cd6404b1f22e8dc82ad3ad7e54acf04012522745ff04ce80a4c50e7c9f80e182

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8620c814ac0306438f51c03ede4d9dcc_JaffaCakes118.html
Size

21KB
MD5

8620c814ac0306438f51c03ede4d9dcc
SHA1

bc01825c20ddbab11cd58bbeba5ce0229a1d199b
SHA256

cd6404b1f22e8dc82ad3ad7e54acf04012522745ff04ce80a4c50e7c9f80e182
SHA512

65b0099b8142f3f6b3e8f455cd95e4e4d1d91e531dedf9d2f65bd221d164fb82ee75808c868964b231612fb5985f11079f46d0be83599b42d130a7ff3ab1ecee
SSDEEP

192:SryCiJE66hiqiFZXwgDULkiddsN+BYkK/akMPVjXGkrQLkij4MnO8CjUAjin5bN2:SZKE6BWLkmKk9kExGkrYkijFOB1IZM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea5591af1cbc0648af77267e15a02dd90000000002000000000010660000000100002000000068b5c4624270a59b99376fe59495c20c924958365dc213fd7dfba3e55c2bba17000000000e8000000002000020000000313451d6a82bc38ee400086e0f8f99ca045eb6170596f74362d144d10b49b88420000000ff3d7b277d7e17da78a19053a3b76d81a337c10bf894697970ed347aeeea3ac540000000e0af9d4d3d591c050639c44ba66c9def13f95102c4e7f86356b8461a2d06b673fe8f3fb98e390b6d830fdd9829b4d114479528bde1d25ab660ab422271ababfe	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423296198"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e3bdd01db3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea5591af1cbc0648af77267e15a02dd9000000000200000000001066000000010000200000006bb63255c4fa7a9a5db82ec522f647970308042b304bafaf06582dbc33bcc304000000000e80000000020000200000009a1d656d1ce0d507a5054345bde9b935d70e5a7b0fdc7d31d6a7d49ad46fc1d19000000033be5fb721dac2d88a59c6b9d10f4555647474f5386bb921bf8ac8e9dedfcafa27ffcd8f7fe123ab2b1764a5f3b17af75196ba40b5592b91f8e0f990b72739b3ce0f17ae48255c665a857d63c22cf1f4acde2b1a13f1657d4beda774f434bf2e6bc99ff73b0374b0ee2ad4bfd2119ef7d712bc1c24fe104a1294003f75786af30dbe2290c85424fc266873cfc37d102640000000f165a6cf38f1d72cbe884d2b6e3d0cf1ec69b3252d7e0a4ff1496e69acf34c883d652958468f4f51e1549f679190c9c0fe731ba460bb33cea6119f3410b157ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAA3B041-1F10-11EF-A692-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8620c814ac0306438f51c03ede4d9dcc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a4576cdc4cb3f23432d36e21f0bab38b

SHA1
f0b401702705c3291042e788fa4868d07c7839cb

SHA256
a5193776cbb4dc29bea9e5473f3c34b77d79502170806f22c4d13db083346794

SHA512
3f9d8c46700c6184c838ea653a2f887a413954ea5fc209fb47a62998b90e4efe26e84a1ab6543c2d586f7c37d325fb5c620ae366f01145125297991a20426867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a4bea68a59f5c642f16720f1452294f

SHA1
12c3fd676a5a443ac26b99b0ed634ad768e2fdf2

SHA256
4d987268f44934b8c285d396648ac46c7e31d5415b15c7098aecbb36dadcc90a

SHA512
2be55cb4f30de66d89f6241ae28f1a50d949e5e1e23e4146c812275548ab16461e60b79e77567787fffe151d009ae1a6be84edc40ee88d249a0ae7c49fdd770e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c3a795038a1a1a305a57b72b0c90bfa

SHA1
aeac2d3ad2709c4287ec6badc51dded74712aaf0

SHA256
fe3b41de1be4fc913d7bee901b5deae283c5e0e4d5ffab821416b01a9b1d805c

SHA512
9976ce6a3416f40cd4358150e11215edef90b6e1458040bb1304d125b8b24cae925426e22823b3b840549e2715680d94bad4df23f653d0982e28b7311eb6fd09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bb3a7d685f2007371074778bdd1f90b

SHA1
a5bb52e9acf551b72b2939f1786e25904a244e7b

SHA256
7288515bdaca7649f9967edee221e8074b1ca3aa3cc440ea648df49e30ff2e9c

SHA512
4cc3f871f803e34e3fea2c753ceaef9addbf5c04e60de7b7bfc3d4400829cf1f9425e52b628173f909529fdca95d9bd9fc4536bb1b2c840643892408d12ba3e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c065c7971ac37d3ee33288f4722017d2

SHA1
e3b6d192259a055b2c72b8efaa970423e5cb13c5

SHA256
f82692f2d6d21453ec9136b27838032fd04b3345843b2ae3df16cef1976d94bc

SHA512
9ee1f12857766ff252926a0e83c182c91531985d53940e55714249c00376d82803d4fc2c95a9dd7438552fc5482871a23b8ad1209fef28e764f797816c00b7a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26ed3c610b6da6afb3058cb35ec74ed9

SHA1
4599c5755f724ff1a385c2448829e06c77c401b4

SHA256
20e051f79cf03fbccde2744eb8eb88c4395bf7c80cb3ead9f71a82e2c4ec7e74

SHA512
dc22d1ae831bd479685bffb0aab1f1e83850d15d5145ce08a1e6ebe471f1934c41075157711614b8daee825dba7dbe6a7435fd723a8a97a4cc274a0c158d2a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7564792afedf49a0c2a20a23259a95d5

SHA1
e805a1be2646ed5f152d7c2a028b1c9f64ab48e6

SHA256
81c178f10406514199852ab4c9dc43bb7f24ef206691cc23612a8746a2fd7ea7

SHA512
94ecfa16c4edb44bd91547abb38cd97e9120de7cd7f3ad96639d1a8a6909fe28acab746afdf1b6944636f62db3bce722b8c01c5f9088edea79ab2a3e88eeaf15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0ace2b7e67fb4fa5f4c72bf8793fe88

SHA1
e5926f2d5c94187ec01afecd51ff757b1354941a

SHA256
ec6400fd8f7f1422aa6614988af13f2dc3d9f1e19f55e42b86eec4cfe4850d57

SHA512
9a1b20dc87f7eb2b11dc867b23f7ae3ce00f9467a29898f7ca1c9d82b80fd8dda5f596961f3cfe9048f641dfbe04f11016c0907e51187291dc28e19d5c42594c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08463ca799a11fe66a9667772f1a9db3

SHA1
610afce93a43f83ef02b91169159ebe34ef59d5f

SHA256
59593a24b65daea8ade6c6bd8e55b146fa568f175eeac4d714f05b4dc6fd4cc0

SHA512
10932b71e5d3a927d5cdefa24e234d1e84a8fbbd7fa432c57714900e52e147a5a150a7d2e97ad6aa74a2098cdb0934274285ac677097d0ad7761dc8a631de391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b6f99a2570c9613a40dbb97527946dd

SHA1
b005d5097d819358380b37f6823d8924d3fbe63d

SHA256
2277ab73d964296ccbd8149a5f59e7b425fab47245750ed087d5e9f2ee8c39b6

SHA512
f12ed7cdb82f6081e6c5507eb3db8f58718f58f348b9a507594d13451e507a6f5d1bb0d224faf76a26bd553d14b86335cad9687242845ba9c6d268ec07b70bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5108b83e5aaf843d9356619c512bfe49

SHA1
bc058d83531cbc3aa1b71ba3ce7359ed461b82f9

SHA256
b20dafbad9fc6efc559decad53ddb3a81b24b277068083de07e15d9592343313

SHA512
176e2f26bac26701441559e10071d739de3da74dde01add6a44b58a3a18dd64e0cdfd96ec7015f6b792d4ee34c75efa26679a414844ff551d27f0f8e720ad76c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dc6ef6c3735df9ffd3310de9c93b10d

SHA1
5503ea2f99be2373e0932a8ca6269296ac8065fb

SHA256
d298dc91a8e686b2b2a5c05a19d6546b4622c7dced99e3b9b87d56dca1306b4d

SHA512
451a99eaf20c24d7359aaca456f789b9224c9483f5a2dd7be70f878b01d4ffb3f9750c57005fde7ff0c12adab06d3d21d04205433d03e5ea6465aa656afdb5c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f07bfd85ce1fc82bdbe898d3ad25cccf

SHA1
53d8ef673e1c5a4bcd5faca31a57d176716f883f

SHA256
9f79ba109339e84943de7e1f32f0e1e767133a90dcb9994690865f61d7dfcfce

SHA512
8df762144f173e3cbb3d27b906aefa4451bac47076454e5123114139ca85c85ec223eed99850f0a55c6e288047f6180f847e3f5975835e7f9af356a27449744c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a43bd4e41e5c6ea57556782aa4e4c507

SHA1
2049810e69058678e20727efd3cad37ee2926c37

SHA256
b619199017728de3d18c16dd826d2991670a8d8e715aaebaace1cfa28866f70a

SHA512
9cee0b7a7808545636ee4b90459f91f6fe52ac17b8c73130d77e11d1c0bb3ae65e68ae2ca17a91f2e9abf3e4a99efc1c397ab150d2a451f22ae2fdbbc94998f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f020828885a7dab57ef2b81d4aa2487c

SHA1
9afec6389dd5b7e2c18f0477a3afc7b93156cf8a

SHA256
75d356ad203451d40884c2c79097283d845420d96fbe70cb690e16d079064f83

SHA512
d1a30253e1a5a72adf2665d55b3ccb264040cf575e48cf95f8c227bec65910edb3fe6ea5a44e4a787d0b49fc9bf1782fe03118d022824656c6b6566e5fe76597

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7EA9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit