e74aa49c4ea3e8966d40760b174cc3f106f985c7a0fcaae1506eb27b73720cf2

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77544effb543e36ddc06cf7bbaaaddf4_JaffaCakes118.html
Size

2KB
MD5

77544effb543e36ddc06cf7bbaaaddf4
SHA1

b0b51118ad5b179882435317a49863469b55eda2
SHA256

e74aa49c4ea3e8966d40760b174cc3f106f985c7a0fcaae1506eb27b73720cf2
SHA512

01b0d0006036dde234a55cb9c8c11e584785b0b6364ee98337256787f47627a6effad6b74d006defe430309392527dc657aab5fd8ccaec18fe142e694a1d71d3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422931910"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000058bb515ad58f846871bcbb579d84c34000000000200000000001066000000010000200000002bf5811b8d5565381fd2c909b36232e352b1f5c48813a98c8d8f3e97ba03cb7a000000000e80000000020000200000002da266b22d2293195e511cd4efd9a2e8da8dc7de26710de03f3b9af6aaea2b002000000044457fdadcdc7e5cf3e028eb126ba406851dadf74802b5cfc04a3897dde84d29400000000e7c5d21895a11b85cce691baa3d5420ffc3b3df46f19e59cb46cb40b18da41fb703f8182f49f17ee592f4714d10894b1d718805a1f3a2cc512aad060dabb45a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D03258F1-1BC0-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02e00a5cdafda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000058bb515ad58f846871bcbb579d84c34000000000200000000001066000000010000200000006e797435363c48fdbd82be55d127723733173af757feea1c359fa27948ada935000000000e8000000002000020000000e3e8a58f51f2507357d4693d9a91ad7962896bb4e3c3c97710a3f81f0d3f24f890000000321457e41cdb35e1281f512010ccbb40d642b43bafd00bb451f31ad0fe367b7f230e36b5a93ba60b782275d650d44e01f0895d748a83abf1e8c70f937be6b966a93620616641dcb34e97ad19ecf92ac1d1802ade212d0357a18173c2de31e660333ef1e420e1df317fc7abac8c5306a54d9699b90db0ea7cd6fb30c503913045b59ebae83dd545ee3e68efc16ef3a75340000000b550505977b5b77a3b03ba2b7a1a7d0d4ebe6e630c4d853fb7409304f8f0ece7bed183ed4de1440dd35ef78089e3f4ff1d18b029270f1ab30fdb9366656b890e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1440	iexplore.exe
1440	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2744	1440	iexplore.exe	28
PID 1440 wrote to memory of 2744	1440	iexplore.exe	28
PID 1440 wrote to memory of 2744	1440	iexplore.exe	28
PID 1440 wrote to memory of 2744	1440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77544effb543e36ddc06cf7bbaaaddf4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
649befbb164ac8666d29e5df9169edd3

SHA1
43e1a3085cf211c7779cd8103ace89d1a246a87a

SHA256
203eb338b24adb273cccc2fc15107b0c123b241b364ad29e9eb4990498b12692

SHA512
97c1f49a2a8a3042579b812335dcf6f05aae190d91f8c2856411ed4133e0304415afc6366aec6009012ba8d90ecb901943718fe18a2e46280a24e91c74db7c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a2f7661678863b3bf39fcf70264e4ee

SHA1
cdfd408d47c7cced117f41ed41e0680821df668d

SHA256
dc01df909973b1d602d522469b0c020f632d619711b53f53d11eee501c7d4144

SHA512
6304c816b98db4acc774eb3e0f58cf4f166513d909508eed73729f3a0ba22731841938c092d232c585394950c2eaaa489a4b4f342a04bbc6c8cd5f610c573ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c53032874b7d2acb962e520e9bb274

SHA1
b1b6dabbe2b9b430545e14b9b53b82750075cafd

SHA256
e3e43e6b9e9d7eb2c6cb355c6bd3f15f8effd31772e1cfb08e3365165d0aac0b

SHA512
8f98d3c2c0f7915e695a5d681ea52f46416378bbb7e47b6c2486ff6bd43a4e43d5b553da06b5ace61ae6bc0a79fe2ad5bd7c1fe694b855de5b27eb37953af11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97b66ffccb8a76bd0a7863f5ac0e154b

SHA1
e95cc4500f235cff6ad6b0f22fd53e28207aff9f

SHA256
94d542c90f338eb54f40da5fbbdc139e4558608799c918bdd3fcd9f9cdf9d0f3

SHA512
058c1acf326cb12f332b578dd3f6c5ce670b538db86e58464b1b719c0e8d52c28f7fc2778588856787fea17ab55078e1afb146e464de62065e499f3bf1fc05d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2cc448b47dc2f188edf442cd9168472

SHA1
23f28c264d4d4d3041f45cc469fb78c12b2bf8e8

SHA256
5e5d492631b576f8543a276cf8d17ee8a28a09b9ac81fb47c39fd664a49ae6e3

SHA512
d57267c878371059314215352d96cb2c1602e8ebb8540495b582b44a44af4877889576de96c9d292a563a2918c7844ea7e85db4f3d150a17baa34ee9273201b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d29e654942fd428d7cae33a8900059b3

SHA1
ce6716b4642448f8fa6855dd68af6b7b061b454c

SHA256
c87a8b7db03796833719d19b475cd9caebe42d1730b2e5b8935e07ec24f1b2aa

SHA512
b06cfdcb4912c7c24a15caeed8b421fb849bab142ba538782af4c0ee785d180f95e90a803ff5ad757105bb012f694f80de03cf807369eacd7ad13f3f1ce7c5dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d3abde6e3b180be2b49c1acf094f738

SHA1
e807bbb2fd68e172b4d131ae390377a44643259e

SHA256
957668eb46c6b6d80ac45eaeb84abf04c17969d739a403fcf6687464af8719c1

SHA512
c849be9127c2b1f81c7533977ae388288277b54ee57d1b3b215c36b078a5328124c58d7d042eda9d7d1ccdc25de0b4cb0067ef3fca3be14785d35e940beb5fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0302b0f212f3948c75d65bd4dc2a293

SHA1
6a447e4ea9304ddf325803330f65f1a7b7038dcb

SHA256
a70a84448605ce30ebc09135d420c3ff8cfefe34e16c262e8d45e8cd1576c914

SHA512
6257b2ff3abf295b0362904f226a0f6b1ace9478191d1512361fa70c740c336d2df6c67eb25579f3d7a5616305b48c05a63bf24ed16fd476d6c0532ed364762e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb1a72cd74ce752b0034ce81a76720ac

SHA1
f8b64015c186c7ad9c171bb7b8a89229626f68b6

SHA256
04c1593b5d0d53cf80d4e09aa0a606cbb461c266dcf8d1d612a4e26925cd6a4a

SHA512
6e24f92a1cd138ed87b8567108894ad3721450fb7118f5dfb04c8e9d0c9da216ba0ac9b9412fcecf4edba5476e03ecd183d049b52592cae5f208285097acd653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a1d88f1035f87dc2b22f6cdabbd5d9a

SHA1
feb407aef36553f340a40fc5b2c2e3b33a43171e

SHA256
a883384308b10ceb5b788c8977bcd95b093263dd3d6bff03e82154f1342b9ffb

SHA512
fc79e4515e6dfa7a0ef0ee1896508114be02480e707e7e57a26a4282b3bc27bc08eb09364850bda381b3bb9e4890552b6f4ce0988ee59df8d9de804897609914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6f92d5c0e3f2ab5fe988f1f17e84ce5

SHA1
497ca2c123e8d60399f8a90a1ec649fe9989beb0

SHA256
481632bef602f9c49e70a779e3bb1c8ac7bcd88e7dd57e40ca58cf803cf45672

SHA512
ff73749f5668e7c1b6ac827e5bb5fa67fb021d87db7cbe9df85ce95a9e2e4be8ad65a34c0be04902f0ec9dad1b852551a26c57ec4865050e3a2646dbdd98909d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
733723532b1bb320f99cd3071331b5a7

SHA1
a51707934a30d86d55877e06abe8133c84523261

SHA256
b99d218fb7bae6860f937bf979bf0c0b38381360fa155a6ac9ebb363001f96ac

SHA512
a2856c3c652b8eb1bddf8a81229a59bb849977c5df2a5074cf5c0bd5f382cbfe8e2528504c2f428dd83d86ae116c4619f345f2bb95a7266fee1b545726d1e4de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2210767f2486108b58c5a46872b3c0a6

SHA1
232ef8a1b906377a77359f2e3c61f5a850137158

SHA256
0039b29bc7b07e4302d5e6e131e71172120b6d75188712fe216e99f82d6bf646

SHA512
30dfb5116c9a024418f1c8e383e0420c8cd2cfd889d0d9e042489cb6443ee1aea16fecf32f5ddb4dbfba7e0910b082dfe1f8fa692179503635302ecca12e58e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b67bd8911ec26e723ddc6094fa7067e

SHA1
cd46bf32ec3bbb19851a81d926f7edcc0a585620

SHA256
1e6a97231fc6f2bd10c91c74ebda1a0dd0c2f3c62c0f187db4aa88a0dd31438e

SHA512
bdde75c70d12d176fa7ff916a84d80f3b9d1d8c95429eb8781f8a659a8cfbfe5cf98d4fc0bee95f5f46c8d6990f5105c86195ab2b3bd9816b47bfed2a1a593ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae6785a073626534bb4339e377b52f0

SHA1
26c9fdef622d96dc657fe4ef568cc670cc98d151

SHA256
0beaa2ccd277f86dd1e2eeffc6e9773452897a4f93adb00cd0cbe58cb638c4c7

SHA512
25d8a20774792cdd962419c589946e7f2e119bb1dd8e6b4bcc1e680b5e00b23dcd371c7c83d0507d2d6ddbda3ac248debbfcd9316053ca316f7a3ae5e5bed71d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fdbf72be4b8a9145a93e721b12bfef1

SHA1
3265bf15a1759ce000ef8f969f1c83e2ed05eb76

SHA256
ed435208cf454ea9473dac365094a7de0f3aebb051250c400f01fb198a46fb83

SHA512
fbdcb3fcfc3ff5e2eb46ce9ef866015c1b515771f299a6139e1a212fc550dd0c20e74e90264dabd9de27768e4524218b49cb35a167bd777b5086f50cd67b1ed2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8ED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA4D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit