15a0297c1631daa3a6c1d2c0dda8749dc4a6eae397fb78a42aa9854d15c2aaac

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b27bfa459b22d294b5c8e340db698eb_JaffaCakes118.html
Size

4KB
MD5

7b27bfa459b22d294b5c8e340db698eb
SHA1

db46634004f57c737a3e4bae91bc2cd2febb7c08
SHA256

15a0297c1631daa3a6c1d2c0dda8749dc4a6eae397fb78a42aa9854d15c2aaac
SHA512

9bca547d29e58f7c4ea3536443e64ea507079375caf293acfa1c9e2b0b355e48066e477b7720074d272d80b53fa6967fee6dceb74ef49b6465f37ce770b3fdd5
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oeXKzd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004e184d351d12c1449ffd1d06e46d5ba60000000002000000000010660000000100002000000088f9f44c399e07db07fc7c607336973df6110afe8724495bde15ba520ab82f84000000000e8000000002000020000000e83ca3daa218bc11bb048cc1331da9c52e5e8adee165a4e59a6a72f078d3db7920000000f401b6f20b0dc3f5efcf70c309bc4e70819ee9c271cc99584203a250e956e522400000009901dd56ce19b3ed86434340aae15310a47aa8aea88b5954b68bd6300cba778a29b14de488fb1f6ba59d45781c3fcf6246b68a99bdc6bbd109d751b9629b148d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8002e0f399b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004e184d351d12c1449ffd1d06e46d5ba60000000002000000000010660000000100002000000060010cf99f3a9a0a5a250207d140b54c3ca1c7541971d673d6f8cbed511992c3000000000e80000000020000200000002181285aba7f54c26d284c945cff00a8c77b9dee23a132814e94f9a5c8e9a784900000008804d7edbb6db79cc359903708d5c4516ce7a86ed7feb2d72b4ec405c9653a0245c1b1abc744aebacee98c42ba73f3a594eb8f043a058d42e6390f8b5268a09d57011e0a75c9ccdc8a6bb00577c9101dc6621a7f86fc8346a7e2b8b0d8586afd34298f16dcd764efb1cef3f0afcf9ea43fa1eb349a2ff049d5e7dab60544d74c9886c6315bbdb291d47b4a4bc2f8b34640000000263249c635077ce9ecb8dca022762c4d8593587e1b85641a2cd69fbf2f56ec929188acc820438cd22522caa01b4f9bd683a79b18ef1cdaff62007edb282e84f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F56A041-1C8D-11EF-9CE2-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423019659"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2284	2020	iexplore.exe	28
PID 2020 wrote to memory of 2284	2020	iexplore.exe	28
PID 2020 wrote to memory of 2284	2020	iexplore.exe	28
PID 2020 wrote to memory of 2284	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b27bfa459b22d294b5c8e340db698eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af2fec0ad043ab0c60cefb708bf3f7b

SHA1
082478f1d20d588b42034bdca33001c803e3de96

SHA256
f2f2b1d4301c4ad5ae1d44c1034bb0adc30969d518d4a792ca891de53303f720

SHA512
193bb68bdd78e3605034880fe1728c9170e42d316b928f8d46827c13f7aa53d7ae2559b66b3a3547c434b7c11ef1e6b9e174278c136b93680d54760aba63d69b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1666a2309d44554127488913cb0edf14

SHA1
5347955b608e1d754ab47ae9a82861f1e1233921

SHA256
80ee0ae348014c3a32650c8d31692d64380c025ae3b9d8bd219344cb831a9083

SHA512
790884db62653bee9cfebd2d0672d79c3d099ae8b0211b9c4deff6a857f7eec4c31e15f044c7538d278355ee5bf1c9e75992a460cc05af9d7cf56e3a659e7f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c588d8cd335b221de093a896d1c29e6

SHA1
4e2c54f093b4a6444cc9bb1f9e47e3ec0ecbd352

SHA256
82a31d2e3743a0d278c01758fa4cd4a7f4a428b10db084d7a5be3d2841e857f2

SHA512
021fa319d8f7ac1f39b3287cf5209aa1916bded31f899f7fff6beef80369c87d812bd98e4c6503aa6487f25f594f05faa21ac2392d149145ba4ce7f9d144e5d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1be3f5ab8cc7277a3a31923e611b02f1

SHA1
0c0f6f6f8ed8b58820c5528c537c93308816d139

SHA256
8e777b0984a5b294d00df687f8d045c9b13d8df775d23ef5500471be3232508c

SHA512
6dc961ebbc5dedfd1eb669e28eaf5d14974b9831650c5674175f11fbabaf6aa894123efacf7406644c6fa80886321437484ea8b5a1c45866aef507c24150ac39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f96db2318d66304a55b8af0a5bf532b

SHA1
15d1411ad9ec4aa8c608734aadb1d4f88ad27654

SHA256
5a8f5498ab45c40e8329b99daee0e2d59256a07d785d72cb24493306668f8c38

SHA512
2491595541e0b2078bc151268cef2da3d2f75ba34257a291a3a2d6c7c97623820590e54bebb3b3bd7f3a160e7646eea2f800b19ed2a65db64c242b3f71786c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95d4d9fbe71f5e9f601a3de8f3095575

SHA1
94674d872c3f9f80eccd83945d8d965cf0f0ce44

SHA256
b9de97eaad6c1cd7cf917ed264eae36d69766af0d89bb657bc845e8aff77ddd5

SHA512
d513261a495a5e8aa923f56d1249d25e0279ebb24f90704ceda981c120a85e8cf21d2b8b51590e7978443e71d602b98452af52e9d7272b4a94ac0938356ab560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
893a53ef51d8a7ef913ac8d273a09f15

SHA1
7d08137d68ca5cd831ba726f265dae633ed90c05

SHA256
87a98aaf173e7b7138e2c439a00fd62fd15497c24702d8621eaaa1c0194fcbcc

SHA512
9d9b3936d6e3d6f7f8ff91590003379502c57a7cc3fd411b1e9c6531cccb73ced77d0ddb83f4ba59137d4ca67b42bb80f35e2b05cf46562ac72c90c73a493ae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff4230da5a7c80a6878923719f1a7f5

SHA1
c3840c5e61b1fae2f75d477e956a8273a76c761a

SHA256
7325bfe5d804d70bb15cb6ea4577859a7f719aa95c2ebd33f62ab7b0a05727e5

SHA512
fbe631c33ed20a31d834b922274889cb7aa55d12a23f4ebe715e451a05bd76e66fb94c1550a779d4a292233da80a1dc066bdc7720bd87950eee8f68937caadaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
765aa8f9f0f018cef42067945cf32785

SHA1
2533b8cee752121e5c1fb40c0ab5739c4b96eccb

SHA256
e8d1c3e80fd9bc8b58573e08981dcccdd73a7d6af96d16d767610b70edf53b3c

SHA512
00c58fdcfa141d458a9fb5c7b40b53406e862dfddf05de3b86599c306947aa237fcead251d7e2acc1d6aae00da7226690d3c46c34b97a641a3906da3981bd37b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9ada11da173fc02808bb5fe894b25cd

SHA1
42c9c55fd68816717c158acf898c5fca191e1f8a

SHA256
ebfeed416093019fa385afd3894b4f0737f4327f3239c14febcfe2414f489e28

SHA512
040da21c64267f01459ba889ee12e44fc5a5a3478abc72e2e9fa1668fbb30a8e74cf7ad218716a30a1bf54cd4b82c719a4b5ecafa291696c38fd317a775f9132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35131ca9945113fb568bfbf4e059ea33

SHA1
aeda2f879a25aabb18e544e77fcd2e414bbc8002

SHA256
c7897eb3bef1536769d4d086a9bd658bfb28397c4ecdbec09d6d70f7550942b5

SHA512
4ebb1530bb9e715362a76724cc91dd1e1d66051e7952dcd94b6fdb79ba7f26bb45b88bf4dba204e5114167bfc0fe322e8312bfd67b5aca10b12d054084ac8a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
854f8d665cc6f3d1b5174891b99258ce

SHA1
0e35d9bb1e63955f619086cfc8e7226afc503aa5

SHA256
7021ef9c18fceb7ab984eaf61c940dea908c4befe2e46d4b4981b9bcffd506ab

SHA512
62725b94bb019e0fb64e7fb53e802f0b3920979f6f25b74f8fc90b18194347178df9799ed57722004d780209d171f012f20b419fa5d4aadedca88647825d881b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8facd0aa86e4d5ac911f90f20589c2ff

SHA1
f1709e4024bdf06b302cb5d52daa733f31879939

SHA256
d13df133a6334f40079cbdd8ee418a7a5bcbab9e49c0cbe538d2f92196d23878

SHA512
6faed1b74ef7c9474fff276f13dc7facbc690413dd28077c00e766bb7b2b4572dc4462a48f8c3f2445b016d18bd2789a5e74c2003a56e7fec95eea1ab066a4ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26edb6dea55c274ceffb7f792907f654

SHA1
faf7829d46ef489fdfa1cbcbfa5a129d3a3e33d9

SHA256
ec777a2611a8d4fd2108e04129f1d843392561a5d7672958c5447557279f7a9e

SHA512
34211013ee9063d9dac852ddbf336e50647d837cb8dbbf8861b053e2635a0dfb928030b31698d6d3d57c9d06bd7018e0a548380f3a9a4233342af167230be55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d7de691790d49930d07eb84995af668

SHA1
5958db96f480e41b2e550e7286c0e6206f4d4cbe

SHA256
20533750a5eb5a52bc7c2c4064d7e712f6da614c4efefa9c7eeb947bdfd0ccf6

SHA512
172c2f783ba3f01254f5578a046abb5e0106459b4f41920fea118736698631e0ed05190fbb2e28386347bb5fd1ddc70612f4d1f812ad203c38cd43f00999661d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab367D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3760.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit