93fd87e6e02c390a34ca503dab6bf665867d1af3e92cc29bc83655f5f3d86175

Analysis

max time kernel
135s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c7cd3876af5637d73af7f398dfbd76e_JaffaCakes118.html
Size

461KB
MD5

7c7cd3876af5637d73af7f398dfbd76e
SHA1

c73cf3ecc22771b06d3f044a008598b2ea5e4a1b
SHA256

93fd87e6e02c390a34ca503dab6bf665867d1af3e92cc29bc83655f5f3d86175
SHA512

b34dead4ceaa313bd740c751d9718523920649ab89e772937d674beffa32b8ec04e1b31b62df10b6a9624909f03b0316d996a6eed63ec4f5c4900906c19089fe
SSDEEP

6144:SUsMYod+X3oI+Y2sMYod+X3oI+YisMYod+X3oI+YLsMYod+X3oI+YQ:b5d+X3S5d+X3e5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff34150908903e4a8d105913412f0b6900000000020000000000106600000001000020000000b44b19b7ca900f4c62dc9825c92741b2bc6fc6286b123f744a7b05903b9bebfc000000000e8000000002000020000000e051a238b5e73defe04e22ee124a924cec3f3cfbd020dd41d7475a82406c3e0990000000e453fa760459df0e4142a311511f07fce17adbba47bf69221f2219ead426877e7f6d1c88412a14a824d6cb7a925a75c757a382bf632979ff4b0e50776bbd3825ce163074c641bd0105c553b9f402c7260847ed9c415f5d4579b709a5d9d78dbc9b7749139a3a66d7bc42c34007e66405918d1750feca3a2b55e3cdb035a758de90c047770af8e890bf3dec8b97392c1940000000274416d01e637cfa12ce9fec60c6fcdba363d51eb6551f3067d2cbf9ae84bff0967ce3c47ad7eb6e8eddca35291cf4494ab95fe5a3812b852fbc672ac8326536	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423050576"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6074e1f3e1b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AF20881-1CD5-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff34150908903e4a8d105913412f0b690000000002000000000010660000000100002000000088b6a46deec323faae91707342afe30735d25c407be5b45125dfbf95725224ce000000000e80000000020000200000003d316943f06c9d694e66d4e333824c52aa28c6bf7afcfa3da1f4a2e22886402b2000000028a25b1e376f4c875e01ca8376ade418279a9d7db8d2a56570161b47e48d82e040000000751b550909dc5a002d6aae21107e32d4f211982c31ab1e72f4728585a3604b9f776f17b4dfee03143ed5957c2a38f7403ebbbc95e6947bd31092bf7ff7402221	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1784	1928	iexplore.exe	28
PID 1928 wrote to memory of 1784	1928	iexplore.exe	28
PID 1928 wrote to memory of 1784	1928	iexplore.exe	28
PID 1928 wrote to memory of 1784	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c7cd3876af5637d73af7f398dfbd76e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc749133d9cbaacfe166f73e789e0c48

SHA1
3803a0a30330eb750e3aec17943b5c276f8577e2

SHA256
374b84b2e9e2951ae9aa8477d02ff2e68060fbb9b5ec5260e7594990070534c3

SHA512
5632becbeb2479f5088d66ba14f73652f52bb42cfe2a82e76a200eaa0bb9442d0ef3a1a48d5cee93cd4bf86bd3279190e8dfbb9b545e1ddd97111dc9553c2c60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29bde571925fd61c3c8cec2e2ea92b1c

SHA1
1a73590227bbab42237072c7f4fd70bc773638a2

SHA256
7c36ca6c53179bc2a0f918f5db7a998e1fd418d7693b01b565354cb55af4ed34

SHA512
e4da70edbc584566031384e4a70f270ee960101edbf6a00a8896acae487d5e3ad4df399e0f34ff5c442126b4944e3187775a4b01b6b87fb168809199d9d10cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a779d247271a768e462e0f7b024a9154

SHA1
3904a3de3a898fa7a13f9c22a7232c0a73194a69

SHA256
702f3ecfcc23a77e4401f074e3c277affc7fbcd2a4ef7225fb346c7826edc3e7

SHA512
bbd28022a6c50a9a198c4b3aee5057bf732b23cd50d9c3ad1a30ff2e7a92123d656a87fecc2c75eb18b8d8c35b08dcd1ba98f2c3025c575837eb1235fd5efc89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4384076b62db306ea28d29a557f5c93d

SHA1
aaffa6942372451ff43d4b2e7b371b11a10ed99f

SHA256
f853459a5c8895470e352df9e2223498c9954b05cee887e14699df10ef4cd38d

SHA512
c7ab0c5ef5f9c8ecd63facb6a5b555c8377519eb07eb1d1e6ad1c6d36ef12765eef83a785c74ce265d1465ffca8d4d091c96aed788d28e40c9c59153ed6cad27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e21ef1bdfff0920a46a95dbaef52b218

SHA1
5c8db874030adfa21cfeae2b92447b86df8b57a5

SHA256
a890fcac477080953f589bcfa7a5ee5150f66abd3df4b407f650573168a96196

SHA512
5bf3c8bc411869b94a579cf88f6846b37dbb551b34d57e830eda30e4829bf8286630d99b7f96568880793c3fc58171a5f7cc400dd18551b6f106c06b18f77203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c5a1306fca9bba9956e0f82896598e3

SHA1
127904a2626bada36dbf0a4ae3d07f7a66136752

SHA256
a13b08f29f6ef74fd2b3e8ef2ecc425b9d0d451b1e21b217d33b05cfd1941721

SHA512
182d00a2bac9cbcb3286036b8bdb64475b93e3648ba5b7955bbcbf3bebefff098d97c5aee665bf02d2600b2cd20302b0829cf57ac997997df8d2fd118e3e6ef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b154c73894e87db0019c76ae8df1399

SHA1
04cc531f813067e1141bd9eccaf6abaf4a1834a3

SHA256
f4ab1fcc674e5e18cc4b548b341ff8807e70e31ec4344fde94f937f1eb102b30

SHA512
11f9ec8f4c55288b3002019cb613f91a9a0c947203ba7cb2f40261be1629554999acb47c284ebbc3cdad2da78a798e81b42e3e1626d48706ed8a74605155f5b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
430af725036a2b4a3d934c352d92fb64

SHA1
742b8bab4ddb4708c12054bc766daf858f5779ee

SHA256
0211577c63d78319d6339de3a146b051d6b75354ff1da31ca9811d05184b759c

SHA512
a670e268fb55cf2e919ed6402c8f782453d634cc436fe800d993b8edd302ac772b250fc0b96f2dec7362b01a0fb1fc2ad57461523184d9506e62566ea03af56d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccae48ce79ac802bc9ed6981579cc8c1

SHA1
b04341e07ae8d9667dadf1b2f333cb01ad54d704

SHA256
c27fdb23110f8cb54d03ac16d3dfba7578c850bbd0920a9e1730d561665f9274

SHA512
e34b6e3d97f10a333a9fde8112221b2960dfed5eb8d0bc129b0363048e6290bbc447f23d7916137023004a3acf5b32d842d049c636e506ad0b780b21871d13a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c61462227e00e4467c48afbd20ca07

SHA1
7435c3859487f62077f5f7d61ee58a8fb325f6f5

SHA256
feaa3be2b08c70776ba0d8bab872af5de2345e8e770d23e2742a3e61724a9348

SHA512
544a0a8624bfabe42f8c663f6f6cc853e5b65caedbd625f8b1167897e46744d2e7783420a24b9e501a0ad890138c67111da0f900c5408f5800a40dfb24735688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
124a07064b7f8da8ebbefa3fa45070b4

SHA1
7d332e9e1a677a1c835666c984a1976e50d8440c

SHA256
258e1ce4c5d86db8f5aed3b854783e12bbb3d6a6439dfa863f751491b5a53d49

SHA512
4a80348195fa3e211368586d38ed3231814a25d2f1998e33c98893f8e4fe26c6d40f7d04d6d808355d203c37166daec950a25ebf002ee4f3420a9d8af062b149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4597325d7f1e9da04aba264a2350f4c

SHA1
46621d10c8f89c524c3f4028bb2524c968bc0d7e

SHA256
34210e0dd967fb472619503a22734e9b868f2884383def989b4c508b45c28c7d

SHA512
15218ff553d33e21b3f6c4bcd52c8e37064ae0f8e5cf892db2099a6442184e5ff938f47571ee1dfc54ba57be86d1e83d0d615d4074e7a70630e9a803c0bc9185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d48108bf3b0287cd8655a2944e72c9ef

SHA1
14a78ee456c63da10f8057b0d9c79a06fc2ea434

SHA256
dc784cc14fce1b9cedd8fdd6dc42f6afc84942127d3b713b348b69d12d9211d8

SHA512
a40a875c9aa596d88f60c33e5dadd70f83ac4e40fbcb5d501db4098a5c51d9cde0f754642b11d5e541be907e341262ba157badf1ad17fd29200706840a5c2550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1da0c4981a5799be1dc44279b259eea5

SHA1
f73857dcbc752b653bded4d3e1ba3e691d69f2ab

SHA256
e01ae2b8d95c457f795b2b792930be66448769788b75ac8416661f79b8bf6c90

SHA512
16d4e5e9939cf5733e93e9aecd9d72325e3aa66e70102bea56e7077dab4d063ce02252452c11aa055f8934c05b1764e3a49ba1fd83b52eb4430f1afe2eb84dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC0B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC1ED.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC25F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit