6114fc76cb70467a013a71fe7465cc2421f8b42260e96183b5556a070ac09773

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1be2077d927a4ff916713dca7cdb274e_JaffaCakes118.html
Size

45KB
MD5

1be2077d927a4ff916713dca7cdb274e
SHA1

8ac2229e2408ae23359cd4c9d6cb0301ec1d1e71
SHA256

6114fc76cb70467a013a71fe7465cc2421f8b42260e96183b5556a070ac09773
SHA512

89b50b483148b36d88692d663c40a053cee02e99639c78fca6c84d72896f969f2e660f60b70207b275c82c1684b59eda60625377857c93d494a1903aecb93e86
SSDEEP

768:LtIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZ4O:5IRIOITIwIgIiKZgNDfIwIGI5IVJ7Sq8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426016928"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d4c4c59ac34ff460f39b953f8ed99337b0a42801200b3c53a4f69a5fda52a694000000000e80000000020000200000006576e78c3a8419c9307c5c33aa1fb60bdf1e145a636530fc55f7f9bdb5e60d3190000000da4dd89078be36820dc4793304c5e7240ef9b8a4002ce5140d042eea74213b2244120177fb6282ee8ddab194bdf9373c94efb125ac796ec2cf28298b1ae034acaf059abf2df1e14fd6eb15fdb74a0fb06309ab38c2959fe9be78dc8e0d3479e5a0baa6476ceb845a5da5671e400434b28d4180f1232975bee3aabacc02235a06f8c067ca236c38785f8fbeed7aa7b33a40000000953fe5ebd112fe685ddf57c4b01ec1c89e499bd9325db04affee76da84c26c403e96c8ecb489f74abb421de5bec461a80b07e375b021b4ddd787a3cd0aa12f60	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADAC2A11-37CF-11EF-B848-DEDD52EED8E0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f7ab83dccbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000635b9ac2145747b18dff255a43b3db19e6574bab7ec85d7b51e37355616e0188000000000e8000000002000020000000ac66b5133e3b2714785a0288cce6cc08b2c107956074c1455bb91b570eec69a520000000e508f9badc644b1629d5ad934f15bc103352bb3fbc885a57050e87afdf8a1f4940000000137629143fd8169c506760f8707ba97f0c61e93711111affe5374367a5412e9c0e4e4d8278b893b8626674d68b6ea2e33f21d089ea7dc2c6f8bdab8fbee23a1f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1936	2072	iexplore.exe	28
PID 2072 wrote to memory of 1936	2072	iexplore.exe	28
PID 2072 wrote to memory of 1936	2072	iexplore.exe	28
PID 2072 wrote to memory of 1936	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1be2077d927a4ff916713dca7cdb274e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cfbbc2e0098a9cf9d1fbb617f0b9182

SHA1
2edebfa9d7fe9a81906b342a15a882ce87aa084c

SHA256
e64a8383ab0a0a855d5b9248e05e998196337f4ac6ca816c0c13f44342048c80

SHA512
76bfe0a973a0c8c20bd02c0f611c7367e16cb65b4ef36be908d7b8f0c67102980e8d6061a7e8e9426fec145e1fcaefd1dc6897b147774561bf8746b6d3049e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb8c3f8d8a3b2595cfe8693ab48d474c

SHA1
3f054e11c0ca137dbcb742db4e161ccfdda84dda

SHA256
422f76b7b9786dfce881ae3dbd8f1d378f4b9ba8a5b34162fec58f0957edd404

SHA512
e81632dedd90c115b3f9c37f04ef1f6461229429fa4a81a14a6e78f536096fc98a28d77450896dba526f07676f8400db2748cf95b511b244165ea778c42736bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc9090ca51eb4a19a17499addad7d4d8

SHA1
d7c6cba7a5635ab438d0f34295c121a5f4352526

SHA256
af521725ae78572c881673cb858fdedc82ce759b08507d864b247e6ccd33486f

SHA512
a2b9185d1f29951b2531f63a9d39e287119127cd0e6f932bff0787fe625f1084b4479a562d0f6f9ca61178956d619585cfb4cd21681fe60b271f364ce7b7d007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb71a67b98fad28be365a81c479c6fe2

SHA1
1b68b6e1d069646afef5def758cd88203d1aa688

SHA256
fc625ab7e5b594855745960d5896683e7f7e852b6ecae6e76c21acbfc405b42f

SHA512
87b81df5636b2c9b6c1b2b74c572f16ed35199de208cfa55ec6ccfc199e223b91094f270ba9499695965fa156ae6b461aa6949ae8fdd5529e2ce505aa6606268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d81850a0d2a687122a8cfd2a3d16ac02

SHA1
85fdfb5c95a3d7a367b591e06b744bb28a406c75

SHA256
00031b2fdde7f5c6328c51277cb692fe1bbb10490efd89b486117d6fd9a8ac34

SHA512
c362556c22db6dc84d46fb8e056ce716eafb156154997fe814d79d2e8aef1662bd500bea7627656a743f4cded3260ea724c52bfb03074464f8a4c827fa7d6307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2699c25e28e2da885561ef68710b43c7

SHA1
5f1467c0ce8cb42ee4384b125dc0de14fb07fa32

SHA256
03b04aaed38685691a925d5fd7cd67d4cbf43880612d77dd5e8e6eb19576e78a

SHA512
87fd5de75b35ac7c040c88ccc6ccc6c048eef0d522ef9bf3b5d78340026773c516ca33a663763af0af088db97733f187818c0786fb18b00d462a08c50bf0f9e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09ab72844173674596a5111008de8854

SHA1
1f4d6b16fd49681dca37a956ca48b975d9f65e96

SHA256
cf86e95d4bbdbbb07fa7b0e8efbb878ebbd3ea5a86dea96774b872b8b499f625

SHA512
7ce6f261995989e23a2884ba3ef9b68e6f6b9eff49aa11a0413dcf5e188168034982518825dc2f4d48f94007d8ba7526d5e68e11411f982e5881e410fd2913f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3811bc2fe2d264a54390449b63f9398a

SHA1
e82a64bbfcd6ec61f85b511e4ba727ac4257f1ae

SHA256
fb8775aad4b3220e53187ab7a6ee4ce388569e8650e35791c11a7ff6a59d601d

SHA512
5c358e87f8141ad69e45a4a0fde95ecf89c83e709d6343f14bb4c77fa90dfafddaf3463a448751c59d2062c75d9598c300b6bdf964a3c826e9e37f60bf1c000a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c27b67621c76f009532632c90b6b79d

SHA1
d3e800fdaf85285c119c29c355f7c3fc9c085e6b

SHA256
5ad14e588cf13cb407dec3397bd67145d4571d3f854e85cc145bdbeaf33b8976

SHA512
0c2b3f23c16fc905696802f3953e1a96b81d07a5ee8c3880474c7422f91a8f7aeea1e991a53aab932bb9eb687e231c3417e5d803617d0700b18ce4053d7ca7d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80cbf5917ae5d24cf9ddfb837dc2cd8e

SHA1
77c15cf1952559ce9081c5fd2b606ee6ec7d9bb1

SHA256
01912a48dc9b437ba34070af06041d5759b37e27fbf9a210cce945442b8c31f9

SHA512
ddbb83f4352dfca6d6caff21e70ddc74e30e8493a98fba8706bcb3c222b6963f199a8f0a9438af8783ab6bb3fdd93bb52200b4c15dbe831fab1ba0aba56aa816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d99a70d5b43f09f87fd0d1e2f706252

SHA1
abd32618a803422cff0c9e053456df765b86fb58

SHA256
6a1607f2926cebea19f395a8b29f2a99340eeaaa11855c60a4391b7cba6efddb

SHA512
cd8fd3a33dd034bb3ec75184f11ffef31961e796f93db285652ba89b92918e622164ff4b7ec119223b59154f440ff05ac741d0da2085ff9cb53799580d961234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2048b8f9271f6920c90dab285995f91

SHA1
c7751101ef2b5f4cd919c4cec7f49dbff1f50abe

SHA256
7bd66bdae5126b492ee70954c3df9d8f85265956027a14b6c8a5743c912e6a07

SHA512
82d9c75fafbd76c2ad3e470b4e9e0600d6017b193c95146d93381d8fd5e1f67556ea738955691b7e27b5134948ac4ab08bdcea5fda079a2a478daa0578a66501

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e00fe3a15f71dbafd6c96ce600e1cfdb

SHA1
aebabf28ab339a5fbb9624370a3b47e7bc1be227

SHA256
f38de0831a77d9deb375343bd403ab6d31ec144037268313df8b4579fa512121

SHA512
29c5de009032d8d361133cc2350f65cc22b34aaf2920016105e7aec048072133d30f5e45906e43834e831ba46258de9bc661ffc38423465c01ecb04b78b95f1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ce3a6e47a4ec14c451ac3b07e447af0

SHA1
fad20dd3cd1aa43e0f786c559feb7f0f09d016a0

SHA256
ecbdacc2d16fc928aad9867c92d197e0906882fcf11fa2dc58ea6c0d0569b4ce

SHA512
d4bd8d60ba4dce072aed55e322f45d77b6eb82c581d3624238639288c547ae04afa7d851052770f182d35502c31e2fb1de65fa9a71b1d9d7819c88387c7ccd5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55cf8bbb004a83068cd2f340bf8fa1b7

SHA1
9a4b682400087b37d7e28f3b7261642ad7c44ed6

SHA256
3bd0b415742d161f77b7753ef0143970fb1145caf0c590630229339026a37260

SHA512
5f98d4eae3be7ff9b0cf1e8bb441f81084d1a7f0620f624e33ecb92de3c26049b8f139f02c8185071db3e8c25b3366c4eb59969bf9b271ed0023afda17063c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3195359951084230c5745e4d358c6681

SHA1
25709416e3f4d6956229816ba6d1bda212f691aa

SHA256
57b46383c67a4840df42cbfa69c3f58989f1f3fa8efae31d8c967158bebc5566

SHA512
9bc7fbbcb6d852f2bd8da81c0d146a3e536af6cc3c371cd88f26661e79d6e2f21e3c00a8fee564c2fefb03931692d4fad360d7cb726cadf2f1fe03a15c3295e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F01.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7F13.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit