58399b38231649c3998626d3221b71ba0e919509bd647a74b1db46810a1c82bf

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

92d31079eaf90087a8c8c6f05ab18429_JaffaCakes118.html
Size

17KB
MD5

92d31079eaf90087a8c8c6f05ab18429
SHA1

89fabfe54b9926bb73e83836ddf4031eaeeb9ef3
SHA256

58399b38231649c3998626d3221b71ba0e919509bd647a74b1db46810a1c82bf
SHA512

2f1ad564b49f04ec21b275b95a004bf50bc1d359720a40bd4d08d28d57bbdd9974b3983c87f4c2d85cb26bf213a4d9a551a4de51f8d8e83f34fc08610ca52662
SSDEEP

384:+pUsdEQkNQtZ9kXmZXekkCnILWfacpOOhRwOYB3jxI2kiiehNWgO:+pUEEQAkkXoOkhIcbRJYBTxI2Diemd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423615571"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009d0e88c562c74e18953ce4546bf24aa3baef15e80959704538fff0ff1b52190a000000000e800000000200002000000044cce7686d916f5d9a1b07ac4a5f970e2b552f704f8ec32915dfc58983a658cb9000000097449ac231885b621df451e974492730e009525ded6ab13c9d760ed0d357a04dc04a67ba78a086840d3e4ba2fbb51925ff9a3ebe4371c3bdb092efe5f54260032ae578db563ee1c85bd27052191f90242402da7b0adc112daf078f22aa7806dbe23df191618abb4164c1c24dea8da3a12c386d10c9b547d04c78a7607b6a61df9344b4917e0528b40baa795598d9373f40000000e4bd8f386c19a2993eb895290aed162d5b1c6a538e8fb9a2aa00ef6a3f53ddefc5d6e3ee1de3b91378bc89cfdb44788241ef281f3377337973d061c9dea9f96d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96927F61-21F8-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000000f00be99f87010094286d9bc26f6e547c508110d77f7352a344b178ec4fdb7fa000000000e8000000002000020000000f0f89df61ddc60d2341af5b0d3f94624080d277098e5c026b22c02427a5b05a12000000010a8bdcac9011c1bafa416c4753f0f248dedeb76e277eb9809daf2dbd3cc655d4000000000fa0350b20dd6b5217dcbf147cd6bc41d6100d31571764a8cf06726f84692e0a338fb6d70746404a71191c78a725b8feede6a5c455bd887f6d6e3c018744b71	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20432b6b05b6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 632	2288	iexplore.exe	28
PID 2288 wrote to memory of 632	2288	iexplore.exe	28
PID 2288 wrote to memory of 632	2288	iexplore.exe	28
PID 2288 wrote to memory of 632	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\92d31079eaf90087a8c8c6f05ab18429_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4f6dad146232ea7036a2678f7a28751

SHA1
93c4881104de00e9a1bcce4146c28735ad3adaa5

SHA256
7d76d13410ee31da20a52b1e4c8f366471e4ea14aa7a02cfbcd58da80dd0dced

SHA512
82f19d52f11d616b9900fd0ad45c9507caae3d91ee90ba18e364fbd60b995954c257f58ec370bd49689e72721a1f9222922254346c672322eff95e063034b9b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adb790a9ba5b81366a9e2f17b4bf8b77

SHA1
2fabae9ceb653c54ccf34f256225efb78bed6606

SHA256
6d89d984b84239726a2188fe51d81c68fe3881d1e0efaf1fef4fefd6fad0db9d

SHA512
4afbc1cc38ea5f65803a2880ec5c580b96051638f421a974b596ed9e792b516302558bca9491a8d436270f85e1a6b391d336d5ab16d204d107ce9e49286abab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eb50668d75ccd91428d2499550728af

SHA1
484ea6d44cca44a6b990985b61b6a90de0c871b9

SHA256
f91db409ef93499e3b1dced7020875ae75be641e001ab556e3531efd0937855c

SHA512
78cb33f7f7fb4c08a297e2160e074369864df0c35517efaa5d0fb6fbf2592451b7afd64b9f35fbda2e86d74e6d8fea0a73f185098db994a9b3e51e0ebb62315d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3be895f7479d04d56211a76c7be3a458

SHA1
3d0650f5f2a5e52a76b6c69de017820576387fb5

SHA256
d9febd45af9a98a986c54cddcf6728b93d5ed391504cd95049a8dbdad0e6f63a

SHA512
b349458107eb5abf18a2f7ac39ad124781c8bad2de14531c25e4fc57d6020d3b2834b75b178930c9b27832a0a044203d6c66f809d002f271b8026ddfa168fdfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34528e81ce3f89f6fbe8d9c57782adc8

SHA1
b9635abbc9a138dcd5184e4c0e29983670c90865

SHA256
74d5da4619ec0e042b0ae7d11cced5a26e30bc69a54ff0a00081e02137fcb6c3

SHA512
7e72b32c4d276bb19e8b2d60d8277aea4662b61f367a725a023f071e49aa52f352ff105786a26981b0e8b09a2df16179ad6d357c30ccde088351244d06b96627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3c6f2f8ba84a8783789972777aaff4d

SHA1
f51139833d1f4729413493f4bf6045d24064a69b

SHA256
e8a34c869b26eee8823d89ba62a65f247c15898d14ac2b5c662163c2ab44d7e2

SHA512
3bd50e4dca5f78fa0808a025eb06dc4e45d32744697ea781f7a378acc9964d7e5efe7656b161a23ac87f9c980a66f8ce634f6442eb82ffbe7c8d4167cdbdc877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b39f725218ebb5e892b9e008303b162

SHA1
9d15163582875bbcc5a36f6357dfd9ff758a6814

SHA256
87cf6d0002ed0156b417985a72fbe64fe65d6a9d4facc6d7729c06b93a94059c

SHA512
8c7c7784b6c553bb4f1030749fe9b3c23401cc438ed00a011ca75b6b593ac99164000108e5c3cc632144fc815cbd7904a669e7bc8656f9543e82e43018479b95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0f6527c2c2730343b5adc515a89285b

SHA1
ecb598e4a780547b4f9ccd70e083dcb020fbf392

SHA256
ab4602c07d383aee13f671077686abf2794091b11688a81be3d1e736d42cc18d

SHA512
cbd790cb50ee84a90172212ab845546e3404c4cbf49dcf3e847142fcad525c6e3e0023ec2d892715acd6ae595ffbfd26d6a618b47cb73e7ea9762a64eee46406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7f629a1bd77bf467575cd6d606113c7

SHA1
f0f164869f4d346b7effbd586bf5ca439c7ff477

SHA256
11d7a1210d4ff2bcc92ff372abf27343a86f2e29666ab58838d7b967dbd6f930

SHA512
53401a2f4dffa29a89899669647b22cd0ce1298899d2a15755bb6786c3e2a3475200ccb02a371a72f57436490e59bf77449d80cefc2741854f55d0971d7e419c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c4e2d0f268dbdfef6068d5c4ae1e41d

SHA1
76a5fe30ab17587d685738c346b08190c557d338

SHA256
9292a0deca05640ee06471731eeeff47645fc599ba306bce8f918814ec5c4a45

SHA512
61249e2384e262bc2fd600e8de2e8d03289dd4689be449c9efdaf509539454a0bead227478deb4f7106143f7bc22ec409d2b410cba55188e81c50db70d4cd340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adf9fb7196f9fe1e4abf28da5d507542

SHA1
74dcebf9cd0490be7a59632b4996a729ef50960b

SHA256
6e79d4c25a6cee4651699b92223916917d093856d1041da16053082555ac288c

SHA512
7b5c43acffb982bfd1f9e0d4e6019ad20df7aa680779b2f06ca672a8736d7a8b198fec3fe0f5d1ba22a956f76cd82cf95392ecdd21861ae96057363bb371376e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eccab0cfdb9cd9ec0ee7268f36c22f2a

SHA1
3937f1629b0d372ee04a02915c599978f1f135df

SHA256
5a8aaa9ebe863c22919049db200b3214ebd02b621a07de62d51e76a44aa95efa

SHA512
e569531ed32549ef16f78acfbd838af72cfe7104401723daa287c85847d23025cf3f6e4fb8f010335af6dd722f48901ec4193c3c8eae65d0f40483b3e92c1d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e6720e6985b7b06b2d83ccfda5eaa25

SHA1
e2d5910a0c98eb722c3bb1c272fc8bea9d50a072

SHA256
69a136be415f90e3468194ac57a9b3f9f29db261bb77bc49fb2eeb9f92141fb6

SHA512
dbd0500714ef074d58db4c3951786a99afa9edbdfc80dfdcac60ff2b598356878227497cb4aee6855a671e898de12a62dd06cbe5d7700332e9d1a7f04c7b151e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74c8fcaac9523f5cb74d1c62fa858299

SHA1
0cd446d157d4f7c9fc002a3ca22bc755d5096c6f

SHA256
2451adbc22d439d2a53048514e855ab4bf54e23d67c342fdc135970e0a3ab0e3

SHA512
8d89fe5a9b68b30c77354b05d709f8f40a2f760f6b09cd280800749dd42c898b7bb578f53ef1ba5630ca0a1ca1d1c163a681212dff3a7d37aeb8fe3f8c66005c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27cdf613afb16def4a51bc35943ea9f3

SHA1
5c15263b123c6e7f09bf29e7c891b231ae30e901

SHA256
37dac6e0af34ad8e2b459ff06fccde7f88145c7c0975cf7a3c04d1126d50e436

SHA512
30501c9c9549e0296cffa551796ffdfa351e1b384197135fa0ad436bc042c7d10633698e0e7d995672d73e933e62ccdd050befd06732b0a6f5f573dcf0458124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
deea685e86525723b0f3d7ac803c366c

SHA1
64de2dc8e84028b7749b344146ecad136ab81a0c

SHA256
f84b3fb60980a0482900dd21c301f3a25321cd427f74a14d91e735c03ef23d23

SHA512
cbac4e037d1a6e18a87ab29749f68668642303c80f28ed6a1636da6e74b7a1247993102e517fce3dfbba039b40a41f74109969618318753d6751e0c80acae112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65ad094d01e164ba7e5137ad03ee108f

SHA1
e23804d2f920f7dc24daeafe4bd58ff51629b24e

SHA256
e0764c4a5bf396d0b221a4cfa42bfd93332aa8de66364166e3932096510199b7

SHA512
ac8aa4e3a405885f9c528f9ca9cb7fd61dfc50deb106061fc064b5ca88e81707dc83b0a24b7a0db01f0ad8efd77b3d622fb9ced94c9ed3433dbd688b9d29a92e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22A1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2324.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit