e534ac53d39f96ad4e9695528588a5c6acf49d34b0b5316e6923c4df7b78475a

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2908e9376572e2ca7936f4a0ae51a4fe_JaffaCakes118.html
Size

7KB
MD5

2908e9376572e2ca7936f4a0ae51a4fe
SHA1

6c4c990d36d0ad2ac9add327e0397685d51164ad
SHA256

e534ac53d39f96ad4e9695528588a5c6acf49d34b0b5316e6923c4df7b78475a
SHA512

bcfe18a9bea414db05edebf28e29e5b2da72f8765092746267bf4b800483f778b34339e8e60de4679929df669e79a41cf02fe123224e234fd089fa51c5e074de
SSDEEP

192:vJCrPVQ/j0iQJk12Jx39v5vt3BZllhnxOt+Pd:8VQ/XQ6Qx39v5vt3BZllhxQAd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90546ddbd5cfda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000619fea7b118c9a1e2e9a46836474b837cdfac97b9dd1a2528006ef8fb13dc1a0000000000e8000000002000020000000d9869a45a49488272bd57adf83716cf14aff642e365f84bd027ed8fd827ce93a9000000006be5a6945b921a81da6ba9d84fed08f88a98fb6481e98fc409950d5e4622cb1f5351ca1cd09de97fba0efd25185728c74f2ea418fd14f38f2c88be76811b5c1f741577c51147e07f3e21ae8863ee5f42c9d05ab96bd33aaeac163975ec8a7aec3153a36d5cef7f7fb91caf34aa8df850dbb97e385ca423f39967ba9b6476f4b9a7f00e655c64539a83fa201ecfdfd1540000000f35ecc62f1454ae9ef42e40ca282c3c122c225f6b9a798d08384329747d979995e2d305a29d46f98c19fa745e84d43e3c480c3f3b2412a5a17f24b8ff9337576	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426453882"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000402e1c84377133a5a8e77ecae579ecac471aec4fec60943443bbb0d6cdcb665f000000000e8000000002000020000000a27b8ab68b59b77d0e80b796dcf8f48a2e6bdfb29f5f37b314111e9eeae9734d2000000058539f1ed8226b41c458d48304eacaa8646ef7bd8af0a8bdc63d1c4b52d531cd40000000908c396fb753f5611b4bca72469c8d12dc007f33c52316a579f771610aa1853426350895cc02e81b10e1cb004c476c84b49a7cdfe1627db33be3e5106612f826	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{070228B1-3BC9-11EF-98EA-6ED41388558A} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
976	iexplore.exe
976	iexplore.exe
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1748	976	iexplore.exe	29
PID 976 wrote to memory of 1748	976	iexplore.exe	29
PID 976 wrote to memory of 1748	976	iexplore.exe	29
PID 976 wrote to memory of 1748	976	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2908e9376572e2ca7936f4a0ae51a4fe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ec00ba199692ebfda6d6ecf367951a1

SHA1
93df76cd97a1054693f12f664242e0a41ad66ac3

SHA256
c3d8385f75561e0a33c894a7f0954f641dd8d85755de51252cda60ac8690b190

SHA512
81944b411455cfe2da9c9165b38feb8eca923ca85da849959384f0de7d6b715675b36052c6a19c44589fd573654f6760675eb4523bc1bcfb91c773de592a2fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e859f8f7773553c5eef36fd5c26d170a

SHA1
52419ae8e27333af0b39e0d0304f39bad91479a6

SHA256
62bb21b7a93a38b63332d55e09efb687ebfe1cc347923367522828050bb78529

SHA512
3b111a57ff3670a5bbc83dd71c02a6cbc3a8ef3ccbe46dec8f975964e124ad65fcffc9ce142f506e45fa8c11f284d3d823f8465312c93fe8a93770a9e2a9c62a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a98d3f89961e627897c03dcf3ba73be

SHA1
f035676c768cfe82067db78a949fbd3d0bd5d698

SHA256
df6b78e1f327c7656cb981ef9eab296a177b03233b5afe96e6c352ea19a276c4

SHA512
b8ee614adbf9f47e7a94c9e495570027a66f7c2d3a4d48fa87e57ccf2895f3cc997cc8787057f8fa88674c31c213e13e1078e41b7da8fa3c1ee975bff94826af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb4da4998f12961cdd6eea58bc880313

SHA1
cfd2b4436302ae353a2fcbdbf475799771bd299d

SHA256
5465c8d3faf59791f9331971e9629254f0a1b75bbc171b6905d1bb4c1dbb6f71

SHA512
cf14abe1b0a9f2156f9721ee18d687913a453cc11ef73eea04e981d925f55d3042782df4ebd7621fe5f3116002a9289bece05f106ba42dd8d7f93f133993c482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebfaad238337bf18cddbda93e101e2c8

SHA1
d7b33649a3988c4d7d48d2c1a9a9a947af63a17e

SHA256
d1d78ae0935ce47c874e17c8144c69cab51b517011d6750dbcad8b8a9abdb488

SHA512
54c1256af8dd2570ab65b0854d5b29d3c18290468d391c185fc3d62cd33eb0050b11507edd884012adc98a70e887de56c16c69a975b6128896fd1dd81898cca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb44fe856c8bfec24bb707723ff2881e

SHA1
81582b4b5bd9658c79731d6ecd0310ccad6ee125

SHA256
e266704951da4150918a221cd64f7332240cf9082a18be897e475c77e89a2c9b

SHA512
3ac96e2ab006bb00839450c379ed53f1e2227196690235d3039cfa9a86572a940822ea295a1e47a472f8ac136c61cdb8386d7f269c8d68876ea631e5d6e5e3ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dca68e8a59b4472596cd0816519af35

SHA1
be1f98a9c460ccdc1c48eff5f5a6b1de336e5b11

SHA256
4762cacaf382f34af8798345e49691d724d9c1109be199c7f45783915b576948

SHA512
8324319786742d1b12021d34c3c38bf0a15200952afe2a93704d07017866cc42d0caa2c2f446a8061e361a4105aad03f7d8653d75a7eab1c8c067dbfd4d6eb32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2ec657d943158fbf0936855c67c71bb

SHA1
d3cd3400215e92d204798474059416a32846862a

SHA256
c6723f4fe514d886bc1f4e4f62ee51b74d087f8a36955e45395cd2b445c55d30

SHA512
574020da549b32910e253bb5359a54230c6afa911e80809e1fd94fbf61721f6c7babb5cc83c718296b697c0feec860c6e087b246977c8c1bcf82ac0e4376a3cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
733522969277a6d4f1441f5a66cb13b6

SHA1
313b0b92b75f8528ba5b9570278b352ccde68926

SHA256
30b390bcbcae0e9875a7eba90c040cf1cd1e861e37558091f20efed327dcc703

SHA512
376db62a1f553660c4c13b3b6f4c6b67af4c66202baf2ae298fcdfda74abd5767f59d485713b957aed49c014e2f298f2477477f6ecf06c48ccb9b7c1a530db33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ea04a6cfb73bc680e91dd9deaa5e0ef

SHA1
890d6aa33867e9ae23ccac650edbb707bf03fdd4

SHA256
f99483dfd50753a5a755ae8940db8c1f3a52c14ddc172ee4fcb735c46ec0a085

SHA512
ef54841743f31a98f34d60b6b578135390201d12259967afd183d775ddf36158a14145c798c9e665fbf0c06e2a0e301a29b81b188177cf2bca8ba40c394d3abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6777f5d25d43722e6d6fb324f44de4b6

SHA1
6a1a0299ad1c88f2fa450518c6dfd4346244a8df

SHA256
2a99a7f266e74525a99061a9e0c334682121cd0e4b9ce8d9a18c1d7a1f876a81

SHA512
8683fe6d1b9437cd073baaa64077a827f2602973c083d2d57018998d4346515b1332883562ca7865cc613bda1a9988d2aa9ec56ce6738688285973f085d2a3ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31ff48d5f171fcdfb696259c434e4150

SHA1
ea65189c700ec40b732c388c028d675fc5a48281

SHA256
0d2d1b6b92669cac631b13c7b8aa8074f525ebc55cdacd7ad231c99812a7d65f

SHA512
6169a2655569abc3cac5f2b8f35b4feb75a2655d080e022218a85586bd1e1e8fac593d9f3027b9a1aaf14c24163709944bed0798aba49b83497da782deab56c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66eb4f999d2f3cc88b14273eeefc0011

SHA1
a2c0c55f0734b4cbcde8d52cd46eea781ade6628

SHA256
d88790b5e095b14c2125f9bc5fbccc003180d67c50c6745d50cc35d5f524d9ed

SHA512
7c0cac8a99ffb353ed8398c8a90a2e6266722254987e4766f4445e10159c432e461dda928b74d0122a2de3ace64abbd16b9c34024de5360665331636df3cbe2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB19.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit