83192d4f0a24ab2fc2276e80e7bc01fee7dc738d4a2c07aeff8f7ba12940d484

Analysis

max time kernel
146s
max time network
159s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

998523cdeee3e0d40773053b281a949a_JaffaCakes118.html
Size

57KB
MD5

998523cdeee3e0d40773053b281a949a
SHA1

964896ce12e92be615c5ac62a8d9c44564696020
SHA256

83192d4f0a24ab2fc2276e80e7bc01fee7dc738d4a2c07aeff8f7ba12940d484
SHA512

48dd298af46fe8d76f43b60ee11c30f316713512da5a651a0155f1b3241dcbe1c3b506671c33e1361db2e947bf96064cfb39a9d79bcd6f93e75df0d74a43eab1
SSDEEP

768:S701qwQdA+fiIDoqVBz5zpz/5TeSN/26qoGOx988PLO3j0wGQs5Iz:SaqW+I6TYh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000df5939dde54007e4328d5b6d3437070a7251acbbda5c4fe4018a9fa64206c59c000000000e80000000020000200000006227105c88a813046245f1cec49421d08834557888b4deb9c880cc0b4144b48220000000cc452808c497503c0d78d787585a9cffbc8a47219576ade050ea6ddaeb49521140000000052513877005584ad012d2fab1c8a0123cf021dfbe61a3586c05581c3107f5bc7c48af0e2a82764a8db9cc33c067755f53c418a8752db832b4cf83d960bcc015	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B586F4E1-2393-11EF-A585-5A451966104F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000af5bd414681f6ae349801b46a346b94240756c036c682bf84f1988876a5c2618000000000e800000000200002000000012177b03cf2f9726bc34f5323ce12b1f24165563abc940094af00bfaa5e6fc0390000000b5f57eb8b0599bac48052a8483720b5c6e5041fc5dec9133e3c74ec62f0fb9fa1d6903bab941c12f3943f556a94f4f0f79b4f5e0680f32f22cb0760045b70bc9ef3be16668fc0b0a546b9d1bd8bc90154369cf6542c5ff775bca4c4e384d352a8436710fbbb9ca8f61e4ac4e324ee7450d56aa87c53aabb9ce3ea50e8732db64e64b9205f75da99100347e42cbee7ae24000000088d860e089d820717e95dafb4c45b313797bc4532f78557ba27d9c3483e0a3be7ef151a350590c6e44474f1ec7f12d3bbbb6326744907d4a7abbfbbec50dd229	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423792145"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0cdb98fa0b7da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2792	iexplore.exe
2792	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2664	2792	iexplore.exe	28
PID 2792 wrote to memory of 2664	2792	iexplore.exe	28
PID 2792 wrote to memory of 2664	2792	iexplore.exe	28
PID 2792 wrote to memory of 2664	2792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\998523cdeee3e0d40773053b281a949a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5103574cba1e1a0769df1ce81735c228

SHA1
48470939eb81fe42da6bc82ce4584ac2ff2aca85

SHA256
d79c45ae9f99339d565f32f66fcea606a9808c4444f680f888b484c151cda58e

SHA512
3df772dc1987c6d59f6c78612bf89d3a1906129f7ec7d81d94f2d5898126d94bfbc31a148fd1de89bbae9aab41eba9b2fab02717b8409e5ec6e9571a80252154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0710cd6361b0ea3d2546254b82d29867

SHA1
439d48a1d0fd663ac3f8dd3048c823e599af19a3

SHA256
8310fed3602f703c3ec41859ca5e32fbb73ba7acfaff1ff1b083c048d7387c95

SHA512
323a82d07d896ed1da0fc11e5b2588eab952bf475eaa877481f70d59cc314a5c3faf0c391bd3590e39ba0d18fc850881c0f5b2e7bd29a7d7aa14a642d6e3729e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
be399cbf0527832b25ddd1f94a48feb2

SHA1
ed10a7752ca6fc16e45d1d268329bc85f0e5fcfc

SHA256
3ed1492b27030fb9a63beb5745a022861de9bcd5624467a775afa1c904a6b21f

SHA512
c06b86de411b0a7555d2eb26e8ea13a20fab86e943a6c27eeaa83e156bb163a3a38ae2df65f207375f3a044aaee560ce7a08b766b6ce6a69431ba181e8b97c64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
09608d0e6e9eb3b02ff4584f66125bd9

SHA1
dfa9212c8582e259d55864fe74ede110bbb13332

SHA256
16c2175b180fe41e45fb0b751c1c7d4a599873321fcfd791f24a0842b4cb9187

SHA512
f180be37338c46309fcbaeb969b6faf04b11da0e5860902c2a3672e835f4e34734c7f8562970d6bd2b24f58592f0857a35d19c048b225dcd9eb83efb9768469d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
311332c4b319fee4b0fe27f8c73cbf24

SHA1
a2aa6afcd91b94f613a1d019c465a4940ad3aeb2

SHA256
9aabaa312ea56e797d1e674ed7b7eb18b06cbc0e619387c63d7cfcca790c3700

SHA512
78443e923e740af7992486d2c47d3665b342034fd3c5b77bfed9f09b208d72b00627f09d7b95fb0b40bb40ffc5665ddba4cc0835276367c8fef4750807fea8d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e57b9db0ce4735c8175907faeae1fd91

SHA1
5af2416a607df012a7fc3931c66849e17c57d3e9

SHA256
52003dfa975f3f606f29ccd5c604d1328935c84eba5a64a2daa669b88a415a54

SHA512
62717443b111511e76eb5c3380aeac784d967c6f3f19cb577dc89737648375b0ad3703b01e8ec6e2b323fa935c78d8381a17141fd4a0752108e6c819fefc0446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a805587e00d29e52c9efbd279b8ae81e

SHA1
cdea92cbdaeb66281a0842c3076a26d0f3888b6f

SHA256
4f4b250a31d655fa3cfde053286e7c2f7bc627244ca1e54a8b61d6fb588322da

SHA512
ce6b4c0e0daaaceddfcd46ad13b01de6abe8262e80f2003cc598b3b504c77e45ba41e1d7f1fa3976c37c94076f535d0a68076833552c83377e2498286b46a9d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2022e114b22def37d5ba2334e7026fb2

SHA1
b0174b9e29a15e15ca3d0f1682f0e3b07ba7ea8b

SHA256
240c8d9f7416100d05cd1f22668186baf32530733aab7931daa6b00f30528d55

SHA512
b36d8acd1ca61a2e4902ae97a1362937763c753e96b5640d4e5ca0b220b26176a2e799ac98f02a267f9a6d05f15bf451cf89ef960af221f9f4631df45c4b6562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c7a4258ab9ad16f5ecc217ff6f386415

SHA1
62470f89f31735890b08e341bcdbf8de644d07f6

SHA256
f1288bf49409ffa8f8af789a77acc7d79ffe82de6f2c14a20ebf0eca9abef3f6

SHA512
e8c47c04ffaeea90e6b858d8a91213a082b5943873e5b232b5bcdcd4919eb2c064b676b9ec9dc9d5c59d73b4f78c5d47e52ce959b40f140ed361fa562c69311a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d201a191286e24d2fa6baba3d8cf6286

SHA1
5b4e8ff289ef914a3ff3996f3188f0448c40ba8e

SHA256
bf35666038346b531a51b7b49a0a4ebadaefa80c275cd310c06fa6018eed66e5

SHA512
7c1c5a7e98808ec52958c2d34858a88826b9d2f9143450042b77dacf29b37ac2c18a085898ca99cd0c51d8f1b48283a49b2dd454e126c5f1f6bfdd9b32e7b22e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8838df5a97c367ba38f28f0dec6b567a

SHA1
11d38daaba46c7b8674b2eb14ac21e5fcc085940

SHA256
b2cd8efe63fadd0cdafd08a7a4c33b0c445fa1d062741cdef28a7d99defa472d

SHA512
e788bfb62e863dd5be00023a8b34575a8118a37fc35a02fb099a504fab4f3649aaa28cbcd357e63bf9231cff5cc3040c71a77401fb925b5a2660decf04438910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d6380b65cf6b59591ebcf94d99257bf2

SHA1
0be6605ab23fce0ea88375268bbb28a56f408626

SHA256
75723781519e3b2b59faa70a0b2f1d0750ae848c762c9f1aaa5c8748ad151b0b

SHA512
dfb084c4ee9c025a80e47ddbcc3c977587e91f34cb50c3758c58e6698adaa9b08a251ebecc1522e0a56815d1f234150cef44d5bae6f2813baa4caeb240030f58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e638fca818127342b1d46dcdeb3b884c

SHA1
9550d1d62fadc833f31eb6802a977ebc2b167cf7

SHA256
1f602e412b49a9e05bf1504172a450386d9719b8f27ec3fc4463e28195d48df9

SHA512
f6f305d8514cfae3f4648c95bdb6cd06f1f31cce5b24d7ad3c6602471d1c7da01fc9d51132de031ff49df328857009e38651ba1c02cf4a5b4708c88bfc2b092d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B1D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BB1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit