586c08653aa899d2eb83fe80e39211e9282b8f6c956f4e150a65e7d5fb0bbdfd

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99cfe1adf220f2804c9681734f72598a_JaffaCakes118.html
Size

44KB
MD5

99cfe1adf220f2804c9681734f72598a
SHA1

5ead93d5ea0ae3d594199c8dfa65c04f7c796241
SHA256

586c08653aa899d2eb83fe80e39211e9282b8f6c956f4e150a65e7d5fb0bbdfd
SHA512

b05b5e1ed32810bedf05b4d1e92e9b8da13619ea4b1d325c3e47a9bc026fb2d869cb09b87065493610950e8afda9dba1b27710db4731fd682cea4171a585d79a
SSDEEP

768:Tl3jS2C9CCCCCCCCCWCWCWCWCrCrCdCdC3C3CoO28N8f+Gh8UhQW4VRJ/qeux42k:Tlzl4bbbbvvvvqqaa00HO28N8n4ZDUaF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423802799"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000abaa7963197d3a311b6a6b7d7251b37cdce3342c8e5763bd50056d2988f9f231000000000e80000000020000200000008f666079f6b9f161d15979662ea45c0c09862ce2ac16fa5957d4a569fa2da4a990000000b08b4a33f9313f9546118e5d4af20ed07b513c6b925353095e912751ca07595f9fbf4ebb8ce4916e697d8316cd48a9dcea2464a7fa38ef4e1d21fed544ebebb6ad720f551e93245e801fae16408cb762d23ff6388c619202ee6e6a914df29fa0299e052cdda83a7e0c8f27acb5a0d1ece064b1e82ad036f95d34b5ba1ee1e75e0443725f8565b90916b3824b2fcbbe3c400000009fe8f9fa576d1e212f39c8d5805a07790c8f8501edb73b0f575f9580ffaa42635fca08e9e7503f8f3912ec552f707360744991be4b4c410e59ab6f0bb0b5c0d5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000db681d040594e2ee464a8186e3e52dd2553019033002334a1b1e7f91616796fb000000000e800000000200002000000004888f4f27afe7a0b29362f41a2cfbb0ad91778212843babb1a8cd15babee2b32000000054bfc2be90cf5e7f11504dfb6c8746e08b118b55535130eef02d89201752761640000000e4ebfe8c083ad4bf6169f88b42c9d35de80cb0a136dc3535b68b505a93e546547984e955f5d3f8c3216283d6c3e9d8a6168644d16d02d295b21c23cfa7de662e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{831F4391-23AC-11EF-ADEA-C2931B856BB4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40145658b9b7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1304	iexplore.exe
1304	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2092	1304	iexplore.exe	28
PID 1304 wrote to memory of 2092	1304	iexplore.exe	28
PID 1304 wrote to memory of 2092	1304	iexplore.exe	28
PID 1304 wrote to memory of 2092	1304	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99cfe1adf220f2804c9681734f72598a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6879eea464531654aa5c21eee965d00b

SHA1
3081e6ac98c3a47b722a92a7e0711783458f1717

SHA256
6e3c520ce983e09b53ec1bb6c806660d30065f19b1bd44ec0d0719256139e21b

SHA512
4926194c907237a9bc209e288a260b31740273f1b8ac817e42165a5543e236b00eb26549af396096c5a79925a2138aaa0948dd7d77702f05b43b6e44795a6545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3eae054fd4352905333a0b3d8cd4f0f

SHA1
450f8bc024f95902dcb30add51f4dc654cb35cab

SHA256
ce9f0664da5eddf85e7860cb8a127a04ebfe0128e0958e354a5ab6119004e562

SHA512
168d839aa45137978cd85c684b1053b601f051df6c4c77fa610b4034adeab77a8c6a6220ff05c9eb6bd4b48124bd90ba16621580159a03a22f98bbec5296aa1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e90c28427a3eaef4339bfc464d1586ce

SHA1
1660f7af0b44ffa1c39bac3ca747584d3cd6a4aa

SHA256
63bbdee0ebec6467fd4ac8da94989d5c791501b34d46415521524a2d60df8471

SHA512
5b87576daa1cfdf86d84f93810ac16c2bb6ee9dfc2de7e2a5029f30cf2a32b1c05963cbc946dd94c277a54c3c7d502bebcd5f34342f69e7dc072d2e7101f03d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00ff7221b12aa71f2389a3bf2f38db9e

SHA1
cb99e6fad29597bb09611265dc714b4dfc998ff8

SHA256
0e00e1638ff5cad0a5e3cb80087ea7d45f7b0454e4a6201e86eaf3f250ec1322

SHA512
bd6f7e2a8d1b06964f2170b857618f968ab18522b3d21e209bdcc5bc25a92ea5861ec1b1848142444835ffb5ed6ce168f251804831d64c4c504ab1f7e2d6a934

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f01395c1fa70bcbd5c23dd0d3600ceca

SHA1
43c021d186d7e975f6d8f07bfd0210256fca872f

SHA256
6cd12e1ab7988991f3439750d7925d456caea884e4fbe746ca5fb4c478a1e4e7

SHA512
38827eafeb2c3903092f8c4c60bd55571669255d12f4f2a266758446423fc257661306303386d29eee4231649ff318c92c7dbc45105206947e2ddf7e93d013d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b040a500688d896c1711da9d4a3398ea

SHA1
dc893fee0856974b5448d7e7e9b0b7d7267b8eda

SHA256
5777eb65e0a12c038403b77ec08c302f81d677cf5442da152cb340ed140209ae

SHA512
d5c59ae274df7df795c4251b4c0b100e0b6c764b744b82d7f904d510f8252310b31631d982673d9ac72bc15642aa4c76967f01a2514ed7d3e2fde0df9bc1bc65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5523de90857ce6c1413e44207acd0eb7

SHA1
3a568e52fefc2d5aa963d779506b93b612d48d46

SHA256
23da6916129e034b83ae336c6486a249000b2e1176af6e642155b4d37bc80be5

SHA512
1f5fbc878f1c8890c9d035241dcc71e720bdfb044c9bfdcdee3d621804536dbd063b9a984d157632c7a0aba2ffbe19c1a7860dbcae5db5c9c487f05e7715713f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8cfb20bbeefd6180364498c1c0edc26

SHA1
cb984479a4ff1c8a6a11bb4fcc1e33086cef64da

SHA256
9d03e2ac1e004c18818e7d528473079404b8beedf16e2dd9a4fc447dcd8624e5

SHA512
5aba9d56b64ef886a34ba21956b668c09947470ac910847febe335ba2d858f36dd958f7a7a32136efec9faf07aaeccbff0bf735a9bde5da403ec1d67c9e75171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfc92ae9adbdbd3a9807501e2ef5fc74

SHA1
433523aaabf85fdfbb621aea558883f40b49e200

SHA256
d1fa20e8be8b7ea76beb45a73722937003f0bdc53f2c71df88c1cbe782c2c424

SHA512
66f40b58e168e7224b2cc274ee4fd1760e5b4479e2b940eeab2312ff5041e1024b968da9efc00bece73e1db1cb1b95db31154ceec877a92ad22227424942f821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fd8a70adbf2a82a2659ded961892720

SHA1
1fd21bac4f9b2e1ca18aa34c42edf848928511af

SHA256
2a841dc40db605804e0b1f4700accc44e8ef5ed6655d2098873ed38025485364

SHA512
ba9566d40a9789f83239f33ff24a04fe6545614583b5a822ccd2fbf4332fede3a7bc225a19021b349a02ec4ae5b078043eb13d655af89d471611b5493221f447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3fc2c7b8298235e27adaa47ccdd51e4

SHA1
86b4a9436fd35fb61f540b53308db46d2a277dec

SHA256
bc525ea65572b208ca63ba8b5e271b041e4113ae54f86e1ef84c4afac47e5900

SHA512
80b486d5070a6dd441ce26e4666620fd3234421ff3d85a7bd5fe378966e2b1c32074820219924902bfd1f11b3cf37e0f8aa8d6212c9fa92ffeb46dad8aa84b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39ad933d632a0ca823dc4e382b4c3d37

SHA1
4c1c9b35b8541a847548dbca399b2b96f4a7022a

SHA256
1f71b8982a3917b2c49fefd785185b77d48e8ffddbcf8107d73103789277f25e

SHA512
7755317cf9b7e2bb48a90c2198eab4ec2a089e8dd381dd138cad385340c821241ebd6d21e8957c115f686ced71d8a7760cb28ff603c06ddd470f317a06a93979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
75cb3a0ed4f9c28a6998031432b23ee7

SHA1
077c7a2f025bb1ad4ddb585b6bf3fdf9503fd135

SHA256
88d15497067e29a17d30c811fdc722404a6f89bb4dbbfe41bc7306ba01aad913

SHA512
0d9801724d8393fd3ecb4ed2fc04c7b8e881349a56e1eeb7228c73bbfe80a93f8323ba19334c889b612aa46e3874c97a637bd6770f75609e51917901d7cdce0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D6A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D6B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E99.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit