d9ac6c296a0c199f33c0c29ea029588be4e8d5de3ef269d6283c9f7ce246e3c5

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87a45ce7e5b47041fe6ff7a4f38ac71a_JaffaCakes118.html
Size

201KB
MD5

87a45ce7e5b47041fe6ff7a4f38ac71a
SHA1

772bed33499438f9738b8bf63415e384c8def4e5
SHA256

d9ac6c296a0c199f33c0c29ea029588be4e8d5de3ef269d6283c9f7ce246e3c5
SHA512

edc81fea7434c5ce7ceb22479e0026c971239c8de24ce62b87a2b6f277abdd912996c8d57ab7805dff6d1d3a1f08e23c7e596a0a61169a72f9ade5111ab1dd27
SSDEEP

1536:kaeV7Ym0aYmd+IIH97ChA0yOpluhTLNp3O677rCXGvM:de6vA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c077075978b3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B464DD1-1F6B-11EF-A649-4E87F544447C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423335038"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000654c5d52a3a506f1d35fca06d50b8ac7e4024e8bd0a2f65d10a5f16f6ef5558a000000000e80000000020000200000007b91fdf0d98bd14804f407f84c5833e4bc44961486541d8643b3fde1bfca07ed9000000041f8f8e59c8b2624b5d3f5eaf27d9d4a279e450a52c25d896cb552544fb98fc5166ebcdc8f42375ca148edc3bb024f265cf6f5898ddcccb5195334656ed315494b4757788696dbe5e5bef49cb498129391bee5bc4bde365131442eb897c69ce98402442f3606ac61bcf6bdfc68f3ccf19bf3dc4d60ea1637365e98904c9665c459c5f449ea3f2b2f53b02cf48657064240000000b2c149865d916890d6dafce7ec54ccec4d467593a5300aa096bfa091e1575e96519fce0a1da080051f59f14f7a8235ccd051bd934b227f6b7adfd67a3ed19e53	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000002abc3b49923c828777806134e8ffa9ced992ef1f891a47c76a845b55e830f260000000000e80000000020000200000006adf2aea45554c17728a08721dc3461da208a1487f2fdfa30610a057335194da200000000b96535f5750ba4dbfd8cddc6283a219dc618d0c63ba2c2de8c44ac649b339a440000000e60435a4a416d30fd8bf16d58cbf231f9214456a6ff772a845fd346e86f457f7841ad3a80b30908162ab96a501b467558086d4f67aa558de696697246434f3c8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2884	2420	iexplore.exe	28
PID 2420 wrote to memory of 2884	2420	iexplore.exe	28
PID 2420 wrote to memory of 2884	2420	iexplore.exe	28
PID 2420 wrote to memory of 2884	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87a45ce7e5b47041fe6ff7a4f38ac71a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2d3ba827d57bd329f498d05c5dbfeee

SHA1
31d7c83bfafd60efee4b16ab333fd3f6018fb547

SHA256
f277db4b6be72671fb749e6ebb21dcc700b54055557597004288f1bf464b637d

SHA512
b845700817de357e21aaa402a28bce0f0d7c1aea7f80198bc07a7670df8230ae004bcec8e54f0e01e7c82978a51c23f7dc4f630b9426420be4b3c02a6349ded4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d10f4db50fccf5bb909a225b39cbebd

SHA1
ecc3d9cc850062afc4dbe49991a89605ed248ad5

SHA256
2b6ad2295a5de77604f62ff9b3bfb491c47a02d97e0432b287b1057d7c3e3d50

SHA512
ea4403f7b0cb4bb4f793bfe9f3364a1ddb6c4bf7c20eedf635949967f098c49a9d12757189e226e7728cdaac3c685a2d9758717179f580f82901e29b6e938365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f60f7dbc03a649c452c653069e560db5

SHA1
89fa43905c634e2c2b61f959c75e46b47e2a8226

SHA256
4fc1a5fae046fca20fdbcccb9a5d4053c8f239df5720f8580d6dd5ecea4d90fb

SHA512
8300246f204d6c328522e9111a4f1bafda2933213f495ef83ff7298248104f15a9b47e0590653a1b36a0ac061a03d976d54ab414a622f7c85b57c43b1152f5b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
906b32be7bb1d9a662c9d32ef842bf1f

SHA1
89fa380594e97ca364182fc0cfb757c4ec7305a1

SHA256
3e945c1f5184d588275adcb9b6ed527b23b14c098eb1df3f6837fe82a95c8f6b

SHA512
2e4cab04ea6f8bc83c3ff2c1471a09db4a1367d99c0f78ef5babb6ed4261ddf0400aed878279913cd033be86ed8affd7d93fb83177f13ede94ab8d69687e93d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39876bbdcc58a103a92be324b9301d47

SHA1
0fbaed8052fb5476a8bde97745e283ff7020b2af

SHA256
f2ff65265d59efe47bbe2cddd30353ea4d2c760e4096efcd8db5ccde39d94407

SHA512
f3deb7c9b5b5a8e4b8b7466e72eee1017660c989e957cf7cfc6a29073fc0241accc5f8347095711bb5570f684e94525e269f0c2134d4ba41a13c2c7e7344a252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fb354b19e6627330c899ab52145ac2a

SHA1
bfdd2b4da829c8e8f050fdc184abb9e356664943

SHA256
80bb398b6965787b5744a8d2351afcf5810bb8507629fd472083da5aee04501c

SHA512
1fa67ab01dde25e0cdb352fce58d897adffe97eaaf9fdc7488741c66647c3b60f2391a4b7d6d4a2d5fc8da0c13d2ca1ff70de42e4b3b34692a6bda4022cd0a09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13289318f50c3dfaf105a3335ea66f79

SHA1
1cbbfc7acc04ec4614b01fdcf3ee8ed1e934c634

SHA256
4f19c45c75f02895d59763342ee5e537b7a0b1865058ba5ab3835bd20e979c6d

SHA512
b1804ecaeab5643088f71656cb9309fd7a6950a440e4ff80e6d3360df32577382d9bfa0d834217f06851d9fde5dbd602f762f57bed2c438b08f4ff0abfaa72f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75741dee2525eff9e043b87ebb9dad07

SHA1
90a869048444518021156869ac9355a21a17d626

SHA256
f82d569c7106e9dfc822cbaf65fa67684d03f5e645f8094d8f3b2368193247cd

SHA512
420875514273534f397bb961ea8433f647dde8b304cb0f68dad9ec3c942d0806270544a493910adefe21ca59a24cfbac30c87525b4b141955e6408ff5d4f6133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4153ae81029fee6799ca5bfdd277c55

SHA1
1289b8f7535008b965b52b93bfe6f18b3549ccae

SHA256
3f746311001b88f3aa13aed88668858f67a433589088914ff5700e7125f9cfb3

SHA512
de7310103d64bbae440eb1536464c010fdedfd927787593dd025d454351d8a8758152e4b08631a7834eb299d41db024374eaab9b96de6f3d7ed3ad89ff381938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47042369eb1a40ed5a256a2d90f9e7fb

SHA1
0df30d4d02239fda15dc13061c340ef3b42fc61a

SHA256
6d3bca1cca4fa394f182fdfa513716fe756d6735f59acfd7100dca50114bd4a8

SHA512
c511946580caf5de39b0d24da8fc559fdd77b95e7d6a48bb9611dcfe3bad0c161fc7c92e1f0da3b595ce6563692f3ac0fc073c7bda4165bfeb0266f84aee2ed5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40018340aa93ce315766c1877e517d00

SHA1
90b1efa007112e165516dcaa31bebf8015556698

SHA256
2562c0ca2fa9b26ad9433d5452001674298190147480563136650792caf7274b

SHA512
7f310b6ba6849158b00bfe9d3607009b0ae841f57997ef5726f7c0ed94e711b30718b21c97a4c121e6ca1f292bc4497375d9bdeec1ffdc8d029c9d199ecb2213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acd9ddb5735fa737bfc072e415e9c163

SHA1
7f0d97bd190ee5acf00a1eb7de252faba347a0f6

SHA256
1674253df49db84d6c41e5f041b560b774032cd3812406043a4f036515102042

SHA512
88afb4a24c38240eafafa8ff323291a599f4f0b615d816ad11d81af181f7143863becbe14abffb78744f4459f7d48f7c30dd79fd5d6a1c2cc2446e0c3fdffeb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a8b22f707d5bf9a117b44ffca80d0d0

SHA1
165486c7a53811b30d3274042e43410deaa7afcc

SHA256
f93eddcd73e58df8a8ab019a8f882a0ccf444e6bb371355f84c3749f48c13864

SHA512
92aaabc4e24d2e792aa6dc67f0a604023c035906b6ae8af617b9f36b46681754ff138b8e91f68d90791509b30f8faaab6afa75177ac10c7f522376a2d368a2b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fdb5828cdbc2f2b50adcca2493da324

SHA1
4dd35438f6de0f83d761b9718a01a06e42f78869

SHA256
855c63d81e09b72939a43637524f14d63e9fae1318a22b5ed82beabb545d5460

SHA512
6dc09f27699aa2fadd92b91c46e80ad74ef7a04a8be150cd5ac80577e93392283c85b22b11ca72c41159c63a2086b380609fa77b500beaa2cf56894be109b355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2285.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit