7bbbef74a05716614bc4359de7839e9d4e80edf3de42e0508f97131771a33bc7

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c5e37f27e6e718b3bdca961067d93ab_JaffaCakes118.html
Size

479KB
MD5

7c5e37f27e6e718b3bdca961067d93ab
SHA1

094d7ba9d7d43f0ec19ad58211525aff7d625d27
SHA256

7bbbef74a05716614bc4359de7839e9d4e80edf3de42e0508f97131771a33bc7
SHA512

2f29a2bc6408948391a2440ce6b9aea44fbf8c32c6d11450d3a4ddcb89884a89c9a5bc8de236a5b396ec72c54c3b4b5477705a3ee7a86a14a4807d22cc7f2697
SSDEEP

6144:SN2sMYod+X3oI+Y6tvu6xAmzM86P5sZpMFzBtug4r1GcFBU/b:h5d+X3poCPuzmrugwG2qz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068e2d75946c8ef47973d8845b42d081f000000000200000000001066000000010000200000002b686a9e350e1aa66d9f4d5f7d02cd0fe0cb41e91660fe3e6c70df945b0fea8a000000000e8000000002000020000000a34e2eb8485eed09ee6fccf5af3ff80140d90df1d681e96d2bccccd852522d5d90000000baacd52edcaa34ea8d8805e8fd6eed0dd199e168399d93e06af4e7ce63ad3ceb583e8c0452bae458123c3839bc39abe61c3780ab1896bf9e4103f815351b338e670ec755510ac671749ec560e94b720b0930be1c6c3458027878da805109df45e554f2ece22959ffed8a304449896c5f033d3da512d14b471a247897369ba5dc73e53c5228c67620d1ccc69bcf8fad4d400000003a56c59c55a98581bcbda17ed2de7b5fe01669b7f93b47042a31338a254ee220e630171bc3e77c1c07c070fda78f1eca1e46eccdf32abb1e0bf91c2bf6a3c31b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c3acdbdbb0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07086F41-1CCF-11EF-9A4D-7A846B3196C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068e2d75946c8ef47973d8845b42d081f00000000020000000000106600000001000020000000b996b00f515ab11f0cfbde2820f4c48257a32d24ecd2ce5ed4a0c88c3e62a94f000000000e80000000020000200000009542a611870e04f3e713720b4c10ee7b072d0b9e78624aeb51fb7d936e5c07e62000000097b0eb8359e64c084aab7328e4b225606630e1ca74d8063f1fc60b77607cef9240000000dd6d00ee3a33a4cebb0a17e9083abd41d7c50d954fccbd2afa374c960bb3d8809bc0533ab7d75b60d5c2cfa87d0a174d3a40d2974b1a04202d77b03ac391081b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423047965"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2480	2280	iexplore.exe	28
PID 2280 wrote to memory of 2480	2280	iexplore.exe	28
PID 2280 wrote to memory of 2480	2280	iexplore.exe	28
PID 2280 wrote to memory of 2480	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c5e37f27e6e718b3bdca961067d93ab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
010d95880e46cd0740bbc6e84cbdda28

SHA1
8671009d3c3f8350ced6509802eddc8022fa6711

SHA256
b39020fd8867a96165de1f8e23c7702facc817e638d4a6c58347ec70cbd1c950

SHA512
2ac8a6e5379fbea8f1ba688875efd5607881b17f8a65b76b9c2e32c63c2a65ae3fdf00192e414a7f8fe140a028f17314e9e691df65a997adfaa9bdc0048e75c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a83990009e8a385939076e8af94588

SHA1
b3071ebe25dff62c7d2dac995271d97b2edff052

SHA256
e970de85ea39d15587a8ed34fca360c465670c6d1f2df29da02d5dd2a857c08a

SHA512
dc8f55a9831d2f65c74a9925ee75fe35031db4d7b9d2dbb87b460e834e0dd13cceecbbea5e6e184d82c789bbc3685ae9746bb13d7ddb9016db1a1e8532c01b03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f906b5cc71c43e1644710bd7ba729e6f

SHA1
c17b23b2fedcf91abf3a0929b3873556f5845ad5

SHA256
1c28fe598464f953334a7c213a37c888f6d4ca13b14a05a9335f53c1b5be39d2

SHA512
614b9adc097dbde73cc5177a9cd5d6969061e4bd5a69a21002f3b48bf7a80faa69d18768f052c8407cb7c964a5f9eefa713e567b0c49bc52b459ce52d4ea1284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bd2ba9f9502b76176d561fb3f363d23

SHA1
8d723e1e660a265b814df557d0fe088e0f960979

SHA256
738df3f5ec00b621a9bbae5cbfee6303315d2f700d88f609d3bfa00e9fdd12cf

SHA512
e95e523497fd34fa233e34ff1afbc10281c8e034c804b7d3094096da0efb7fd37e510a46f9cb3786497661db0a2e346f983d4c941015d548b8c2bb91a08398d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa7996b3a7ffcf713640d2edfa6d825

SHA1
dfae423aaa916099d367db87ae7bccba8eedf5bf

SHA256
3694eb2a0d2a329def5b8fb9677f9b5f7dc12009508d5d4688770090e539c69d

SHA512
f1583aa4c861c10e88c43ac3a74cbe159965450f85f91d73e3976ccc97bb1ba2b559760d69e73df867372ae61e18b7f42fc803ce14f17938280a2fbef32f34b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a3e78d0a8c443c55d114f116c17c3c7

SHA1
e4227d12aa1bb87373d7a6f5e2c03d0f8faa5da6

SHA256
86d6b9588e97ba519cd388ef0b08788489d51862b7cf16daaab91653f65ff251

SHA512
5c936b8b555b927db0da6ccf5fdb82956420a8199a98571ca7672f86a9ebfa77de7eac4fba82a60545a5e52f620bca490229d8dab0ab10286c870aa9e3977e89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe45514ecdba9882b4844c78e438dcb3

SHA1
5ad405e8e573cf23f4fcd13726fe9ae68b2dafe7

SHA256
ea1a4b14fe33b9de8f911085a1c26ec9301002186d85695c4d4e95ff57100ae2

SHA512
6c1fd2343617db3f0ab32da0eab7499525f759434189fc32a5e7cdea24695c3e574753f9c539b5414876dc52d9cbafd3f8fd559c1ba6670a1ceed629bb7709ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ccdaa4e17a29b017a279048c5f21f25

SHA1
e0371d5f49200fe36827af7581bed536162a236c

SHA256
df7a244ce696775c4be7e7d4375434b95bd6d2d9997fbceae69d7a45b013fd9d

SHA512
851a593ff62926d626f01caac45c41eeb833c528981342e1db3af44afe508171c1b06a783c2bbd65a46b1700f4cc652b08aa5102f2a5d2fd275a79d871d70a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e31dbf70b8dbdf4ecc8064342f195d2

SHA1
8f2cee4d1df13add2510c3b158a8324be44edc2d

SHA256
b59161dad56f7e31b20cdd48463dc07620df9883695a2f3a232194047c714e39

SHA512
b3096169f09477bbebda23d51409d0f824e2d0b89e99c9d86205d0d8342694dc32ec3339db49c4db71aab0f82736e49d6682239674489735700b2f43882e9bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7115fcf7ca8eab943d6dd6fb215db8a5

SHA1
67be21c6cbea1e0855f98f9d3b92a180d73ad58d

SHA256
f87bf5b9ce963819f876598b6c8b6eafaeaeebf03bb3918f5e7aada57632fa84

SHA512
cc47c71ba1f86dc7538d4cdd25eb49fe52d05d55674647fffa76068959d558439ef335e9419c740e83cd8a0efe6f6fc9737146849026999c19ff8fdbd8f3aa17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caccdb14a984b6472d8a9ebb25dba848

SHA1
80e401269e668d1a5128315272ea013abf406ed1

SHA256
605627fe6f612e7d16b8a45b0c6ca87bc5b59e1a96494f147bddef722f35e555

SHA512
530dcaad9820a445fb3993bfb16876491e35f9a38683ab052e6ebd8843cbe69ec4129127ef61bf3c5cd25b8fb9a2776ca6fc3cfd4435c203ec82e24cc3a07cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b79c5e20ebb7ecce5aec0a9748bf1377

SHA1
c3a12ad1e68bfe1ffbcb083e9e6e27051052124a

SHA256
f77c6484b5ca47fdd5823892a7e99a32f6967107705a25d184a5870d660518a6

SHA512
e74eace8aec12fdbd694f70eb1f94fbd5dc633907e8e9cec5b84831b5ced05af0986a91e047997b28a801e14d0f635da64f3c78c8c9790eaef510f61d8fafc5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1519.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1668.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit