1bad5f4aa843edbf6ef4c87f2856042af373e2144343479ddccf7598f9a586cb

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b353310664458b8e04939f3811031b2_JaffaCakes118.html
Size

53KB
MD5

1b353310664458b8e04939f3811031b2
SHA1

5beeaa9838ef4b31c70c7707d65c47229461b842
SHA256

1bad5f4aa843edbf6ef4c87f2856042af373e2144343479ddccf7598f9a586cb
SHA512

6f941be9e65dd86a8a4136b3a927dd9ab12de7d9ba26074979280765da6e3cbf80f18d7e825d307f0221c28ddb197292b51e56b172558367b50366883d9ab476
SSDEEP

1536:CkgUiIakTqGivi+PyUprunlYG63Nj+q5Vy0R0w2AzTICbbMon/t9M/dNwIUTDmD5:CkgUiIakTqGivi+PyUprunlYG63Nj+q2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80E81B21-37A1-11EF-9BF3-52E878ACFAD8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425997097"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004076526a0f6a9f37f67dd72c2f85695c4d4ba822ee1bbfe24d8f3661ed545541000000000e8000000002000020000000ea697c920abbeb67fa872d30a85f41061c6ee70e9d457709bc7defd8647a5e9e90000000fba149a92c6134a250353e2d921b5761b1a5931087e8c387f0be21acdb98f595d93c9f40ee13ed112e2cae76cbde65597a9f03ad35ee28b2379a7c8ec8bcb069bd06f7a1e0d241a8ad2dc43eabee968c5dba62753beb3681df7e701540851b4c87771bc57de9cd816f2ba8c449d9cacffef1bf4e470015a20878da549f2ce4ed37e2968ea34b0c52885942a17bfb7236400000002319017837906c0a56b0afdd4857d5ad97e6cffba6f51664aa1b361e9b1aa1f44ec330ea06eeaafc8b7b4fa64436500bfa237fe6e2d5864b65f1ec36a5fca199	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60631c56aecbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000079d8038a4474be85975892e38c3085842eb2af61c01182118c24f37b3c758f73000000000e80000000020000200000008bf9752d98fff3971fccae4c6868a467ffe798f142d831a011afcc0fa9114d06200000007cbf3608f534a2e7a2fd7243c631395cbafeddb934fc5c529a6fa003a3409aa640000000816da75e4b3e79cae165568de43387be6e1f58083064dbd0afa7a25b8cada0cd113365ca3fd2cc58b0c742f5f1b9591cc8d31fa004bb9e14380da331e49973e6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
1812	IEXPLORE.EXE
1812	IEXPLORE.EXE
1812	IEXPLORE.EXE
1812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1812	1700	iexplore.exe	28
PID 1700 wrote to memory of 1812	1700	iexplore.exe	28
PID 1700 wrote to memory of 1812	1700	iexplore.exe	28
PID 1700 wrote to memory of 1812	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b353310664458b8e04939f3811031b2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61ad8fabbdb7b800f0758dedb5712616

SHA1
1467ab7985408ec27fbb832150d65374ae96ec82

SHA256
5f5bf34c96de32bd4a361970991e0cf9541a5e204be0e8840c31e93d4bd6b68e

SHA512
d7f340691105d6d0ab7088998e892aab2b44c34dad3dcc0261063cd1c58f4ab5c4bfed36e6dd469014fd94bb6947a8d69c5e108b21451835f34398c5dc0da3ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3aa1665d6dfc7dc89a9b1d4ef3d2703

SHA1
9257c0759053eddad6a67945b26f5d9f3237bd02

SHA256
18227197a0bbe0bfdde5b753c9bc86b06de45b5b4d23ef6f7a6a913aac5a414d

SHA512
de6b7ae0146f3fdfc52b144c30fb854d3265537b20899eed668539fa0b1d95f83548d218a04abbaa3ca3c950a70651de0711b22939f0a9381fcd3c49ef5b1a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
112df0497a1d1ebeaa5a6bd24c923528

SHA1
ab87c7941aff3c1f75d058300a7a875a6237a078

SHA256
0d7948b3bf20ad9df9244f579a067af9706db4654cb57208d17596c579f9234b

SHA512
25da88e0874745daefa31c152d995923f6992dc81a08aaf1397807cb4707a31598348da4971fb2b3b44b603f20ba388c82eb1a55e88f176fb447c652fe79e412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a81c13ca38062aba5bf1d0d4c588d6f4

SHA1
99808ee2179471a6e29bd3da19494a14c5ad729d

SHA256
410b794f7dcc03a293e435b666390cd9a500afb573a28c2a29c74f6c3e20144a

SHA512
e531153f4a87deef39267d7e40a8b560e82f6eaf0f7563bb685ba8c8a3d76119c268576680b7c36f384209b6e7d3cebdef427f1fb7801a2e82ba6538f9df3072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
140000775d5b34b67fbd0abc9639894e

SHA1
146d9443c122be2244098afed26f680acd203f2f

SHA256
da20e0bbacdb6e71363ace853a524e4492bfa77608b2e69b3847043196adf2ec

SHA512
c28ac683015533ddbbb31114562958db15f58a560fcc1e54361a157e17ee1d33da7e42f4fdc547ab7994dc4a89e683da4d3849e7cb9b610aa3256c1a8d861f1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2443f3f60099a6f05dabf30c909a9d40

SHA1
e0e5579607dd1a3738bccdbcca6a363462db0b32

SHA256
76224ccc9fb00bf934c99f6e48895c059a09dc651bc924f2cd11db77a872c870

SHA512
bb79fe23f44982d2a41e74d7233e83b27fe2c0da2633e3108c2fdec32f2982cf4a0f75dc35417b9974d8ac22c5297a4d9a9ef05ffeb7e9e601622b64cff3ff74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
526ad4b287fad92d4b9ff0125dceb8de

SHA1
4af6ae3f27c701bfb03a30e3309577c2203866a8

SHA256
63186c638f19fcfd9589b650fae5cf4eb3814b83b99a89b68356513167bc56b5

SHA512
d1cef3ea099f67796c6fdbe60d67f3082c0bccf57961a5a42ce80c7a51c435d088529dd3a156953cd525bb6d357e2c3fa391ed982d63e92950e380a29758aece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14c3b2b8b6407b1f4992d608eb340b61

SHA1
95e750d01434b979acf92a21dd27fe1a88c6d6ab

SHA256
5f865191f68eab13261c9a7bb05f8c187544cdc29c1fa7c3f9677e1771b11eb5

SHA512
e4993c3ca3e6d5034e6741aaa352c54e1113f61ebe3d903c84913aff2447ca31f7c758cf34804c9715f665e7fe5bcd2d4f8670b575083b4639ea3d6038703b37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22b1b55709787335b65e3ee5802de172

SHA1
48a81654b5997792e0e5311ad591a0aa5cd384a4

SHA256
cf447fe8de432a65dc7f401d66278009b3b07afc75f484ff0906a5c25d505df4

SHA512
f7dc84a25386df059f0a465a8290def87245f9543d86363e3d016b9c5a2237a8cbe28e192b45f58878b25fecbe0131786517a16e85c22bfbab11f53f270fcf7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5417fc1bb0eae89f71535ed1df21057

SHA1
e67bdfe9ca84af9a3a241911c5c14f004bd6bb80

SHA256
021559100f4c967a1d54ded7b6c8c8b18ed3dfdfc9517818de71bdd1d3000831

SHA512
e859c76e05146b71f29feb6c891ac66a8657fb6aba9f95b7f6fd95c7ad934ab75091984b4449601887e17831da38804d63474b5242c09dd7c8f79e2fd2d9760e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0440a5a73309bfd65c825065fa0032dd

SHA1
b8920eea004872fa48801d8bc3b97e8fc0cc552b

SHA256
883c0d0183c6a276cd9dfe08d52db9fbbe17f193f5d4bfce141343c90fd589f0

SHA512
ecf9cc62e5ddcdffd3bf48faaf458d3e36b506345c9b106f6b166d70502132952f41cc529adfdecdf19f034cbe8a6fc041341f348fa073a4b98610cc543a7cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a80b6ca48f8f93d09d92fb0f9d9cd9c4

SHA1
e8c81434d20309022184750d2566e179f552d1a8

SHA256
8b8fe3d5f38919be63908f8693c9679fb7b49a7d917e1b5f928d721261441144

SHA512
9d165a249457fb9d3c9d25b21c1bcfc1fbf959c83764e8ed5513777c726032155f7c835dcee6aedba7c57162759770a102689320651899972993122123e53a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2d3c6181a1eb667721c8641c39662cf

SHA1
e601d61d2e3e320af892d014df38d24af945b594

SHA256
80b96cbfae277270f754545e0ff3b8d76b55f1625770e4872f7eb06b3f6d9868

SHA512
c5f28253541ae3aab1ce4230a33142171f3bf71382059845ba3dee4fe75ce9ac982d2f60c8fa2d38f6e2cefa1f33526388bc3def7c743efa244375b2c7377543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5cb58a08ae8494ea78bcb2775c1ef42

SHA1
223770e492c8fb949a308f9b5317268135bf9dbd

SHA256
a811405d6153c863944329bf10710117aec26602a78df574744053a3ba53e4c5

SHA512
a53382583db3316ad228f7f3a7e583dbc41f5ff635b780208235a33d28727336d9b5f8036d4b58b6f2daa3cc4999a5574ff52a1d2c5dc6802eda5639439d317d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d874a8ca195b2413872e54b476a72c5

SHA1
800d2a05dbc6e1b02fd16b2a021ab07430167d49

SHA256
0fb3f15b579b84fe62befb2a79a587465c795d804faac2dcb07bc3e11b2baa02

SHA512
038326d1ad96ee59d08842255e7b6167be1e849b6ded2c59ef2d1e9b04b2699e4c01bb73586725c1232e8558ac5707022595038a2c8ebb5843c7358396c473c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2178.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar222B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit