61d19583cd3fe5af62ca82edf2b6604b4cc7d0a508b88ba166c432b248a5a697

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

261b08b52b08bbe597513b119273f2c3_JaffaCakes118.html
Size

6KB
MD5

261b08b52b08bbe597513b119273f2c3
SHA1

858769029e4662b97894c71a5eb89a9395eedfb3
SHA256

61d19583cd3fe5af62ca82edf2b6604b4cc7d0a508b88ba166c432b248a5a697
SHA512

09d7f1923dba5c05870a65ab8e1029f5a2203332cb18f61fcb6804792dd028af7739b933255a67d727fee7da9b50cd72c46c1e83794027d1a4bf3f7af5463cfd
SSDEEP

96:uzVs+ux7OmLLY1k9o84d12ef7CSTUz3cEZ7ru7f:csz7OmAYS/6b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000732b6c4169d31842bfc3bdfb7044ede700000000020000000000106600000001000020000000386961694a3c06a1d399d6e5aa267bf134656ecb655db4aeea858b2f605ba723000000000e80000000020000200000001cb580a7659df26faa63bcb8e228b8bb6e34a9f98528e75a124bb27f4df3286e20000000785fb8beff6aaed9d583c7ea0783f813bb97fb3ca5054ad6a6b5f8d6b36dfc4840000000353e10279a68bf2cf6156f924653e9630cb034b6dba516bba4fd3b7065152848ec2df7fbe02a9cbbee9d90798d8a91574cc784f89310193c9683e47d921f4ab0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90fca5b04eceda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426285865"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9D4BD91-3A41-11EF-B012-52ADCDCA366E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000732b6c4169d31842bfc3bdfb7044ede7000000000200000000001066000000010000200000000fe228da36cdda51c10db4a3107ad87acc8bce62abbce2f8dcc4df31e9382b1e000000000e80000000020000200000009b8d5db2e3f04c7c2e3a8151c8945b1cc323582381595ec01729f6dbf451d021900000000fb6df81446dabc23a61994ad4534e02d837a254f10149bcc30c0bd544d5fead61f9215b63b5b9b85085ed67a1e409e5dfab44aa0a2118de8cdfc7db34fd2e2954c4986ed33ef1c3732c2678f8e6dbb3a052803c73395e72c22556c3470c98a745068220f0a498323bb6d58763765178c11ac043b3b99abbc220a15dd6f05d8684386295ef4f83bc03d4db9a61f315f94000000049e0cdf0f3df639974e4a0db59d0bef837085fd0313fab4134aaed08f10388f449f194e9d456c7252d86cd136faa2414cd1f8bd974b6383424b333147bff39ef	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1688	1288	iexplore.exe	28
PID 1288 wrote to memory of 1688	1288	iexplore.exe	28
PID 1288 wrote to memory of 1688	1288	iexplore.exe	28
PID 1288 wrote to memory of 1688	1288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\261b08b52b08bbe597513b119273f2c3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba81f21bda2e62c05bdfaf855bc9f874

SHA1
fcf5290b43d7f4ac0845f8917050fa0d156b4911

SHA256
516740a7567c1205c8f2a66b0092ef03eeb16a607bac993743fedc297c23fda0

SHA512
0508a5f707f829d2859fdb55001144a971b11c967742d118ec669c9099ae3b7a1e62c7c2eb0e0728d5cb849bf9c5bd5d9b496a8430a363050ae71819db4b2ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
032a514865205fc9f58e38d547c59e87

SHA1
f8960c863e0a516cb6056e8803dce5d47e5f86e8

SHA256
cdae7113ef0f024eb5dc6f0c119ac8f5ceea4953e7ceefe82e92e363514b8527

SHA512
55a5ba1cd75eb0d32a52aa93629240ac62493116a6f29271dd8b89a0d5447ca3957553bccd6c6536f96a0dbad6042be0e4eb0ce0b182e49dab27705fb8a2f60e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4be69bcef225ec3f14ee02fcd068f847

SHA1
e22e7196afdab51b6ed9efaba0cbcfa9296d37b4

SHA256
550491263a61735a04904c4836e6e2682b17fcddb30380ebd289d0a166d2c23d

SHA512
0ab10ed9fd219c7d62d2ec8adc6173f992f87bf80b2cfa8b005560b70de007134f3edb42f139eac1dd0d86eed325b75e4e4e7cd241f8c57e2ca4bc94c6591c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
971991be956332377129a8c598e61c28

SHA1
eda676e71cf359c87e9dc6aefac5236ab1503e89

SHA256
cc017c4471e545f2f31e108f1c46ab2573acea864c2992e55db22efe30c0f9ec

SHA512
24daa5664d9a3ce15dd6449d9142113a48a7194b1e98c153aacacbb49990e1d0cde365ceed1f0c6d7a42e892c4df68c8e022041d19f964e6c33bd5edb31ec5b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5e9935a386c36eeb78302a6ca743bff

SHA1
ec03354b58928519ba906ecfc6e96968b6a7f996

SHA256
e6e7d026230aceb6dc2c4003d3e5d30bca2e00c149d9d29f692dcb5dbeaf2ba3

SHA512
4f599cd95c39cc83f4ab8ff953af65355a6318de57fc35c45bab65c41e40331d7f417163558a2043096ce73e51500fe36368e2df9c24f5802a91ff88f06386a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f3db2fd3e773732be5071af7856ec1b

SHA1
8025a2b7fe0faa40131e85bca43c401cbad0fe69

SHA256
2aeed5520f554ac7c4a1e1f0d194efc3335fe59237375db506547b02abfe32c2

SHA512
26f32c70b8d96e86f4cc6e058c612df74eee753ab1ccb52a841acab8cbe46745bfc455a87836638236344bc6473213b6061718b1b0b63d3c561355ad4652a9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53ca5833556589d0880b8e9d12a90011

SHA1
da008867f665653840498254aa992985af2c9ae8

SHA256
dec1682d1b7ff0bd95afe669955a92a9e6c4899cba7c44ffd236f0f5c1975305

SHA512
bcd9762c92d69c51cc38ad14376c4a65f6049e173d208811cc543ba77c0ded8483679d47b33fbb5c82044d749bed3e63ba985bd594bbf08d7adf0360eb464eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68e0cf4a42c2aff7023ea40fc3ee6d50

SHA1
7263aaf4428e464ec711f54579be8e3eb26b65c7

SHA256
09b85108ec88a824d944f360bcafd1d5cfce2489f484e2e0f1c5dad920500c4a

SHA512
ccb9b818ef455c80c9d363410ea5779703ce21a2866d600b6f3ec120b27cee5f7e3e7a6aed2f234b93e4c56fe09fe27775f7d16ad1f913f262923a8c57011fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4319a23bd8e17b7e22a6cd0f9b5dfed

SHA1
42e1393db8ddb45ec3fcae70ed491ae9458f16f0

SHA256
eb79c4740a1067f42cdecbbfa2b808d8b267b45a90df33f78ea976ae686ed60d

SHA512
e385e30b413b6eaf5b38db1b1dc244f024fb61f2f90b88e1fa2d4ffe8a754cae1b077897ddff36f14e18e942d61b5b6f176f2dfe403d23c0d827230a9857d4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b38a7688ebd696361e4bb8d41acc261a

SHA1
78f8f6b47987cac9b0946531e80169a4794b94f1

SHA256
23451ea48e8c0e56f58051580fe8aa5781e7afd50cc553954da143064fcb2923

SHA512
0250fefb7d056d0ce88e08133466d0da9316300dbb57b6ee96eb781c96c9015bbc77a5f043904c38601d6fa70eb39a2e0d637186716bd6b6f5c19eecee431f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
def9982390b08bdd227db02a699f3637

SHA1
9f33561656dde61181dafbb4cbc1a0b856de786a

SHA256
90c6983830b16ab7989fa8909b5e0bd1892c31a8301341fbf6966e65ec7fdc21

SHA512
5f03089fa522eb2207cf698e6aff0edf2649628c213524ec9de25144857c85835e47959b62c44d9392996ec5d8b3cd05c28b604a63dfc88dc5d7c33cef16edc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d971cea9315bf262af0ae0e1a6901a9

SHA1
84aecaa9639f817966a7c061033f0f6ce4664904

SHA256
97dd967a673f5c4a38a11747bf86cc711ba1bcc3ef3d2d80454cc58a1540ef0d

SHA512
60926c65dce4f71ca5b8636b09aa846f018a8394b1fd867a816d6731cf25aba0e0166d23c5eff6548f5fe9669ba30ae301cbb033b9722cbe0b23e8e7d2890f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a77e11e4e5174cc6ca32b7d7347ffa5d

SHA1
793de7a93a2f837bab803691a36126ccb878d5f1

SHA256
53202fe1f7cf379589f1f0fa2ae28c53d08a0fe99848735a637daa8b7172681a

SHA512
a418c0f6ab5037a4bc073665eb23b182dc71a57709123176f6ac978f63b4b30b83626bfd1a40db83fd96a6ceb268d52ed4df6a6f26b6b5b85460987519f9ec10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
534fd20cdf8d177a1e44000a1ce81d22

SHA1
fb2256d967a8c397656750d98786091bdc469d63

SHA256
b2f5faa2c0491b625b9be3603123909c71a3e30fe9e9186c208f68193555455d

SHA512
f1184fcc9e6be1592904df75a582decbd0a4176378975b49ab8bdfadd5132c0f3972727474351c328f482241b4cdfe27e92bfb78ed7d3f20fd437490f5773b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
beb8380a2d3c89f973f6d00b5ce29550

SHA1
8141a25e9e8b1b757fd14d24e44d155fddd0a6f3

SHA256
859483c3a08ab8725d0a7be7c2d97bf94fc2c190a450f1252bb170bc9c2da1d1

SHA512
0a5aa6164d5fa918f0521179cef9cc0efa2f882deaecb40ccfdc9a400952ba63a83172a17154e089eff0ff198301a1b5a0db9a6cb88da2297f34ad3f99ce07ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ff2f47ef8a2d17383fd98efbdeb125b

SHA1
ee3e07d213ece23a765c7f194c151ac98ce4f8d4

SHA256
4994af418b28996424fde30f3846e7b7019b3baad3e30f11aaab8f489ebf4320

SHA512
e23deeb348b09dd63df3cbac4c08d36659c0338ec8dac1316afbcae45d03aaf09aba5e8a91680025919e81ea2166c275a2e763c5dae7e4e60189aa6c03673bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab319C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab328A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar329F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit