3c7c3a0ea0f6b84a342d7bd22bba255de1a08e09f3ce07f756785f6711f49e27

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ee745069fc5cc6af8786b6533a7a1a2_JaffaCakes118.html
Size

60KB
MD5

8ee745069fc5cc6af8786b6533a7a1a2
SHA1

a796b9054b9bc6c6bef77a26c46b726812f1cd1f
SHA256

3c7c3a0ea0f6b84a342d7bd22bba255de1a08e09f3ce07f756785f6711f49e27
SHA512

5eeca0a290e6e62983983f883e10f36cfb50087df21b51e2a1ec7a908e9211c5588a6889d13cfcdcb3c02c9458f514b7a6f0cccda2258a95dd54e650bd51d2ea
SSDEEP

768:JiDgcMwUc9GeCSXuhjrAH+oTyWhCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/Ijkk5t:JtiRHPTRgec0tbrgamchNnWC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423512329"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000aa641f7b69bc580f86fcb1fb7637d750ad14017c38c415baeecda5a55c24b5b8000000000e8000000002000020000000507e4109be62689fff9446bd851a0cbdd68a30fdaa5828a14575175bd1edb28d900000004ed5bc05528f934b557b4b4ebde081493619319c5d5e41e14a7cc4d7ca1198647b9d5bf9048c3539e6c2d2fb82bb5bd7a2fa2282e9ff5d1f0057a033a5646911d8790ac896fd1352b3c26bdb52a52abb3ffb8104b56addad6982c6c628ca317e859b2612a3c51a090b1dd4b5ebe7e671b8e816d6f55ffea6ea197cd3a4bec2c9ac138091eb33aefeb515b5e42d0c16764000000086330789a7d9d360ad3b258d278ee8800f2d4522bec7da74a2b04d56e56b182441d16631f3d742e26230aa1739647dbfa90eda4b479c2900e38b441acfaf6812	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3450D3B1-2108-11EF-97A3-C6E8F1D2B27D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a070f70a15b5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000526f79e6e6551e116dd2e575961122832979854b07a3bc16bcef07ba462c3a98000000000e800000000200002000000039e79a88a8e00824bd3dc170d186d58e0c992798d53c4ae700e8584764c6203220000000445a02d213b7513926ae56f573973aafcccdaaf1c551a9c6590c3122f003068c40000000f7d34102f10fd9d644858409b0e4dd95117faab42166fb41933822fda2dfdc7c87648ce70ad97b830b1371db971cc03de76492a501b26e135039b2708758e023	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2024	2428	iexplore.exe	28
PID 2428 wrote to memory of 2024	2428	iexplore.exe	28
PID 2428 wrote to memory of 2024	2428	iexplore.exe	28
PID 2428 wrote to memory of 2024	2428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ee745069fc5cc6af8786b6533a7a1a2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62e9580d4bcd15b244992e63edf3ce3a

SHA1
1aa07a2b9bc9bb6000caad7dbf016758c0f04e96

SHA256
1609713e135a65aed2e36fabb4e102e80e21c2451aa0e909b6d6779fa17c13ea

SHA512
9e79ba588edd4d668229dab42d6c7a31f8cfe84d051a9f27e100df59a1698c663bd146c117b0b2fcdb53b0133efd3885a005630f49da9a8f8b0ccf7d6088039a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fd6c3f35ebf6d752544616648c51ec8

SHA1
154c2fc128f98a81e3867ee2596e9b9b8f322377

SHA256
aabba693a48294c10083967b0341c88adaf5c8242739d52c36bf24be375cb717

SHA512
d09decbb82ac2eac81aa1fd21ddf132cd0d7b03140f82dbac31af54070667f9e96c062271758c3baeca69aeb9524ebccd40f2e2065b2b9ecaa4bf815c940fec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fe0ee1d6b05a1c1fe72b0c553fde48a

SHA1
56a7116e5f33fd3a4a30a921645f419d75ae74f3

SHA256
5704a5e83e99fdd2b7523bdb0ed2a8a5f6f0de3b6bd8cbdabd2ce34fd275a3bd

SHA512
741bec84ffc6eeb5c224a999f01591c22fb0c403fa29cd1a36e0dabc1152df988e2e387663a9b52dde6b072f3f182224b2c88d3613c5af660105f5627965c06c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c289e7682634e3f2cbd71ccd0d2c15a

SHA1
d0def6d63369219c4ca8d174a73c9a07ab98ed7d

SHA256
f3b5cb35cbf5571f39390d478f702f78d4513991c127821b7718776a71feee54

SHA512
eff763c7905ef7ba4a4c24b36edf0bfb66ca2cda0d16961c8000426fd81bb3edd4cf2279d5009db92ea7e12f6b61886cd51d88e965400431b1919ffa854080b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4204d47c9b2097e0e7d668c2bef53239

SHA1
d6f3fdd720447a36f4f5ae3e962b91dea848c362

SHA256
a507fe30c4557f33d71bed0623db135dc38aacfdabb5031df695f585d1840059

SHA512
60ae6aebd44b093cc89a55feb3c184401695057a16124573768134178bd3724b262a06d17c33b2684613b1cda3180e80e096cd32a48d80e350f3a7a8048dfd80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec74c68d942931711bf2a5d5dc1ce459

SHA1
57206041d8f9483ba6287dc5b25c40649972cfe0

SHA256
62a4c00b32c2b9ae1fde433181b6acd8308f84ba2c214e0bfc4a0ef6ed96e049

SHA512
f9b499302f0644cc13a28bcafe76098fae5229d6aeea67df01c45a2a165e4632f55e949c11589cd1547eef096e0431af6ef3a8df0bed32fdd65e70261d8c1a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68eea7496e8963a84316211e083da014

SHA1
e86a01603232ac4078a7717a4269016f6203e74c

SHA256
72c4f25c0957de5175abb8ab460d2709f103112f465757a9e0e0de89de6f2b4d

SHA512
80f52652c0ef919980c84f6dbd7ff941f5fd40821ac411bb52d4a17116b30d4d2bd87b9ba288da16c0ce3e3bc43e2072f6811f835c6ca00379ea791e9859f99d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9e25492e1b1adf2c44a90302b621e95

SHA1
152334d03c8310035b66598d86f327ea604f7f3b

SHA256
cdb9bd74fcfecf3043c4ebe45365b7ed637d5c7dc1db8b0226ea437275b080f2

SHA512
659118e0ddb278dd1a71a3fbc6fc1d59274a4d7b614a7412e634486a072738b116042ac4246c57046319009cd2ae0c281f8b242bb5289138b0fd8b9e11d99ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34447e070219691760ce23f2b27531d2

SHA1
bc6db8b08d715f0315159990d63394adaec90b07

SHA256
e4303fb2141c5f3e5ce9cfb0f966d06ccf17762b609e462896530baafc3e9f39

SHA512
eda5b6df2873c4ec0282e4b9b5e05389c0f85e3ff2e32fcc0ebaa0961ecefba5e8e325b6a4488c16a7fb607a256192e1585ee9dfbe0bcb4ad0f3c89401ff78ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e77d298c75b71f3e57e2c571a999585

SHA1
5bad4b579b1a598ff0eea6e4e8e3795cf759febc

SHA256
a5d3a85ad6492bf8692d76397e5145dcdd53d2d27671be08595839932ab688e0

SHA512
13eecb5b1552305d4af5f4f31a3fd6944d3fcab72417da5770515491c462e53d98ae6a44b599aa4c16839867f3abb8bb276e7f3cc0ec0ad86ac8ae1bbcb006b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8509a7b43b4d20c70d42ed4480fbcc56

SHA1
494989967f886f705e521466dd2b86942a271dc1

SHA256
e27a9409b8522ae903b39167d48bdc28cb7c88ac0814b8f909bbdd4cdd727b0f

SHA512
abf637a60621fc67b96efdc45273dc573ed715faa26504e1fa3c3d7e45b76981913372f3b1c9df53c2e5e744bdbe5314fe469897e26ace96a5349324f529ebfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
951b3d003a0391a3f1fbdd520321693e

SHA1
35527043c5aa790f064d716482be79ea9ff8eba2

SHA256
6e3a9ed15ce117ad71777f4acad9a263c2c5b5cd01300ff95ef9312dcc1a6c18

SHA512
522a75efa1216e94678dc88f1e93e3236beb24136e41df734a6092fd53c3478a7e923d1bade56ec3cd4c03518144036a26b5fc13bdb99768a00e6fb7078f7cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86451704b3cb626cd0d08301ae6fccee

SHA1
24f712b4e95189bb979706488873ad7bad09f38f

SHA256
ae0311b564102eb7fb4692d78f96c156338132a96c81aef48287619b838be682

SHA512
7c3a979493e110bccd47ac5de18ebd0f03a9dc798e814589e75aa0c6c316c0318de914f8cb7e8ba13a4166dbdee22824e513625bb98e907d11eff35bbfd3288f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cce83e3e792c9a171f486689ef5977d

SHA1
4a979bf5817fc50d813390670e6375d3dd47830e

SHA256
4bf7ce8b74b2222764f627cb640ecb0f980dceb57a6ba5bb632f2416117a0489

SHA512
27edca75defe3e43049f71ed09d82bdac850c0b3651caee62148844e25123d540cb0b4e076e2e426cdde5bf510d59e2d0314fcb3eb2c370e5667d8280e43b075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8de9a09d51bc017dc682fae9bf67319e

SHA1
4ac928a41e21e07ac88443ca350e1723d5a49bc7

SHA256
2b81c44328e79fa2a71bbe5a50cfa340e5bfc1557d65893dc2d546bd4e27ecca

SHA512
0d16626d53873c56aa834a1795e4439ab4f23b9283c0625ba53da0ea1b712a4602a127e0f2a25e28b20cd6249357cba8573451d93696dbea7a97f7b11427d064

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59A7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BD0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit