c90499c8c0baa290f33c669022e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d8d0923dfa5b5d95dc058439d03618

SHA1
e895604dc09984098385397310072aa9d91d57ae

SHA256
d3da2a3c2d6c5a6501f6f6ca5edf052a4802e6828280dda57d6613530e5201c1

SHA512
37aaf10e79c3b72b1015cbbdafc0182cf3152ee0671a8295fbb79a137c17e17747558ad0366497813b6a507ba02bb25ba1a435c9d22071ac410b715c685fb5c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c3fa9462d8e9f74aa14eff4650c889a

SHA1
30f484f74c6ff73cabed531bd4d4dd5fb0f90b8f

SHA256
d7f8acf6a7d0643b7e3e3994919c3367408bd406ce525d8e704eb06876f69f93

SHA512
35ecad928166121c38b66eb097f4b151e15fe95d89f8e24f4bdb6f971606ba9864374629fc62db184702e1e9a1124aa88981c3966d7eb6f54edfd3e5cb5b5e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
646d64b32090df3b4bfd386fbc0aba26

SHA1
84c85a3616e7873876dc4ad11a05249405f76659

SHA256
7654cc0deca7cfcd64a135764b8f6a9481e77a39efa043a709610c72cdc6f5c8

SHA512
09c5a43586913d96dac6cdc7e68e2d0de5f4534fd44edc1e45028fdb826d4cec000fad1ad95f3a2053dba812005ed81160f3efd19abfc53d22a63045a3cd8637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90a2b43d6eff234d720aa13cb78bb298

SHA1
2d7e26f77892b77005808509b339a341f971d591

SHA256
2fb50f65dbe09cfda12189a9879afacd231ac2fe965a70d7420dfc39e8d05a0a

SHA512
dda9bf381c29724f0608c545390548392042988288e75bd50147e8b334991c825a81688dccbd4c6c62e5f1afdd4b57b75fd058d5996de8ee18937e93190f15ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1fa825286e5e93e1d626da9d2cb8131

SHA1
adaa43e240eb9d1e2b813903d55fec94812f1922

SHA256
1743effe6b78765f1a2f2a2338d7e2d664056205b7a58ef1a405ab9ec5b824b5

SHA512
732e2a1755463965754fe25f5c1533acc28665060208911cf065e61631f162256668e6366d274ace69f4306632ce1daa6a1a8015ef9816e6bce04687eb66f70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88ec3ecd9bec5e01b5f60eed851b221e

SHA1
f30327842bee7dd7fafda086fd689f799d82de9e

SHA256
1337bcbfa65b59b93e7eb4771d52f561dd82c248dfdd65b953e8587d5cd03482

SHA512
0081d40918839c3e5e74d6dbe05206b534b95a1c2f49180002f8fa7bccc60ae6021183b1653a8e5bc0f25c32bd5084c6567a4e474e937cd9443780d90921a5f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78da6c487ae8e85642797abf7e6681aa

SHA1
022e08028ee070734e8e5bfa49c295ba30b5a5cc

SHA256
d51ae75f7b1ad929cbc0925c27a41a2c779c556eaa81d75bd5d3303b32697512

SHA512
8f94dace25441714dfc6aeea2e4baf999548f2fc1cadbe6d76dc3d1130d57e4d788b9f2f68ed5b5c89b11b88ed309233e4dfc3582e40af94e394cb3699c288f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fafe8b2c3f5f604d785eadc1ea4456a4

SHA1
025a89978a45e0ff28b4822824817cfdd3346b64

SHA256
f8e72609a27054f255e57e2db3001fa7fab753b0194dab5ac9d71b08b8503506

SHA512
1bab1a25c6e178fe826a261719b39f0295b20a4492d106b08f98666611b8093bcd69007e110d8ea08cec30f9124eb1895573cf658e9a0c25fdf36e99390301d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2d5f17c8507213834af50dd4052bd98

SHA1
1058f8b6fa550b74a25cfd7d8c267b1cb4857010

SHA256
d775c97a3b6d555f228fe588d294084f025d65d7884dc52ef7a42ce777443bce

SHA512
41f6d11ba289d543490ffb4c687460d28c280318e69e41e0b1b2e77cebc00a47d7287d72c732de0d71361023759a1cb9463074672180df14a6f89427a9ea124f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64ee994cb83ee103fa2b2b7562176521

SHA1
5c32f30ba8573f336766d7367962b12e38b2cd2a

SHA256
8c6f1287daae48706a71edfa6582265a4cd52820b4bfd0d60676930179603145

SHA512
9db85d1dee155e3076e976ff092f4dae3139401131c3e03159612387ad0f582b2f4a74c8fb51bbb8a6543a0d6a3b69d791ae991ffe5a3b4ec5134152b4f731ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29345dbf52b6703b483abb148245e1b6

SHA1
93b1a979f8cddcfcce1d83e8b3c548131eef1978

SHA256
de5a8281aebd1b31f15ef7cd8bf4b85186301b6da295d55a7527830b4c855ff6

SHA512
1c6590aad61c2e250024c7a9c2a8c210c38dc3e8ca03eec418b1861a70dc079ce4187086b1f4417c6127ac0aa5931a3a73fd400cc58172521e005ef226daac78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6a7efa301879df4493a32adbe886f46

SHA1
f23737def3c44dd6839e906427f11a6ea3ebe58f

SHA256
238be1964f1e575e2f5b4ca05dfbf754ed579b6e227c1addec712bed8d650bb8

SHA512
a91ae835565e344f0b99aff207b339a89d394f2d346736a20b96c0630519639e93df24f9de21948505b4b5fb6f12a3e569878da46fd6c3fce5cc259e07371b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
136d13463dcbacc8e784a9323e58847e

SHA1
f77bf339164364ebf30f3a17fccb93fa08abf61a

SHA256
0e43926ac0f67a3a81df9c752fd3f2c65c6658107dc56779b9f169190b9bc1dd

SHA512
df7df49457c278604f4d55dc19e9381bbb5d04e6df7657a8cc1ac6efbf33179fa202fdf6a39d598cd42c9322736680f0b9d6b20155e44fd4ff4e22f2ee2b9903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c80cab31372ddd180971e84a2075175a

SHA1
38b58ce2b14e3f82e3754981784c20df1df04bba

SHA256
8606cd0a784b91032fea60064f4d515fceaccbf96d4e1ba3413975f23ca46b68

SHA512
59172036d9a925d49a6c572e14a61b511e1b1b77c7a6979ee9d217f4e8fcedd06c377aa859f36262b65566c2bb658c97846ec89ddfd467c53823a2a9441d3439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96221f861ca02731a297e3df1cf84f66

SHA1
62dba9458cc365011d6741029fb9f232287da1dd

SHA256
fb989a2dca676266467ed54468cf454823f97326add196a7d645cdc492652a19

SHA512
ef8d1835809806e0623fd0e80ec93a90940efbc5c71493f918ac97f9b080c2e07362ed9f1d504b685538ae5808029c05ae638eaef0c2e4b6e6428f9f1d83287d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24E2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2533.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit