c34c13220f0d04ae58e443d3eef4fb4ce51410e7f09a66fffc17a5d47ff93822

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a6748b52857426b346a2175162e769b_JaffaCakes118.html
Size

70KB
MD5

1a6748b52857426b346a2175162e769b
SHA1

e771d0f2b1cebb84f9a8989a36c749a77c5a8052
SHA256

c34c13220f0d04ae58e443d3eef4fb4ce51410e7f09a66fffc17a5d47ff93822
SHA512

3a79f98dff8eea70fe8dfe55d18dcc7c1e345a4943e04fc3b9f07ba1889e58e9240e28695448467a6f077ffa5f3d2570086df96a26b36c2e36290c384159197c
SSDEEP

1536:gQZBCCOdb0IxCqEDPXi+K4BbQN9uVQlcXPAsJkGaryb6+oHklESPIkKwI21sNTPt:gk2d0Ix2PXi+K4BbQN9uVQlcXPAsJkGu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f006d85364c9da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a63f07c20bd734cbbed517ffe3d13fd00000000020000000000106600000001000020000000285c922c2710f02f7f9c572b1047b3214a2a824a1a1af4ceaf74918814898f22000000000e80000000020000200000002dddf5e573bcc165a20a955af05ab42c10382dca1484c7ea21d07ab7f325145490000000b92924db29126f7d3045ed0a57c31f3347fff4afe62448ce5cbfd8b8194401c57a9c177f22beb7fbdcecbbc032d64da96ed5c62c5f3c566b4e82b83ea38cd2769ec49d36355b7436534874159cad1ce460e78bb2e05cad3a0dbb2ce8f282290071a2cd9dffd2c9dca918b04965c7572fdabaa8b981ff4009b4a2beae0198b78aafcfce5317cb1458f6cecdfae3b479e74000000076d9c562d71562d96c3845df39d684d3a3a9f4d7ddd0da91ca05be87fc268212183963c565996f15f6f55083ebf929492107abf2a2d4f770b41082294420b3a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a63f07c20bd734cbbed517ffe3d13fd000000000200000000001066000000010000200000007192011a1d9c03a2e4f979cddc710ef3317e2196331593ff3d47b121db85e619000000000e8000000002000020000000db56eecfe5f0b7ebb9c6975721d7075c6cc17dfcb9234e2025bb394935297546200000000cd1ce09d1b9aa5d5cb34517adf8330af970d761ccd24cca5b6a0b12f27e04ea40000000946acd998e6b0681c88313b97d18806f13bc4a24be208c42c360601061396d4d4130d69c0c2ccdf59b3d1d08f1c0189d26de0787fcb5639c4a813fde1faa0dcc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D97BCA1-3557-11EF-87C3-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425745333"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2736	iexplore.exe
2736	iexplore.exe
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1028	2736	iexplore.exe	28
PID 2736 wrote to memory of 1028	2736	iexplore.exe	28
PID 2736 wrote to memory of 1028	2736	iexplore.exe	28
PID 2736 wrote to memory of 1028	2736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a6748b52857426b346a2175162e769b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
874ac6c2f08bed07fd4ce702a3b271ab

SHA1
61d31d563b545d528f904e394227e63ba5cc4e53

SHA256
4b54f66537cbeb58db3151b77836916f6ca5555f730f76a5bebc6d1f79d18ee7

SHA512
9297c6dde753f6d19fc615bfe7ddd8d3bc99f59b2a997f7249a1476361ad5a98f5ba4f4ee3219f49ab553cf322228c3f928d47e0cde6960776c4d564cfb3ec6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c80c56be9958e68d53abf974234fdd8

SHA1
e0f10f5864ea28107686a940c472ebd26f52cea7

SHA256
e400ac97b627b32ed0d4b18370e2bc9981f30462b8f4d1660af0dd6a09f35044

SHA512
60da1564dd7cdd494cf434c13230bca67059705eb797a6b7356c8af9395688dd6684ebb7dff9ec9fda2bb8ea048e79bc7d668763139ccd650f8ed6093f605a98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5499f1309dd74634836539b606b14a7

SHA1
32b9985cfdb895ab8fad598519fc7a45343060b4

SHA256
cb6e113aaedd289aac1d436abd5e76e3240a008a6a3e066f77a79ef4270d1caf

SHA512
7960a7759f7ee099c8450e097a870c0c26c24a181757f22f0684cbab65e0892986fc61a62274a8212f959a687ef7e3415c05f27f052b53de43045fae0c7f9a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60d13ae275b960cc4fb8d223242a07d4

SHA1
5d06992114bf9c45578816ff7cd1165155456ad5

SHA256
7a5d88c8c56d80aca410f19757d7525a3a2f7714c6cb463ec942788434002bb1

SHA512
1a9d9dc507286def53d4517d0257d5fa6e86154cc5144ffcb552ffcc5ab11a6fc943cb749c3564e06376e1b490825ea0a721e304af4082e3fa1cc31e87b3c999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee0cdc41228b78824d1f225256eae640

SHA1
c3301576e20ab03cad37e469a702e4d7898021b0

SHA256
e07a95d977308a723a39def86c6f56ff02fabfff3a6d5065274505d2414afaf5

SHA512
015e162c77f058da842b2285875d1baf64c9016b6999a43949bafc6a13a9787f6dc6e6c23ac3216a1419cf62dbd9c4f86ba38598cf9bc43cf8249e2e7cb37001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bfede7ba75828d83190f99b57795d80

SHA1
bfadf3ed71015b683d9eb93631d1d90f024c3745

SHA256
4842f13cd95a7ad7c142f67340678d515c29f54b99cd20e3279a02c3a05cc529

SHA512
2a98f2df8bf7f730c846b9016e2786d291cc42bc994a307add80efdcc69659c1a2002679d9706dac2f65440ddb925661892671b36045cb4f17e2a8ab1bd61c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b02ae7bd7731fa553739dcd095b72eac

SHA1
8b66fe88c572014b67351e40976ebdb78f18736c

SHA256
d055c02b5b15ae8e9fee885816561ae415dc8243c649d3932448150e8be3ffad

SHA512
30a68dcba0f2afc7a021005701a4506d5bd56ebc3ffdefbbcc30d7eb79bfd3083e733dc3dd375c246ce7a5ca095baad93c217716d6ced7d7c0a9429c418776ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
392f9b593589fe93a8d54d3040ad5e17

SHA1
5d0e56333cfea72e177f3eccef59ece42c06ea09

SHA256
b789a1d25475109f63b90baf85cad74d021d3670e8ff156b2e26dfd018e5a33e

SHA512
2f149919346dd9389159b5a61492b1bea34f3abfebcb5d7efb99906ecc820b648cd28e2ec88b4bf76973a09a1a1ff88b252ac2de60152fab973d22de33c89454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba60d4b4fc6b134b0022c600b25a071a

SHA1
9afa7207968a90365231e9ee226b07ecf1c452c9

SHA256
91ca50e77e306add6f95192edea879a677e9d347c46a67b8b9e9893acf379c61

SHA512
1a03a78c0fbc4dd0fbfea727692d2b30a53a9e0ee7a43d210a03e56a5f34317bb0ec354082bde44a5109063c701a4b2abddd47815a8ada6bb4097e7e5cd00a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dab34e72fe10da9a8ac10af78c1c8c61

SHA1
2480e91ea1d56d6be9e9d1fe5ac6d211f11de145

SHA256
3affe599f927e01f5966f9f858bbc373e7d1c5a5375cdef41af16d987e9635d9

SHA512
055e66db5c234f8988cc5e611284a9f19b12976975f35d0347fc16aefad230a292788c2557003645acc94ca9d4a06f3ebda81d847a8cb3b235430f0958bb35eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d549f13336ede43e5d2101284e785b51

SHA1
c954e1eb6f5522274da82809c931a77fa6882d60

SHA256
379b517876c5a99e1c6020fd616280eed05f74b60eea0450d5d70669fa27f637

SHA512
92c13741712b88c00d65fd5ee9d366b22fa647cd4429bafdd6e59a02d0570537fe7fdc1d7293f9e73e39ab29e8a11fa2810bf0c0096200a6624d87395005f127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb616e540c293b2c48930156153a1df2

SHA1
c61f147fd1e48bbd1f047bdfc68f3ab8522a195a

SHA256
124ecf73d9dcada4e121b45b75dd6ac08e46861d2427f9ff6c7d4b99327ab4bc

SHA512
2488ed36d6ffc00c1f69c0dba41532f7aef04f4663b892ed6a67bff9ad2fa6b9c5d41928a36c121a262d67cc7cb078eb2aeefcdaf075a09bd48049078805cb46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fb20c7445db239d982caaacac5a4aede

SHA1
376bfadf9e2c0c2608771d779986ef9f36c28944

SHA256
0481b67e55bdd3a8ba791b8edc886f03851ebb5a66fca5635196a7932929f99c

SHA512
c65c019d9407ea7a8c7363161d3b2b82c38e03ef27a3a838692949c6848c1cd21bc486b56903df59f2486938b7246d35727b63357ea543b4a2c6907d08849bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D5C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE18C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7ACE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE29A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit