f85c05619efd21324388182092a2954d9846e28790c7bd3668d082346cdf2e58

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

827147779ca7d54bed76a4e77e2c0c26_JaffaCakes118.html
Size

50KB
MD5

827147779ca7d54bed76a4e77e2c0c26
SHA1

011300e937afdaf066314f36a464e7ec5bc504a5
SHA256

f85c05619efd21324388182092a2954d9846e28790c7bd3668d082346cdf2e58
SHA512

6a4784a519f938cbff7b69b30e4d64aec83bef05312b54493da914da806e9d612644ba0ce95bc868e21ee022a90329191933691167899347c60fa5b7c457e919
SSDEEP

1536:8UGKqUs9twdQiCNjVCEoYmKrDZaMkvww26rGrP:8UGKe47CNAEScD02Ee

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000001b989d922313007f096316e20c76116110f772ab23445b59845740222e00b1b8000000000e800000000200002000000067df2a60f98e333da9d1e404a316b43487b0e817ffed82ed0a3064b0df36b237200000002d9736c5a328a576108c2be33520d40a8dd1af0777150fa45b71b1ee8ef39f2740000000894abca5d55fd5a65fcd7e06bde057db8dccff06eed3e22b222024e4ace4d279ad0680a84ed2a7918e2ec530a8f062c5005e3810ebfd0c7637467ef73b1eb35a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000e0b1c2b184fa0edd06caf80db6d97f0e940d4c26eee6dd282c666cabfb8e2f03000000000e8000000002000020000000ca1b960df1779a34bb653efae196cb6d9f91418ca167781f6ddb947790309b0690000000130b306a57a56ec4a7cf11781c975acb0cdf394bda4fcff55198a683909f73d1f6fd5b58d275ae7cd8737759af3876201e5391e7294329ca9c20a2a4f298bc89b9fdc0e7289628948d26519f1d482326c09cd05aa88afe521e13e9083a0717ae18b86ee92e759807156f6103173aaf3d479d4fbdefa4f8e4cc3bb5deb7c3e2f1d6f2cd830c13f3c5e01ab7e10dccdccd400000006018653609cad0597d4f006ebbcd033fa71bed9500e2387d4f330b61052d495fb03959ed5fa2ed3790b4eed04e3777a0272bb0b6cd9a0284639fb5417369c363	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28BA9E71-1E18-11EF-91D8-D6B84878A518} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423189325"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501ff1ff24b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1276	1704	iexplore.exe	28
PID 1704 wrote to memory of 1276	1704	iexplore.exe	28
PID 1704 wrote to memory of 1276	1704	iexplore.exe	28
PID 1704 wrote to memory of 1276	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\827147779ca7d54bed76a4e77e2c0c26_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ad92307302bb333afb68a89e7a45790

SHA1
9dc0fde749d83f38692d4d3f44ac37fa78754e95

SHA256
120fc92a199edd7de334d02eb435271707778c3d04b4adf74c31a6f001c319af

SHA512
4422e2a95bb17928bfe0b3e04b4eebb54a0fded16b82ae85611ee1c1242c5b7c7ea88e3b359b0af4c0816845167efe2ba14cba9ad5d1a01b9b0e9f06866bd52f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79cbca103ba3049318e8ed16f3bce4a5

SHA1
c11844dc00411fd5564c3a99c77339b75686cc10

SHA256
45cc20ffdb56e06beca5782cc2ed6d680dee86b531a62dbab8f0eef583eeffd3

SHA512
304104465d8a70ed4a2ff7f9f900fbc1bdc3442d4002ae2c3c08511376db3b34ad2a9f99a14f3aa7d8d3d360105242fd1475efa192fb6c3870b55ee437558e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ec5c41c6012c15d51afcb178a92cf6a

SHA1
e85102ff0d57e7cc2ad805f7f9f4447c876d798b

SHA256
10b929b857ad373c3170ef64747d98f6b8bbcca455a09e5dc29dcb2d6dd70010

SHA512
72cd01b2bc6cd5f7c079900147a12343b30f03e54c896b9b27c8d857a59c62842c3a9e5c26251f6a15787c37d3b3170a2f2731144f805fc0c9b53ea5847b27bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bacc3f8bbcfb2b0cabd0e6cd96e77e2

SHA1
69a8ddc39bb938cd4b52367524fee3c9a490c006

SHA256
c73d1bdbbd40a50674567f649db72c9c3fe95b0fac40fb656c4c0a93617e1268

SHA512
bb34ac5b87cbaac70d5b919952ab49532ac2e16e6db465f4281792af26b9d32577d4e8041482356cea00a0cc5bb93928fc63c209448b622692f5cf7ce636db6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b300d24574f126b6bd0de4b58ad018f

SHA1
e9682150cc7fd2ae58ab1e77563359b364f85f54

SHA256
afa91a3890dcff39ff54f79532036c2c0a844c5c490d01fa86e6373897ba42f0

SHA512
3840687b02a5d22e549f6506ccf1335cf1e3564eb847495a93011cf81daeeae8a83cd3a89fe081309a3070f37353b7f1173bf1fe640af0b86a6ca3def2e79b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fd372fda1041a8773c39766b7a4944a

SHA1
80c876db53f9d95b9466a37f7d35884f6cc61ce3

SHA256
98c66f42a125b8192c52c22502972e4b27ec21a656e8c5309e7f9742b5fedc74

SHA512
15332c02fa1ac659495530841ef5ebf04998fe249020a835dd57c260c68cf52549e516353ad2c03bb1d3e077518660cc675495c7806af005c8dfa423ba44a4e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98050ee49aa2bbc33a267dd3ac6374c2

SHA1
bf0b45bbc4f8bd52b8c72892c66e775237343f7c

SHA256
c89624a5646e96e6a17cdc8326fac0fa5f573b2f8c54f9e9be7f23bc3b27218e

SHA512
5d84c39ce6642347d5fccabcca4cb7f07a7415f394672986f7231f42c8c555f2bb6f7d1f2e89806bad6417bf6faa1722a90f76da49121b00596abeed079d1175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f542965d207b4522da349e6f65a8d9e8

SHA1
0e7f60c30b0500777faf2e6d0683466b6d295741

SHA256
55458e965b0cc95d2b09c1e2c7ae555b4971c1658cdc133a48c997a84b210bc8

SHA512
353fb5239b48ed2c99ce8802920c25f3b55cccd871be248625014bf5138007b3f3debaf6f39a9add2aea874e6c7ea30917178c642a87d84ec018da0db85ef801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
767540bf97d8849e313180fa8a7d157f

SHA1
6a26bfefabe1af20939dee4a292e9fee5ede2b96

SHA256
5204e0cd432c7fdbf7b56303ccc6a04a28c0d7db1788b4d1fb6a372b0ca2885f

SHA512
8e5691d4473efe6bbcd1510126b40fb5a0a9be8e7650f21cdf1f84279af987560856b862389d4080dbb539e03e2dd798427b95c3c0930c4147b1378f07ba74c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
602f7cfb6efc2fd6399567b10baf2293

SHA1
9710d0b8da547f15539871a61935d5b9d8e12e67

SHA256
5fce4f98f4f582b141c46fcfdaae638ee9dcbf57879fc246de277b6b0d1e7aef

SHA512
1702fbb8d905224716e1886bc04d81e414c4eb0a82f2848c93f94eed8965bb0e2699b58360f36c4dae47e93400f3e343d7b4756023df9863e66e96f62144296b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fec9edde59b1b96205e114d3a8d7a32

SHA1
fe20885738ae3cb2423d2681e5f647ccbbfa9ee2

SHA256
458eff65a40397d283e7dd5f72ef657771743d60b7583e9b74dde9475218819f

SHA512
31bab9afa150af778cbce5be002e72c6ab16bb8f673e309dca62caf51cdc80c1c96a73f49151ab8a08df2c516acc57115b8a57a6c350f8395720dc35b9361b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b1834e863a9bccc86fc507cf0c6fbde

SHA1
ea5219dc92bfdc5109cde924afe205993ab10160

SHA256
1c30a4ca53f7d0ffbf9cb12b3481d222e0183b9a15caf7af4539cfb5be195eb0

SHA512
3c56214558f8f2421870f63dea58a1d088b2a41340911a0b89d47960b54cdc3e94dc5b86adb239dc30f019af825f0e9c59aa1e630bb093278428c55707a935ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
464c464a1caffaeec92104801a73aa52

SHA1
d833538dc590602bb60730252c0428e81ec061e9

SHA256
74edbe401a67e328f40fada6373d5325e029631e9b3f28007be4d37d506c0a45

SHA512
9e64d502d465f7f2cdcebc62388a871f6cfd0e0693551fe0ebc92509a3af747b7a79cb4111a12310b3ed75a2152f8559f464a67aecea2905245a08790c47e9b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd921110dd8d90055c48fcb873385369

SHA1
2fc89a91a40fc7904495d0c5b34a9bc7c69191d1

SHA256
eba167ebfac9d11951a20a10d27e85810d470784fe241cca90f0464945a4e9e4

SHA512
3eb9def343ed4f9d15a91465d7bf4a778f07b44019b077ba3f66e7bd99166de8aca6703136442bce4efa57687f236afa5c78838fa69bf5c1aa53bd25da280c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1749.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab195E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19A2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit