37d1384b461539f3f1c2ca6da46231023524a7ff20a3ed5a9a4f3957a9f5090c

Analysis

max time kernel
136s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82f1012488e82398056fe09fcb19aee1_JaffaCakes118.html
Size

122KB
MD5

82f1012488e82398056fe09fcb19aee1
SHA1

aa5e173180d1dd2240f58f4af03167d1a732c25d
SHA256

37d1384b461539f3f1c2ca6da46231023524a7ff20a3ed5a9a4f3957a9f5090c
SHA512

25a98436d2baf1c5d26be3060c3b94d2a5d367c214fa589cc180ad3784a9e2eaf0bdae698483df84ce4fee5a0d5e91e7496ee72e4cd22190960c0569066ca731
SSDEEP

1536:SygM/s/c9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SyLs8yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF586891-1E36-11EF-92B8-52226696DE45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e7653bd964aa24a9c7fceb7688ec74f00000000020000000000106600000001000020000000d5a67cb1b7fa1629a39d58a29f39daf6b4412f1fd028995f1c635d30da8f43e2000000000e800000000200002000000089421c27066678a9a1d79bdf35e573ba5c0cc7dce813659a3e66908f0b9ebb3320000000ccbd966a086e92f3b93b5197e9e86f754c1aa68bc9ac0a4643757dcb4f21b2894000000053c24222eef31271ede423eee48c3b74975d7e6adf21ceeccc38eeaf05a9ab5599b227d7fc2479c8a14192cbdfee5b7917d5970a4a00d22ea3442e3163d67ad8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423202571"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e7653bd964aa24a9c7fceb7688ec74f0000000002000000000010660000000100002000000011d4b1252b1b10a193db2a2af5ba0071aeb5b03500fa98c8bdfd6e725f5621a0000000000e800000000200002000000023aff99a989d499823c2c1facd852c1ed2566afc1dab13f211a5935ebcd7658990000000e9400b346b076bb32852b4d5d0bd6a94c809efa36063331f2c67fa564512ce789ec1ba0c683974e9102d47833f410a7c983214e64e0390def4ca26a2b1a1c2fce099b0b497aaf58f3dd1badcaaf127743370503d813633272a78ee8a59a76d7ae6f393891e1fc940c2a857551ff2612451bbeb8fe704abea0cdc621a9325932cc2028944a9d14b3b2c062e6d71e4ff0b40000000081df55fab51cbd354af98b1c4b532d31d9112419fd170fe64e22516b325e20ecf40bdbc7ec62ccc9dbab017753151bbb9bc98edb14d76e43bdeffdf37543dd6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0aeb91244b2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2196	iexplore.exe
2196	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2124	2196	iexplore.exe	28
PID 2196 wrote to memory of 2124	2196	iexplore.exe	28
PID 2196 wrote to memory of 2124	2196	iexplore.exe	28
PID 2196 wrote to memory of 2124	2196	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82f1012488e82398056fe09fcb19aee1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31a0d91eb2b74782f1cec393889362ee

SHA1
47774d7cfe4b2dc8adcbd704583f08f894349943

SHA256
71ed0dd0625c3c3773ac785ae7f83099c1ccab713b08e40d700fe1389b7e35fc

SHA512
1836b701435fed83b850d5f3bddf0b0b9713c265602de6f2482ab88787dd53677a27ba00d3c7a5c56f3e2e863908cc1b4e54210f56759edb871f42840857c095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bbcc32b573a88664a1517fcd8c4f36d

SHA1
1324a8be79ea295a3db69117935f137261762b99

SHA256
97ac6c42e5557113aafde8b483593cca781c72a948ad21f6eac24985643eb210

SHA512
9370b0266b2f2a30864abf84213c6bf376e79b82ced9368b15e6b9b2ddc4e38b20bb0101f40feec054fa3f6558047ba0d5eec30e719a046a094bf35e6e62d81d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebb8608117c1e6cdde22865346997783

SHA1
18223ed2ee232c088578dd7c12974558865240f6

SHA256
3cc3cc6daf6c5e54f600400efd99fe2dabc913600a7baba56829139a12d66e52

SHA512
b69be5680e1aff9fd6704ace6c98ed0b5ee1a423313f1bd1f57f418d8b19a449c9e8675649ebaf81cfc4b0c8f6dbdde4b40289aa14b830bb44539f3480ca92c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29039e923422dc0ae0f6ffba2f0dcbee

SHA1
1f5c5959edd9e7731af2f5ac0615feef080f1440

SHA256
c0f74e64ab7e16cbc70a6c8465a0d7700a94d9ae3ba18424af91df6ad7572826

SHA512
0b0f5537f330a9401e3d17b8069c30df9b62c5e4ec8573d26637b394ac33fed656a9270764311ada834ce81133b576ed6f6cda0ea3de840ab5832fc1fe331a77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7f3122429747b368c98069edd073a10

SHA1
6b3bc123e1cd7ecc3d0499ec05d268bda8af02f4

SHA256
f83878808464c2ed1a35a3e892284c903cc70a0de838679e591085671275ab02

SHA512
19dce3dca3ef45d118413db31e67a1b3accfe4e7bedb9adc2fa451d21f8d1713a0c82e240c756d1e566412e3a44b717577844abf1f228df89f8885d5377fa1be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
beb6d982203713910949e253ee8a3dc7

SHA1
e38ba729548ba71d2c6455d01f588a253cdc1fb7

SHA256
7f3b7d43816d5a1fd992646d61bd1ae49f18eac45b0b729a75f015bb3dd4eea4

SHA512
cd2a01f3e4f9704dea0b08d78625ceefb755dd68dc30b74d2c9786a1c327e28bc84f5029d3a5f4af45b057b71e9ccb8a176e86213da541e24ea365887879004a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6184c04ffc2fc0eb6ae4e5f66ccf8fb3

SHA1
e061ffe29cb4b42bf5a83ae19bf0563e03e08f4c

SHA256
9073e8d12d58adaec64122e908711caa1f3ccc4a0142ffb7ce7f94892d78d242

SHA512
c676ea34d6b88d7b96b0c701bf58aedc6b4880fcf1483e3d2edf23ae49f36ba35a09df6573e3e7ca5b483ed85d4f00f240c5b2aa6e53c78b16c159699f483dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d17c24c17bc099e9b6299afbe08554

SHA1
4ee43c06476523cf23675e581efb350776194938

SHA256
b057cc76af086cd78a1ebdeb9b9af61e39ac606c5c4a15547e675041784ab980

SHA512
d2edaf3d0a83d5e70fbca72a01b5803a4fb6ff89084b40a78e4e3f78b5f4177898ed626c947e3d4bbfb8761fc549334ab3d1c725c6c95da6b66c38f604957290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df76e79075d17772dd3ed69b4e402aa5

SHA1
fb9c6993c633cd2988a3dfe6b06a06fa4cbdfae0

SHA256
79a4ce8be686ba9ff9cb08516f1c870f83abc75ce0d37a30b84ef61831dcfd05

SHA512
9e26d8f95dccbda4e6e5bc9473826f068a53d9ba4920e4cb405d5291e4dd0671788406ed951433fbc52a55f5746f9bd9578b0e6b4b4cbf88f2544be4df8b0e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7335ef89f1f1808386a1eb2ad1abe075

SHA1
d163d8b8394880ec1dffd2243506099f1eacf0e3

SHA256
7161e93ecbf57461f9258f788417feb95b51e4a830e4ae25971d4658f701feff

SHA512
65353d6863e36953b8ebdd4adf9b6c7f38f3a00f6b57c5f45a3f2333d7ee25938b82590fce4075b2ab856c6bbebb3d24ce893e3852ad783eefab8fe63fddbb71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cca2f90d2e125b3a9b9881c5a6aab03a

SHA1
c5d4ae762d8425c84f5b2ffff92c625b1ac48c2d

SHA256
f21acc589bf30f2224ede55d68996a6159cf3565df13965fb3d78aae9fbe0ab0

SHA512
f05df4a78164a412aaa1161b13c3ac337285304816b9b3c2de63ec354ed06bf09b079ea3030e2e297ffb6142afba20b07659fe0a7f084d9280e5fb38179e3b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c41cd1275fbefd56f94521e187f80429

SHA1
3ffc2f139e019e8acdf930b1e9d1e73d8bbd2f9c

SHA256
d03024126b1dc417383e09e74e6490f4704d1b54dd2c59ff8e6cdbbdb357f359

SHA512
390c03c846cd47fe23d12b31ac259591225f49f68de182e4a2f24adddbdef8f573b43af965c5bfda8925149aad3f77a1f090da180f7b9a23374b4c383d5222e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B30.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C12.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit