6c2e2c0f1b0aba2868611213b4f074e939f08a1e8c5941e9b97e4d2116b25f6d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7db9493b2bcd0db2bb93f017a20fa64a_JaffaCakes118.html
Size

229KB
MD5

7db9493b2bcd0db2bb93f017a20fa64a
SHA1

e20778708a99a2123c8a1519805a48417bec0ecb
SHA256

6c2e2c0f1b0aba2868611213b4f074e939f08a1e8c5941e9b97e4d2116b25f6d
SHA512

5e17a4723843c1ef845046e24d5428ea8eb9c998c140a1c30f0e478cde9135e4035dd6c650832cdf7bfbb33a8d6bd939872669b0662ff7b45f3585133717f029
SSDEEP

1536:dr/8vZMZlf4IKZdA+0npblNS35p6i6qGvZqKsUj0KZyPtrVFgJVRLpfMMPqp:phDT65yuLFgJVRLpfMMP2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6C59661-1D14-11EF-81DB-4E87F544447C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000d263b311b65376b7417d9f6ad6421e8baae3873e8ccaf88451bc52ff06b5d33000000000e8000000002000020000000ae3854853bffe34434707aaf2c8948384d89be861d39963514d854149b814e352000000048a8983d0b7db5e8c5bf91894e64baf47300a722405df86f3d18f2ae8c03c04f40000000944bf02f330d4bbcf4fedcaafd8205c308a8c7c8b01305f1285e60f1b5707ee1fd571441308560578b0e7478ae93fb420b54d85bd4fdd532317233b37c8cfafb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000bac885bf470a52393c7c281a6b5944dc5c3b45bf37b4041804c3bb3451c85bff000000000e800000000200002000000094589d541b79ad975b961e261f1c1441138b3cb7090ce5ac3c7b7165f0a853fe90000000c489955034312e9a07d6543ee6d6fd841b766cf9b29549722ae2f5931f2b5a00fe35fd6627432242ed445d77a0b2030dbf484bd371b7a7ef98f64dacfd75dc208349f119dde81df831ae432869a426127ff8e6ad73d622cca5c9cdecc588c6113b2915eb88b79c2441990432001e01edb1044fd5b70c9d76fd9fbd455e055bd88048e227267d0d22a4315aa3b92b47d1400000002db084defc7140708fc35e48606652cd72dcee93ecacabb503db9ea7329931c54650d1632402f592eb088624568f595583271ae0b6e5fac718e9866d3fc7aee0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7024acc921b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423077922"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2448	2180	iexplore.exe	28
PID 2180 wrote to memory of 2448	2180	iexplore.exe	28
PID 2180 wrote to memory of 2448	2180	iexplore.exe	28
PID 2180 wrote to memory of 2448	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7db9493b2bcd0db2bb93f017a20fa64a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67af04cd8b54500552786eab2e2b7f97

SHA1
5c118b1e25d0f936627f9115e9d429e65a57d5e1

SHA256
cb3021646d7850f98a6bdb021fc174af6dbcc42db21dcaea0f993ca22c3c58e7

SHA512
fb10e020db32b8db7a2fe8beb12e1ffbfb9e7ff1cfb0266c7dff0e36d7e582da0fb593740af541792354630ceff13653a812777e7922b1a4a5772dc4fb9874c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43d913a98134297bfb180532b99d3457

SHA1
08d2f9ea987e2144c2d79c48c4c23d369c8a2ccf

SHA256
be90fcc386e21f368afcb395fee8d0a3fc61c1ae48022e956169ad18c4762715

SHA512
9dfdff368d998b7fa794f63143f6019b953dbbca77e3f034db57137d95aeb5279b6a6bb001b915660d3897d8b3cd2618b8c836704167032a16f7c5c2be59b8b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
369928f4f9909a0b963961797a2cd9b7

SHA1
c69cf0f0861d997f79c737b4c3b53597ae0a344d

SHA256
6d4ae91777be4efe917741955c83b1648ee34fbc2da95c929967a5b94325f787

SHA512
e8ea178fed67ebbdcaacd88d4f9fb25b0ac792f284ad92fd5fe5689fcd242b6d77a5c26d75648c71e435b668d2bcd59d73e3e4b85b0ccf4397ecaf6ea5a94be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63411095489d0f3efedea2a7e7670522

SHA1
9e9d416e4b80df55070c025082777c5770283ae7

SHA256
cb223f162149f7a3eb89de474c644aecb7a6996cb939df460bb134b9e3b1e9cc

SHA512
be5fffad0ef83f9cbe821950cb4314af9e339832cd6cb302248eec317409ad2e8b5834577e0e762d4cae2b81718d4c5f40878c4c81e3457e2ec3eae687464bf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94c8589c5c22500a14bf6fe2c3620307

SHA1
f2e04aee725c6b9b5a55182c71b7d44d1fbf6129

SHA256
de3d6831b6d961013c1f0e488c84fdfaf63175f35a7ba4a5174f27318b38c4c2

SHA512
459ab72ca747f1a7af2a5ecedcdd9451274b1bd1c0389216fde7c3c0c72e2d495108cd53d505c79983494a45dbfe6d7a9576ea51d746821bfd6a79df1af55b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50e3a414358833390799b1af375c212f

SHA1
31410624b6fb05a498d2e52b71559d92efed9d6b

SHA256
b0d4625158424982d74d2c0cc1d6a5db9e6484ac77b7918d49bd3bd557d184f6

SHA512
df764c52c5cfc038d78d3affc5ac9e75ea10eb62040f49e8d9f9a3a174973e616fa940c67c519ec00a06972fec6bf09d2c9af0c4001c7d3269ff1334480d2aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2447bf95f49787863770a8b5ca915d01

SHA1
1ca3845cc9067762cbc12466ef2afe954db1b40d

SHA256
d4b206e4c3d717d46d02f848b032e5b5ea793f9983b3b239909bae6c87b509bc

SHA512
5294c0f58257f03f38831e71087a0714076e7f4152cdbf8cafe6c3a54482db774d1f70230047c70fd1847b2aa606137293fe12cbe6c989307ffeee7b5ff9c968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07102eed124615680fb440207a92a37d

SHA1
67267a1be65e2f6338924a12c39554d54ff68bdc

SHA256
9900d3ede3499112d6c0c7c8c1b41cbb623d51a6d78da91df5cf922ff5126598

SHA512
79f9742e1be4b2f2ee79fa6523e77ff9f7f145d21ba9ed71de415880c202784fba6a7fdb790cff780fa384797817c2bc28665c326cf60a193ce6b19afc31f610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33d8b9f506fa2c87104d0a4c5c3d7789

SHA1
7d9e4c10aa10bc2b4407c4aa9e35dd10d27c1f3f

SHA256
92b7711d359891d5026ebb6890f2b8d29be446c4b42d26b493852bb89f03b092

SHA512
058b75ef5251a628b5bce154d4350ddccad11a7057f9c85f12a192cc326e6cc6ce8805624bc050a972bac273ec574048b2a7fc52804253b244a8a8b88582d5a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7230ac02904ab3c61e2fc9878b1933e5

SHA1
6f456ea936b7be449a44dea9b0a08972882d84d4

SHA256
d4d414e95e476c69fd0fe115ced3b62482e60a8e83f27154c7b7c8ff029b7359

SHA512
1703226b5a37fd0a826ffab1ce264d2d8964dcb5826c30190be72411a303d7c882f1c40e94ab57d2fc0e3323f23afad431ebe0cc2880ce9a837369e2ddbbc59c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c8344e90fadfa6a5a369173a73da424

SHA1
dc8d2d3be8411ae0f2f00af69c42305646844e13

SHA256
e3bed9f9f67806ef8941609745f4efaee67b042e8e5c2ac6a13578dd1e99dd2a

SHA512
5ef12f3cd16115dfd45430ed75bb18fadf36c9ebdbf65cb151ed6a6be96da3122663c912f74f41da15cb66bd3a7563a886f9833ecab01f2a288682a7842b8aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc67440933614a23a79870888fdc8cfd

SHA1
4309c94e65f23a84fa7738d1f49b9024a6369c21

SHA256
bd8a1e225cbc01d5d6ab1ffbc75c01140b51bd5c0a161064fce86fb508dd23f9

SHA512
2f591d8c26081d09e9c5aa34f00bfab4af55c58beafbdf41d09823427b3cc75ee528fd6f3903842529138cbc23a2821df417a0e6b2e6b8ac0108c3645e1bfef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa2d4de51fe90af1f19217b3a57e93ec

SHA1
7050e8252e815395f4f96fa44c4f61f40ad889eb

SHA256
e1eb7470524ed21b98f967b88bd056069bc4086e60f2e162935b2515317e3e75

SHA512
7f00538dfc6d2815856b5a5a32915f5bd620ee4493b7885aae8026fcbe0745a16c9816b3e20ba4393646e290085aab037231e83ff98d9d1e62d0c160729fd38f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7c8ed221b388c851524e7a7f4745c4a

SHA1
b18f986d48061a7be5e2c42290007501be83d26e

SHA256
b0c239617be24c602758bf1978a4c4db8d4780a097ae1c21983a3c6e46771518

SHA512
08043fc0b8859ff20a3fe185bae31404e355bf40bd6f907d9a42d54129f42fd125a3df4ff40684c09bf33c18838ab163b387ac0e2f8bef470209d4c565e4d428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc2f6fb83b7450a2f48198a5df31098d

SHA1
00af9b5f97d238980f5c4ed02be5ad7ad4f63ae3

SHA256
742c10e673b76bfe38e0a1e5e9a7eb9d00cd49c358d2afc00370a390b3a4a1ee

SHA512
fd02629ecb4a22b2d6deec8435c99fe97447d45e5f8626710ac965ededb6b5227f2e0d51afd6277ecd531bdd1fb7885b9dd772c1c214fcc8cee0bc893451d9bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56bde9f129790243626b529d1aa5f35b

SHA1
43814f95b642a0030ba0c17e4e1fb2d9f1cb2986

SHA256
f1fb3365c0f8a2cbf7c38b152abd11a9def53fdb8495bd5ae19fa74443bbbb0c

SHA512
2e0bbf4c3ba4d681a5994e893febdbbf14c74a419b257ce106443af43295c71b38d489abab7c2500c5c554f0cc7ed5a110629db0c380b653f32f3cba4b10d975

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1813.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1816.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit