350419bbfc819319a7de440b02998c4eb57374764260d6bf1db46943686a06b9

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8072e6f045ef391591f01b715663700a_JaffaCakes118.html
Size

125KB
MD5

8072e6f045ef391591f01b715663700a
SHA1

ed7ef40d47e33ed34abda1cfc95c3ee1aa91a536
SHA256

350419bbfc819319a7de440b02998c4eb57374764260d6bf1db46943686a06b9
SHA512

1af87d3e796e38269d64c245d04837ae90b963e50315a9901d2853a56f136a0dd06b9d177888c1ce0a083fa4cdc1606ceab3bd3a05b1da6d9391efaf1e0ca0c2
SSDEEP

1536:SKECCCCC22222ZZZhhh22277777OOOOOi3mANVSuKArYin8AVFX722NMNQRmNByq:SbJOA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf0e76582ba58d4d91a4572a8d44be9b00000000020000000000106600000001000020000000b6015aaf3bc7b830e9e92bfa35ed142c857130721ae1e0d600c3e76f1250a4ef000000000e8000000002000020000000300c103dc63501decae748ca8a7f424df2f17120885dc09db5be2aed4e95dca1200000000a21a6172f889fcf6b737e2bb63fa2947fb7492e708e061652888dc5f2efa9354000000014e8958734d8349ef115599fed9e64f8aed5a3c08e38d123fb66fd535a334423fba1544e56b44429c1d1b630837335f17b73e510498bf974330216ce894153c9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf0e76582ba58d4d91a4572a8d44be9b00000000020000000000106600000001000020000000e030e6f55f4c51ef0b530db0ffd4f48686463fd9dc2118d2a3d0bcf63d1c3854000000000e8000000002000020000000327643fb8a3a84f1bc50dee6fbce12183e47b77c7b9140c4d9a83c498d3d9b9190000000756920ea266f2bf038bda84a03300ee7885356bacdcac84d2d2fb423daca53b38954bd9c266b6b7e9dd695e35f347cee096edb699e54f102930a1bad9e42e98ee567467e680cea93acbfba9355f0167ae08a96619d6198c0cebf025ce463ae5c09b2cf97a54349669fa52d37a7b7844445af7c7097ae720640ea9a921631013cf87dc2802d9b35cdfdd1c447149d821940000000ce85d48142010f557ae27660eacd584cf32a37b4b556433595612692adc6d6629b4f8316db35614c2959fa746192b27f07057f96be7e31652e1a1b778a8ab228	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e9c823b4b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BB05D01-1DA7-11EF-9F01-52C7B7C5B073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423140852"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2896	2764	iexplore.exe	28
PID 2764 wrote to memory of 2896	2764	iexplore.exe	28
PID 2764 wrote to memory of 2896	2764	iexplore.exe	28
PID 2764 wrote to memory of 2896	2764	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8072e6f045ef391591f01b715663700a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfcd7aa6d90ca167d8333708ad80244c

SHA1
b6e9a17835784dfb3a425ef0472992b33946b5af

SHA256
15869d761ad0112767ae04621431b70d7c5625af9dcc95735bcef5142fe91020

SHA512
709377ea1c454ce7a5b8f24f730ef5890dc437097e6964bc0438c64a373eb2f48811607eb92721236c75b2f95a38223059f225668ef49b84574080a4e10ea2b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56271f8742ada86bcf7276e276978d3d

SHA1
b1150368d1c1435378df8ec5f4e20e0c51e315f7

SHA256
56ef99e0069d48a399b2f4329468b6ec9210c1f5f7e5f9086ac09e922c808cf7

SHA512
6605426860f83912b25ea34b6a09df0ca04d9ee98003641d548794f3cb1a7818f1b88a5460936fb92cfab68e1f5f73e7bcd9922b1a2f2166765aa55f8fda66d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
418d9addc859c29e8f3bf3a4f2608285

SHA1
3e4a3c3c076ecefeef2c6128ca36d018b4aff2e6

SHA256
44a5abc7504d0f4486e28e4c65fededb38aacdae6ca84cb65781b1ff1eeb36bd

SHA512
57d8af03467b5c9e729503385c550670bf6719a387de268b8ce3a611b2079e89a30a4d32548ca7b2b7de2f72957f716196cb6622601999ac975349c778ef9f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d7e988208469c1d6ff3bf8f1f725cb

SHA1
1b3034381e76b8025dbc593a13ea89f1cbe482ac

SHA256
2e5eb99110fc92fb7178ef7c6f0ee132ee893995bfbe06c82d326cbf3afe8cf5

SHA512
35de093d56f91cad9d2771925b37f5e7dc488bc4ec7bf13dbfabff9402f487987dc3c980295cbbbf588e20cba6231de6cac5590cc3214ff6fd0484641ac5541b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7017c1781da43d0bb64401a72e32d13f

SHA1
f5d660d0da05795158a34a142876f54b26a726af

SHA256
37902129d620c7f500ded78c3234b2d23b29091c4a1f684fdfedc729d562512f

SHA512
d99e3bea95bf6c4a8fcc748c021d8e9b6f2f671e6532c23a0742f6aebf9e01078659a99f8b6b3d6aac655eda080732de6be3eef4fa6753cdb56fb6d19ec760ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abd419d8a7d9bffc3c2e6d7286a24741

SHA1
8d618f99f0b3a08f85f7af7d234a23a4a7de0bad

SHA256
a898304663c1b5d2da2fbd65f2c4d035260e19232066eee1e66f15920a026559

SHA512
d44606492e8be33d1d0394942419d5fe8275c401a9b30dc5008b3eecdb7aaf1f40f3c31347417fa4c36e4a2a314be398c0bcecbc9bea4ba3c73918e10218a63f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21fdb82889bf09e4b7970713a11a31ca

SHA1
e9e60c36876c0b90b25a71dea49ff535fa4a0442

SHA256
c27da8704c71b60fe1b2eb0b501c7257f09482501a3590ce4cd37eef30351d1f

SHA512
130631bae5a4e959bdcd33e03b034253863f44f3bcd18afed5917e43413e4e871c3a457314e138d949b700ddcb8d6b8f2997e4332d381c8417f002cd274e8ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66272eee99d7a68e827ca332126a0753

SHA1
fa2c9a5df75f3f69f426a1b37889a2cbac735313

SHA256
06eed2758c92ee5e96f552e341c96dc3829af7cd4ba0b31b80bf3f5ae5347c16

SHA512
f49a81a0d545e9dc4f0bc0547b9ff69bee7a50278c76cc7a784ffa84461e05198a4194c6f0e7cdc7f69604a9cbcb03dfe41a65259f2946ced4b295ac9e3af9ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ed05027d3f9ea8c7cb7afdaa3eedc88

SHA1
14a2c8ee086e55fd9755f635d5e0aee4a8d9670e

SHA256
f0aae4381d4dc5ed43e1145a612f4cdc13e9c46d89ed3a534c66cb0279c9323b

SHA512
acc290cc30ef842540fe32e72c739711751ec950adb6a44c90e47b7416f4871bea03d64d71b508c87c9192696345fe685b2b494c564c6e1980872597976446ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e414d4b11e183cd2cdf1b0107dcf8f5

SHA1
9140d60cb9df3ac3733435cad312b9a209ad239a

SHA256
a78106cc1d15f5e4e1e56b8f8be8562de84bb4dcae542163780d0f22336781ec

SHA512
ba6b806e9e92e406f40ef57cd7adddb23c68205f6b5e02e01949f7eb163d9356bd3737eaebb81ef2aaf678ac22851a0562f2b353272c03618a753d4b47af012f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac81dfd822893f9aec5dc141df35aa03

SHA1
ee6fd228d8c78ecd112ca3f08d1e4c236cd36e49

SHA256
1762c63de2b41d9035632988c6b9a2842de134dd4de8c6575f9aed3d921d19f4

SHA512
26ca51df0f5150280e6a9220228d1053de933b9512fba894c58da3f7b491d672258a55101597b0832a05617ea201213193c40961a8a8ab854b4d6e3d4ca150ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6045070739f0c0e4fefa0b442f6e8c88

SHA1
6487c07d96cd3fa8719b517331e9e63fbc091fc4

SHA256
c79b602d407d0c4fe6f18d5d72c946a58396a00f25f4585d492577436749cd74

SHA512
1d601483960870d36c0aba04868f321b1f4193094e8c0e562944db03e981a95475bd171acb5664dbb1ab87d756ba320b817f1f5512355dbeeb5f21f48146715d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03a798e37a63cb0efa5e44a025df231c

SHA1
8e7040d51ee7a2e1aee7b97f2a46a6eba96e7e2a

SHA256
d5a4ce2e4409def2b956ff546f8cba3524a9ea25e014329fe1d7020e331a4948

SHA512
8042ff47ec006226aec4b5ee971dbb2c839ae66f1d33785392a1eb63c94d7c329d1443e781543b96eb06953c6d4320881a95ca5f305294506b7d319e2341dbf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
388f1b9ae9bd4dfe865fbc8316a6a14c

SHA1
04618eefd361d409fed15423058059331402c88c

SHA256
df7e92bb82c47eedd27baa8878cd5c0edf79c725936b0798c8ee03bf8aa5cc47

SHA512
9bfbf4976e692cd941145a9c2a5c81da3f31ca5db49768a59b822da251a087c1b5c1799720fbf043efbc032dc2bcdf63b69e9625603f59346f3972be1f8665ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
835f32a77b109f11a8bc9ac6e308943e

SHA1
7ff87b11dc727384ca213fa505234267da930b2b

SHA256
40030733c8df615acfc8922235f63a2bdb8d1b94078ae0547b2a787dd3aefcb4

SHA512
b7e536de28b68ff66cfeacb7ab740c50386a696415527a94f8929685780d3514702ac6515f5559e38d761f51ca1bc7629a2786cd8748b2f8eff8883ab1a882e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09eab0457d273ded15498629417a159c

SHA1
18f5878865fbaa30b99440a513e61effc70f4218

SHA256
52ab9cfe0e1944f1500ad7f0df8e6ef23864343741faac3619ff68808637fff2

SHA512
4ac677754b37e17ffbb89c86ae7735dab34525bdd41480e9ec3680ccfa9a425e408d4758d4beacda2c6cb390dec858c0eedc33fbdeccbe15d70a66ab4209eb80

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC37.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD38.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit