45daa4d1c229298c5f7dfb63d89a4e89dc5171c6bd465dbbec822ac425f7d910

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1730365cc493bdf88e1b68a7b676e5f4_JaffaCakes118.html
Size

20KB
MD5

1730365cc493bdf88e1b68a7b676e5f4
SHA1

509e57248db77390084279981ff64f28ce256aea
SHA256

45daa4d1c229298c5f7dfb63d89a4e89dc5171c6bd465dbbec822ac425f7d910
SHA512

a4959158c2d4bb2c3e710910490da30ff53c4ff3ac4b37f09256beaf81e36716299821ff64d498bdaed83bf5bde9b0e89dc123093d3d91e13b5174fcea613242
SSDEEP

384:4+QfPFd9QZBC7mOdMYiuKfpC5IgSnbmFe7AcOz69EHyPd:Zcd9QZBC7mOdMYIpC5I9nC4yyPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000c228929d157c5d3bfd62f137e4dfce42742cdf5d969ad9e3c0d878ca0dd92fa5000000000e80000000020000200000006300a4a32b86f70c838d5252a767bc8ae796cfc1412ebdf1f78c4e6a7af31610900000005f029a9ddb9a63ef64a6ee8c38902cb20518ea942318413d3ddc69e03269aec983689c4c31a43cbab3066c23cd7dabb68bbf9fcd72c1339bb39b8978fd33c1af69de05372d24f5a7c072d9d66501138382919ccfc17a58326f2b83c2e8e7e8eec282609d84de412c036c309e4d97e78040a7303de41157b22bf0e26f10990e54436abf464a8fa027823d79739a5c99d140000000dd5e8107ad75a6856dd6035d0763710c809ba8bd867049fb9d3e6c71b20d8922fa271612b9df61684a5657306dadb7d4ae3532b827f0b2eb11e878f7e9d94f64	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425677256"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f70ba8c5c8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000872f5a0e0d18c64305cd3408d586b4077d78bcbecc3090ade9be7256ebca573e000000000e8000000002000020000000acc02ce4630eb8cb69628b96156ec0a04f107c923eccc45b2a9f96b66092aa5020000000d2af4b0f6885cb92cd858063cf70b02c7705d994d6ce5659f32184be1c236f1a40000000dc05be37fe7e74ac9ec972671905dd5b3678c63bb129d9cc1dd8cc38d875862fe584a5c7824658bc6c0d27a627e5021e62291fd99461f14652959a436afa211c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D28C8CE1-34B8-11EF-B267-DE271FC37611} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2436	1656	iexplore.exe	28
PID 1656 wrote to memory of 2436	1656	iexplore.exe	28
PID 1656 wrote to memory of 2436	1656	iexplore.exe	28
PID 1656 wrote to memory of 2436	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1730365cc493bdf88e1b68a7b676e5f4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
234f184d3e224bd6f08cb91c85e20069

SHA1
11f4ce8348bac1277bbc4c172a911a559e52ada1

SHA256
6bd5a2edcf9cdfc9665770c76ef936950157fc044d2a6cb7b5ffe8cdead0b76d

SHA512
58f410cca3fbebddd936ac2176aab6e286a5e69f323de3b73640f30dcc8c16f04a6132d1ca2ac440c39ec1cdbdad1a5c8853417d7ee60d8f8bba71dd4abbe865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb90731c53a4c2d3cd12bb97c42a0fce

SHA1
4ab4a248fdc7da4b7ac77e62a95752ca05f726b3

SHA256
22fbd74c5bbc72fed14c3e6207612b8d653f5178bf842b22f617e0c15b06c656

SHA512
bc7d818753b9ed364d9cea30575cad648090c22d0cade56ccebee45ea78eae692928f7bede8a939cd37c75d6cdc1ae565627c1e8788147d4cea7dafba4bec6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2898122a87c28623098a5d515ea6de28

SHA1
0b97167b73e5c05cd4f3b6f2b8de7d44f09b6854

SHA256
488faa7ca49ff916772727d9a0c292bc068ff2dd01d4846961a82b230b6a0f67

SHA512
6175fdce7b3317440b7d612b8acd8000ea8db7a11e0e84694a44295be2a19c554b88d252454147d3e5ad08c4ea4f2ae60df6d5e77ee9e9e3958776115d92b00f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7ed7b68f91d308bf46d9aa38cab8a40

SHA1
e434a8ddc585cfbb31ad806ae0c2bd04698cdf63

SHA256
c2e99cfc27d1474ed4f42fa14f4e041983f4aa4bc2763a1383fb10456b007694

SHA512
942813b08b0a273ab92028d9d7d2fdac3bc7b4b8aca1236b9515e0b4ec38f1c8233204574545edee01ee91d106d468ff2eef5d4445f17d5b1e94c0f1c48a8f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e6685b04c533946d90658c8ae640870

SHA1
03cbcc73dfb43d84fd15b30ceee2e5313e9445be

SHA256
ae51eeebd67568e94cb5b0c7c73573a247f1609d5c43969a9e92cc25944a2799

SHA512
a527c8a86ee05652813413d9bfd17b75948cc37b100afeee630b2321be6ee75c29c460fb32777f247635e927f5069721d2f462f12c8b99f737ffd533cb4dd40a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4010dc354f5e7ebdbeb4a15a14dc2ea0

SHA1
78186429b4bd4289c4ed8cfe0b3ee7a79697ed2a

SHA256
1f7a208c9f844a0cc8a093fa457d2337ef9b520c3316acb9dbf591ac70c63848

SHA512
d35250ea4f6cb6da79a5634c7c6223c201e3881e7f865dc99ffd609d3e44be41eb245d139355f0446cc12bd0f23f846b4da0f12d0819c74eaac4c010bbe61e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e853e7dec036a6f59c48e62d9dd33a2f

SHA1
50d04fa9d609614f21cd4fdece8cde56029b976c

SHA256
f131b45ccf24f285344ce06ac5ef438863089497010858a9600b2ddce12ea2a3

SHA512
cc5ba7b49f7b977e6394c0a1fc594cf73a674666d5e061375d66dddc52bfedec934ff88381ad29fa9319ca3b4aaa6a5f08bbc7177e25410aee5e9074fc04526d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
380001dfcfe8b79196174d316a8e6401

SHA1
b7fddf62e103a4daa6ecb141ead9e15bed62d379

SHA256
2a88d7186ac360a9abede52e0beaf24f290d27649fea534ac967c6273aa0ea9a

SHA512
03d66e490e7b9af06aa86ac04b97da9dd8d72f25ea0918e6ef218b2297d36e1ada48e2e18756942267fc7d1936020de96f1d887552cdca0f384c0ad8efd7c2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c20cdbac82ff32df7d596dab55ebc125

SHA1
cf4eba582cac75a5cd6badbc0f2fd9f2b9d23b84

SHA256
a7f042097241bd803e581fc4ca97362ea1ee4880001a31af0cd9ea4eea0bae79

SHA512
38b55edbca5e980348703b0367162cc04ef2443f18f4f3998f53c11ac15e8c451188b4119bb4c7fe5583bc91fb526332abf1adfdc4bf00681497f1f5921d5c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a37c7c62e9c6d0048c9ed9f294631385

SHA1
69b9b2a6a26a83da74f677ada1b4ecc8eb557406

SHA256
9a608bc8f850289ff4a8d17e9b9aa965c967fda8402b8d7d2351625ac33115aa

SHA512
0c17112aa838bfa0db9d2c62150437ac62883f4e8434152615bdc6b3a8b34e18fa6f0a278f931956e1d60d5c5b3d60bb6c0c14d8991c2d3de14ee04bf31de407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79e2c2d723b5918d1f4e1ee33420a250

SHA1
32d96abfd57237d7bef0eafbc2c3ca354868cb4c

SHA256
cd578547a587999dfa6f7e6ab26b714dfae640a81f07b1a42ab7a6d1c56dc5fe

SHA512
9c0ff24eabc3a15ce9f0318525a72dfacdecbcf71af8900e066be4d3841405d1d81156fb96b44e5245bc1cbc6e0795286fdf2602640ce5fc8c1effe5c751a363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47487ac26fc4d90a2eca296948e54af5

SHA1
6d1042af17a53218fa484cd8ab1c87bac19dcfa2

SHA256
77754be3b2f3e4dd1421f604c990255985da10e4a75734bd9a235802583806c9

SHA512
774d52bcda0b3670ad31f191a557e4b4870866bbbb680f7df756c65494d6500afd99acab450ff09fa901dee6e5a33d88b4daca94d5f4eb45751d773da18b0c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19d9c3f9abd68ee6537c5b009b12ef12

SHA1
09a452fdc620c759f6201ef3ff7c367e7e58db49

SHA256
7c1f749976c1ea0388b2ce9f74c26e1846f3963547d4912dce82234b0f088c2e

SHA512
bc19971b3831c17fb24fafdb9e68baddc6887a2326cf4a74f5f24d9d9f58e9ac20c2d9ac70e700d5ae62924da10f8fcc646b891f63947ba386abf7affd23a90c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06d9faa01b41a9a76e389fe325f72313

SHA1
2622f34f3a236b277847057b0b25d92d320380c1

SHA256
03963021a7d3aa0f2f5dc8629cd6cd392691a911b70da73a11a7e9353888c598

SHA512
4be3a56ad14f0eee6e4b1f0e29c2f5126bec0f3d845a61f505f147326bc9605ec70c6366be60526b2d31e92c71b5b79f6da02a9cbcf47c0b2a5cf1c4ec307f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37caac6547bbfaec42761aa94a969f16

SHA1
a31b74c15fa7084b9af51323dcc8e778d7a06a9c

SHA256
9bb9477b84fb0aeab4c856180775ac08443eeb016c478055ee649d7fcd2daedc

SHA512
e3d545af2d3ef10405cb968a6710c49ed7a770cd17ba36e52b142b1512f907c591a94d369c6f11ebfa066771139b300f32606c599109b4f72f8c96f5b2f84d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2523742da047bd7d77d5f7c93777392

SHA1
6ddf56cbb35c56c0eced0ea54afb6b6935f04322

SHA256
d3bdaf4e8283297969dd888f13c4cb48011e6c0cdc2bfa44f8a6225d3dd6473c

SHA512
74ff5e129abc7c4f5abfa86a062cfeb04e1b04e0e24f75b4c1a52b568256fe2d863b7e8da8d3b82e100fef3db30e2d0b7556bbd81e388099645f54d95136ab44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3094.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3144.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit