9103cb51e3a8299041b4a637e3773ee00367b6e687b23bf76636c3fa76d23d16

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27422bd9536cca28f63ef2a28d0310d6_JaffaCakes118.html
Size

11KB
MD5

27422bd9536cca28f63ef2a28d0310d6
SHA1

0d6d9cbd072e8c792dc76ee322a1aa4f55c207e8
SHA256

9103cb51e3a8299041b4a637e3773ee00367b6e687b23bf76636c3fa76d23d16
SHA512

661340229d7916fd2c2ad0e44de1dedded25a30f276c23f7dfab48c168603c9ee610d9ccc266fc5ffc44c7dcd9e1206919cb7a01d76e93ff644d3c36ec4bc07f
SSDEEP

96:uzVs+ux7KELLY1k9o84d12ef7CSTUHGT/ku3pYepFfrUMzqzFliFHlVHcEZ7ru7f:csz7KEAYS/iSYCfU0HPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07f6d0243cfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CF2EF71-3B36-11EF-82B5-E297BF49BD91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000a89ac025cd274daa0112f1f91f53c06b8890d0c1aa0238669c840848e64e9baa000000000e8000000002000020000000928a139b158134f096880654cd48123273552751da4ff51c9423da13727242ae2000000010ac172bb4444db979440f27d947dbc9be590a66664e36b98eff2596edf7d7c840000000dd35c91f000e16d1ba462477996dda609993bea0c30ed47eae08594c37dbad01f2e7bf93cb17d6c757eabfa658d6239472f14dcfb07a4040e06953ee0b845ad9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000add3ff2a1b3e14e74e73f06b8daaeac1bd73d386fcbb70e08a002165ea796b40000000000e800000000200002000000052cd261a29b1d42daab2a8f8107d180a1549c57108b3442aa868ef32222e4b4290000000df93094b36a4c555fba11a671f27d94b24b97005841da7b1d4253b6a0c21efdec01d8c0df2063bebc99e7cc339f8ebcd09355ee04c21e2129d0844acf99732cba198a5ea3203eb455d760e6dae564d481bdedac81af7b7aaddf1c4f415dd831c2211e318bd95500d1ddd9517306aeb75fe5b0df03907d04257a46aa805d90eeb3b32f5e9f6718621e0fa9bb81e938efa400000002f238f39b3af07939a36c7a0918a150dc9f19f84e371379221d9d64734b9f8ffa63d02c7838934ceb1fb79e168e044a524db3a3fac1d7bdc612e9010ea820b9e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426390802"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1544	iexplore.exe
1544	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2984	1544	iexplore.exe	31
PID 1544 wrote to memory of 2984	1544	iexplore.exe	31
PID 1544 wrote to memory of 2984	1544	iexplore.exe	31
PID 1544 wrote to memory of 2984	1544	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27422bd9536cca28f63ef2a28d0310d6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1544 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a54ecd9893c422567d4e76ffda63146c

SHA1
96721744759c00eeb25d4a0eaac23a23272f89bb

SHA256
71f9399cf4963da1869561b0c67b842720d5fc21f290b98b519c64923bfb6142

SHA512
0011d9f8b2732b55b0e0e6199615d1528718f35d5545b8d2aee7a98c02e073386d8f6ef23ca276d7aaeb2835b66a0393da33e4fb5d7e30cf1ed6bb62ac88c81f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc4ff844ed8ab1b576a8b0bb535a512b

SHA1
2d3c78e0fc33cdde768a08baf474a978d7133788

SHA256
1c1f955c3528cca2c111cb56d3e51ef127abb102ea0ae91278f37e5108981de3

SHA512
60519be5b48a8ff7236f35117ff85f204a5b5640110f94112bec85f6c67929af74bb7c63c413960649d9dc6461386fed29b8b05c46720620f41bf24f70818dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8293a1b789e18fbd8fab645460684649

SHA1
878c5edd03e0fb07b683afaf87d5d61d27a7477c

SHA256
41ef70134e0b8044f85b554b7f94e8410fedd0f17e2d8189a2bc81ca1b7bd78a

SHA512
e3a7d78de30f8e50d480ea6527f969b760b0c4ae587390a62f06cfba948ef393bd42ed8ee9535d3c48971df5003b393a61ffeb97f335b03479ea1872b719a5ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b958f674225f64baee8619c197d29199

SHA1
4797447847dc57b5980247190d0aa1372a51afe6

SHA256
b8083e889922844e7e84c5838bc791057349b8219942c8ca773738f380135850

SHA512
04812580eaf29cde7e6c16acae1f0fe2fe1f668ba08a60072e71be6485b3bfc3ff6dc3d48f9d89b039aae54cd462faa3ec3c700e947c8983e8b26612517b0a3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd73b3b78147d8fc95b7e3ef65852152

SHA1
cca3d63acd808b5dd21996c5a3a15b4296bfa94e

SHA256
30dcd5e6fddc695b3e26fd7bb7998d808122f63b161942b99a2fbf230456e60b

SHA512
a7bf4f8a2dad9ed653fa6d6774b4e5f80765e086281e462b804d313ca47f05e76d2b28f9e616c8f30c4a462703a3da878c82dff553d05f6f733c1dd44562afa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55a7eff50f60dc3ba6ddc2fc166310fc

SHA1
994b31a6d9d3f660236b47e7402dc65642c16f43

SHA256
d5573b879bcbb189348894004acce163162a9cb372f3f5e3d141c2b37b36083d

SHA512
4fddfa6f86173a4fb5fe33643a7efdcf279058e742e686445a3d4ef6822dc348772446d926b8b19cc79cd5d7a8aba9e31bdec10945a5ec6614cecf63313d51d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7d135a55b8913c20ed1b3d0dfc95ecf

SHA1
46ff41f5b1b7f074c7851c5a5a893a711482716b

SHA256
b799ade95918d04fe500f273f5be424ca054de197d67834500a32e21b257b3d9

SHA512
7eba3940e9ffdb3fd27cd3a71cfdd54ba03aaf963fd811911541286e025028c0d98242a5e782f24afb218b3bc474e7d05a148d6fc4751225f0118ebd86fe66a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cacb0eecd832044aed5a8d5513b183a3

SHA1
15bb8b02e8e7da9baa5b94c8d6a5fe4e7c8363be

SHA256
f3006385abb9e9af6f2e7607654fa037baa89c00dd1b17fce68f12850a6e4a87

SHA512
3223276a457beaac40e953d283e88ed970db90b4647d75e61fcc61e1f1fc173080855a98dd378dc3cbd89701ec4567d3b4818c1a945dd5cc9d2532d083488627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dbf9ef3ea544d240271d627f932008f

SHA1
e01f705bb8796081c9dfee18ff6b00cd726fad8f

SHA256
681c2608b911321833a43386d9c0987663d3d23da7b68183d95a17c50af3476a

SHA512
e2838863fc0850f4aa16aeae958cef23ccd4d2b3a9073002e717a91666527e1cf35ebf2fe39122ead4c5d7be93bb405116e6a6733ae656a1490500b688a51612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf03cc1c17e92a1be2496cd16842e974

SHA1
1af344d6628109c1e728d8017ba0f49e23a870ae

SHA256
b0759b31c7dc4af00726f2ce5c8c3bebbc952e4569645dcf7bfac012f8f3fced

SHA512
15e23d26b2f26cca042ec5ea9e4c233065227ce1584d2a7b9712dc20b0eb1862c54f2d3688c6b6f14deaa75cbe79f87691183c0a6f82a287bc340654f58ffb85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57dc2c5ddc2c2f9c3d2988c87375bde4

SHA1
1fff328d4513d05cf8a665fe986bf4cf76cc5888

SHA256
21708049bc8d164f17614757eaa93544e5e583a93ff42eaf49159b192882129e

SHA512
8a6708132c0a229ffe72b4389eb291528c2dc01ff37344c8c7222ac0edd03a4906a734154d9632eb5de52a06678bc490a8881903e643a99e33d9089c7799854c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82b2a67ddc1a214cca565279bce8686a

SHA1
2885265138f37ae1b2745502f80d13906651b12a

SHA256
c5ef387ebffe352ed7b1d04139657ef7cc483860156be3392d86ae6742ba049e

SHA512
27fbc7b2ac2ffdaacebbbc9fa1d80293db6b07732496fc686a4e114c2bf2d81502802d67cf9003a17e441343bd76a2048f6a27cc47dcf135299ebe3a1962ff18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d163d2e8ed44bcad4ee4387a6385454

SHA1
bb07049421e882aa1d0d45420f5ae05f920868a4

SHA256
f6f5d0a08d5b4f76abb7fa23d39122cdce3f9d62a08b342d828e41a67b11ec20

SHA512
7cb5953affcd9822c650ff4e1756f585a489d2c8ee572f5a839d32916ebd255a908ae52272186bb04c3d9b2345175cc420fab7c02a0d67c5a2b95dee67afc78a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e692457dbf482eecec581c0d320b651

SHA1
5dd30470f3e7c97d50f2b580260b2b944897e8da

SHA256
eebd18bdf0c23cba7597b5bc8e524648b93c736d90c8ecf841c8bce3dec90757

SHA512
4689dad8f566c573d095ae4ba9dbe0eea405161ba8e9d4be4f29e1ee961cd46db0bea25338ba559bdda27880079c0b2c8532f4436254a4b1b3aebfd7c9ec39a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3e84f019948315657e57fc794cf66d2

SHA1
d5316a4441839791976ff4d28cf46892c1532561

SHA256
f54302b6cc3219e0db2ec6557cd2336dab74159269ece6af1d75ec95c134ba40

SHA512
bcea87727f0bfdc153857ba068ad3044d1a15668e102c5ee6db9e65c662e52d1b215919692b34e5e88defee6c939f5a24b299ece5e04870c95ea290db10be97a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cd1526705964f394eb66a0ecee27025

SHA1
631228a5160c817348f79f74f3e6d7c1cfa8d641

SHA256
45eeeceda4e691b5b6d088a6829e32af628ef27251e912faeefe66c34eb181c4

SHA512
2658d17dcc527ff5a088b062a361acff6a78ac1e95f8b881bde5d68886db31942ae805162a025e29bb478329b839bdbb1b7eef75028f8935fbc9b512d808a698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f8edff82aa6df6783c8023c8d62ea94

SHA1
90adb438e572f79cb56f50532474a80be16ca167

SHA256
4e9c31d4f75427fd512321c3ec386381be1c31a044329c64c267fa0db61d58ce

SHA512
0530d0cdf5ea1a68fc62151480ad5150a5dba058b658c1ffca34d9842cf7d5c6c5ac0d6eba46c304aa23aa24d711ded1b9585798d2c2721863a6d709b9981652

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7E0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar871.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit