29590131dea20e5d5831a4ddba00e768ef514c3873eadb016867390b7dbf59c0

Analysis

max time kernel
137s
max time network
152s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e142e214289e525718e2bfedf580d16_JaffaCakes118.html
Size

43KB
MD5

7e142e214289e525718e2bfedf580d16
SHA1

bed30ed1876a063aaae77fbd07d0bbc9844cf755
SHA256

29590131dea20e5d5831a4ddba00e768ef514c3873eadb016867390b7dbf59c0
SHA512

855845fcfe170e645540269d950facc69f9ccc5b373c64e9a5751feea04be5e20025a9a735e7bad3c8fc159a0e563aec437804dd8e6022a66f6a2406615fc5f4
SSDEEP

768:wJ/sp02e4QWKnJ4YeP/5zmTVSISrNPrQajI+t/Ue22eyaEe0jxjHR4ByeTT3UyIX:wJ/sUeP/5zmTVSISrNPrQajI+t/Ue2R8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000db11f0b4268b2c8efa99672366d5cfe0a393bb70397ec36e1ca33b645e203492000000000e8000000002000020000000fc3b9ab60ae7a5d4324b21247108e3a8a48f034e33a99f204727670ef37dc2e290000000f27d13ea133adaa841564211162832591af77f94429839e81a474348b3deb489b65a8ea35f8ad1a22b6b9988b45dc089b4ee3e5e0c4467e2d57706f1e0f6d0e06fab9ccabe20495fc06b87142b954fc53286da3399bfec80af975332b5d73fac8f1e23ec8e51921dc2f3dcc555ff5bb4f0a17325fbeb811fb269da45cb028fdd96254ffed7b1854b5a178bd20be632cc40000000f63adbce0965743f6c5c1ade9bde7e7b5fdacc4a3a2b74c729cac3f4529bef1849cfc02cefdf2c91dd6be33c31c22365bb4afcfe2979265c6a4e5b4c4df55e52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003899b92a2ad126c6e7e94ebdcf27d586be0b72b86ec637b7713c445bf10c1ba2000000000e8000000002000020000000c464f35ba7511349843cec1a824f71da6413e562a2fb75cf4cf6e6e5743b990a200000002f7b995f025303c1a562ecb1f6ff0091a867eb869246feceb3430a6dda1024b44000000093e9c4f015230a2e3267a60443a342b665e202660815395c069bf3366c0671e63125c429eb76c2a00f135e55987fc009f48f33fe2dfba16f59fbcf9dc4e9befb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700b177a33b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0B843C1-1D26-11EF-AE77-52E4DF8A7807} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423085598"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2920	1760	iexplore.exe	28
PID 1760 wrote to memory of 2920	1760	iexplore.exe	28
PID 1760 wrote to memory of 2920	1760	iexplore.exe	28
PID 1760 wrote to memory of 2920	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e142e214289e525718e2bfedf580d16_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1098bf2d32ff89d450803e424d36108c

SHA1
d27405a90f9078bf74862c14aae215f7c87c0e0a

SHA256
46aeacb084d832331dca3d8c8a956bed9868db2abaf4ba3a81db4aa2102116d9

SHA512
d8b9304acc855f4cae7b26bbb4362ca94f43bd687d729b5bc6967b32de27ed97f31b95d56bb490db676d779ec872bc87548dc8a076e2435538c0386bb45a1cbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82dac88feba2b9ca4c3250635286b884

SHA1
754069bd23cc96d0e2f76f001925737e044a659c

SHA256
ace6d76726a50d7f9c2eb3121c100d73400a8fe0020f389725ff78256696f813

SHA512
02d3cb4dba8fea76c10fe8d8db2f7d479c0ce06c5e2fbc9289e3982955c9eabad573659b0fb25b9f82616d5dbb77cd7f9c11b1788241fbf940f70d8c6b2dbd5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae74d68feb109476bf23a3013c974896

SHA1
f9e736a07a19876f3b6768a0a58a4e661359d073

SHA256
e360d132e4f30cdd5a60b9ed11940d35e39aa25df52d195974e66287a97d43dc

SHA512
d74aba9ba23f1f41386e57e36e570f793624abf5133e721af800dcf17586cd7aaf8024a70737b3f727bc127b41b86af039024ee8d551549885116a4544eba429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2692da1a765d4244e7c9a0636225be6

SHA1
84e7e040bd3ac19c5ed831e4148ea33531c45da0

SHA256
1c846c173941ae425a479c9804736c64902c7f2ac75cafed34f2f1937dbd4a05

SHA512
63b5d211de620a1d441219d6b79bd49db38df5d3a6d02a5f10844adb8360038b2e169bd0cd9ca07a3b22b2c36219dd77d2cbdd0767293a9601cf3be5e82649e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7807efb1c1f9c60b356bff1684b85aea

SHA1
cd9b20f83964b4a94fecb9e05223a151b358c1db

SHA256
5da6d2a0b88592ffa57451fd7890d20b97db0e32561e57c5890aa5a030435f79

SHA512
ad60cd25ed96096da997dbd9979eee16aed54e754f97971515b3e933a083ca4aa17a267e90c63154a5fa78327ec5646e64c8a4a2788d6b3e7d2709759175b70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07b7302a4f1d109c060fea6c21c36707

SHA1
2309fdb6503bd37aaff12225bed9833d386aa61d

SHA256
42c68a7c421fe223ce736558b7c6b15401af728e373e06c5b1b21ba978acb946

SHA512
51762f720f88dd558a956d23101669519cd96ba649f69ac8a1b8e64a5577e9ed45272cd26e16433bd1a2c8b5b5a63e2457f30be5b0177f5292f43869d7629fa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ef17b20a796b2bae89930339ec9732

SHA1
f56d8a3c765442e85bd71b3c83b621f688f1832b

SHA256
7977607d7abfeac8f8479f379f49417bc1b38871b26b2370835aaced37419160

SHA512
3018c34a8381e14f37819214025c8cce50d082fa97cff8a5fade0324eda29f47d4470125cf132f790f5f742c211f6b37ab20188e986636af5bb9cb631ad3e313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7e037fbfb76826d815b46d499bbc493

SHA1
0babd937603e8deda29f58b82459b92c62afe8d2

SHA256
8a5bd3fb7a383e268c3b8028adcdcc5b6e264196e87377fcaf059955edc4f161

SHA512
ba9c1f87164baa30d164504281309fa57c5bf274a10c7aae4247d7bf5c492226bb26fc88aef38d81a66145ca4827f1b7e48e9aa809fed386a6c70c22d2bfd98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
660ebd12e5c4ca17575298ce318ed781

SHA1
31217fb6ddd503196987b65ca53ef5bbd0f82f64

SHA256
5f9fb29ca46710afe7a5cb1a68cdcd64418472e0e873d19cec7ce66576f96e20

SHA512
a611e34e86e37b0c30fce6216e687a596bc753662dddb8e994dc5444647f43a526a19cac98d6a2929112aab10f9a6c7cfc7d35852ccd977ccdf55b78d8f4dbb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
788f0a6e17aa58b096f977755c88f9c4

SHA1
b416062cf6216ca69b495680f356e021a763bcdd

SHA256
82c4054ba60db1ddd0e06f870e07d69168172aff7b040dd47aeff9dba061b8a1

SHA512
740ab520df66982a1551744a2c4df5708296ce2c2bd035945f8398b9d4bd8a7de6def8c0d8ea06df8496339d01f9b06540dd6b5d49920ef11f8ac06e083b783a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96838d396a56f995cd95a03bc7474dcf

SHA1
e70487eea16856ae743f6681e327a4b4f281ad30

SHA256
15b2f97c3de9cd6f099dd62c727217ee472103ec02a3ce11ece185f893aa3310

SHA512
04269bd63e33b24c8d25f76c47e7a085a0c71c1ec57d28e96dc576df05d3d11c11fc2f83b54ee37bc49c343d0b6877124875c48291153a993d0c3bb57328841a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9a07d85bfaf633c0e6fbd859265cd4eb

SHA1
796778ceefb6dc01c0573592f74d4ea8874bc25c

SHA256
acbb8d0b94e611fdef9fc56970a18255cba4fbd1c2aae9d5e108cea9fab317e0

SHA512
9b2b97d021e20b29900b953c9555b940769779ee847cada988701fb7cf02658e93456c9b0dc89ad530b519d4c6af8395321cb1cd5c7995c810dc4c8d217b3129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c86e5dd39970da86e3449a39a7014a4e

SHA1
9d7f8325829eed165ac2be02d122ff3cdf8983ad

SHA256
4fac1d249cb575a7d97117c8c7a1ba1f89052eeaf45317ba15ab3b260409a079

SHA512
e8d70ebea65f70668f551088c55cf0634c6a302fbd3c8ff99b57d7ed1d95ccbf3e18e930554ac633709b2c7531288c0fb7c8c416975ad654c920dff5b0d7862b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E89.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar51EB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit