44e7f2a3d9c2eea32a3ef27f96d17780181a943174b9e00d7d00801fe73aa531

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

425fa27e6f9e0fd3cbaeeeb933ed6942_JaffaCakes118.html
Size

53KB
MD5

425fa27e6f9e0fd3cbaeeeb933ed6942
SHA1

94be8d3c486e4b7f50cd4d260bccb8698e986e13
SHA256

44e7f2a3d9c2eea32a3ef27f96d17780181a943174b9e00d7d00801fe73aa531
SHA512

c6e4add24435a73cc160a57041b3f7799e6beab26f37052a1964593fd2c0f8926d4f3b73d4e72fb69243298d14e4cc0e0a822ffb50ec502cd696984d5c029f23
SSDEEP

1536:CkgUiIakTqGivi+PyUwrunlY163Nj+q5VyvR0w2AzTICbbjoq/t9M/dNwIUTDmDN:CkgUiIakTqGivi+PyUwrunlY163Nj+q9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e085d7c83dd5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000b5cd2cfb9e88f03d7c2d33a42f4d9da56add7ed9d12f93b0a15573b81dd7a03b000000000e80000000020000200000000d61b908a9ef20ed5c23ff4d20cf2e1af478af9950c8e7298fced7b275e652be200000009846a3a7a19c1a1ff0c3c233fef69d0976fd2edac902c8324a3597ad10ed72814000000079e55c2b5967215d8a62e016a79f3d20f23116e0203f5ae7a68f4dd16fb61c8d8f51839cf1d496bd00e82a38489203238dcbd5878874c7090886152600385815	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000089f6e4984fa3ea04493df8de21b19b1c096e01f2669061908c9204c9cfa9eb78000000000e8000000002000020000000f8949b2b54174c120a327517b7f77c20d0de50fc16fe5ae376e73adf130d043490000000931be96bf3b35d1c31af1920e3ef37d00af27a0cc4f02500b3d0208f83e3e44d80c3ffdbcb9e73619dd6fcabf7a0c000060e2354b8110b9b4d2e01f7517f3c92d89e15084ddd1e0361e566e1a59ff11af2cc04546ffedc95f94efdcbe620e280363ee495fb15272e8bf5cac2b64342c075054b152340031c5c6858181439ec67a6f44b06885c927570646988e2730d2d40000000bfad2bfa9e8e256b89d45d9414ec8db179dbcb0f847e0f8ca0e8e5e8207ffde7ff079c397d4947855b19c7359d20af7016603d8621a397115c8e5ec08fd591f7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427048264"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F30A8011-4130-11EF-B82A-724B7A5D7CD6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
1176	IEXPLORE.EXE
1176	IEXPLORE.EXE
1176	IEXPLORE.EXE
1176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1176	2528	iexplore.exe	29
PID 2528 wrote to memory of 1176	2528	iexplore.exe	29
PID 2528 wrote to memory of 1176	2528	iexplore.exe	29
PID 2528 wrote to memory of 1176	2528	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\425fa27e6f9e0fd3cbaeeeb933ed6942_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
534c45f29859f91fa408bf81a9ffda06

SHA1
dffeada00b74ab1150be5bd5221103e128d28b77

SHA256
e278c1e9cdcbb5af6def881e770ddaeb415e7508d64478e9a89195a45c98a335

SHA512
3067cdb0b3e155e7459d7bc5f55446f3a05eac5c05583a9d61b4dd95492fe36d8487345063e5221e7eca808947981c109ec071fba52554c7eeb7cab8fd99c1dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f87089ef851ae905cd89fabe83726b8

SHA1
155c58157dc8e0509dbffeb17ef58dfed506ae59

SHA256
b531e92963a84811a0631669dbe7b12961d45023b28a5d8b14a5836096bd8c35

SHA512
9e1e032c8ab9840a9b1c9918bb65790e1eb6ef55adc3602ad78adcd3795a2595eb72484c5d4fb7c20b96d8a89adf11e5eb9b4f8c6dc02ae0ff09e69e957471a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56d0b4581da2f8216c1dfab0bf1b1316

SHA1
4a4034968eaa325fa74427de6176975b6c6bce11

SHA256
c907d901019e8d374069159adca69b892d530f4d6cd3d84c9e8cbfa818e02962

SHA512
be678a105f665999089ba31cb1cd393e7d4164365922636d338819f3fdbaa9bb978bac22dad4ee79002f4d55fe2dda690a35bd54199a211c1c638acf93069f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8f1a38e59e84e6bfa4beb025bc2d5c1

SHA1
74365d6703525668a7839cf7281e56abf9a5a50d

SHA256
a04b6cf97a8f17a97d483da29d1af2e5acfca15a887ecda6cc561bfe062600a2

SHA512
7db41a43c3de0091847faf2e10f701a3c30f0c7d43b34a768261e332b23d39a1535c17941117ac740ed5eb7efb27958d091b3ea92b38629523bad7a36de6749d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
055055f8f9c03d1b255f702b6a7980ff

SHA1
30da35debbef31604e06f68db9d17f1455767a43

SHA256
8ac2f861d8a6df62cb3f8cc48ab4747c74b19f84598e117dd032318ccd900a4c

SHA512
e955ddd5fbd955bf8b0c5fa85bf47d6fdd0c3d29480cadeeb870444a833b673be202c873313fa308d5cb2a44794d642ffbe1bc1426dc4427e371124cf86a6d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c2528e4f74b50b1b96b079b9847b92d

SHA1
00d4a1b4ce9f04136f907ae835999760de1232d0

SHA256
e5f423b527db37fe8c38eb0c8a8ec025ce57cc98e6ce9212be9e292d1a614b3c

SHA512
76408889c2664e46f8cdef296cb3bc292b7b10a51f8d65cdae618d2f16ede869e9200826b5e3a76e7c14fcecc9d572606d77e6368d0e2d05a9a492f43d13124c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e367a3e7ae84935a3d6612fb14003fc

SHA1
df0afbf52ee784b3a9afaff73d56dae62edab63d

SHA256
86d6aafac4f4456a9736c041385a4a7f51822e598f05c53ba735c560c7ee6dbf

SHA512
23d9c6eab71db3152a1ea6912353c74b75aea501004dbf37fac3261a86db33d334211096c05d78378cfd0e183361c0c206e1cc1dee7b271bde2eb0c5bfd8fe06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7c96123451397ec6076f6299b82e979

SHA1
73b338cb602d5a96909704b5a4e9e513056f7dd5

SHA256
c977d27f52231d25f7e508bbaf1a4fdc169ad915c83d33b7e63733f425c780d2

SHA512
f948a5794b44235a854c9ef26e29b8fb515d1fd2e5b82ac957920f2c3464dd34f7c77e91c38e002056f4f78f288c03a3ed3dc2c7b42a5108d53b3697fccda38e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e9171f922d702f480554b0dd5805519

SHA1
a7e9f438573eec6bd5f9ad3d0dfadc5df0573b8d

SHA256
561ff9dc2bdaa824aec536a4e2c1b399697d2ed551332a8e03b84dc0a0a7a8b1

SHA512
8e8ee2f00a1c64f340dffe7abace3d1875bf8aefb2553ace7021c1bf9ffd0f4ae65e442ff59be941d9f16bf6915092d3079e4097788b1c01d28a03a61fbe01da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8992911a36b5b29abc768fd6a8905133

SHA1
c3c99e6f518705ca7590fb345d5ce1ac90a33f0d

SHA256
1d35705df050b417e0d3d9da1fa6241e0ddd98a059a678a1b0eb16c5effc507b

SHA512
e94d3845daf5600f3cd3c6a4078d33c0a64790ea57b5e4ac7687e8642f6a9e990ae3f38e3f1a9bcc91d8adb0a87460cb932ed7501245b0f0c091fb0b330cdfde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b7e40ab5fd72553811fd592f6398f39

SHA1
c08f17fe3da47d66f6735338c719da73c415bcf2

SHA256
45a24446fb75a4114acbb9508ee4265c53030aabd33c09d7e057b96eea6e0444

SHA512
42efcbcead948e4aca0f318856459167ae297aa09577b85bda2f3286f376cf54ec6ae26ce5711c261a07105f032c0a31404daacca847668ca1e84c84b7141d75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
833282a04b1bb58a20b6119889d2b50d

SHA1
a1f4a8730c3504e8c394b7c0bf90c4f10559d42f

SHA256
1a7e9b6280f452688c56fbbc0926ba2d79dfeeacbdfbe5e2adf94cdb6e06a20b

SHA512
5ceca395d92c26eaea12e189a01258a0c801da8f8a279a199fe9f0a9f796b827dbb4a770cb93d5a2f418984ce122de075fc966748633d9c4e2abfb84f0e0fae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47b790c60fb22318db7b1606f81d8bba

SHA1
71d5c1a905f59c2d934d0ebff821abb021516b9d

SHA256
65fdf9047a59268f04528c32d050cda523a6e43cc82e92d39b691c743d0df6fe

SHA512
817221d9628d18a397c28d73dba115119a529b6f289720db3c1fc8b8dee70bc872db113e1086c2fbd6d5eb179bfb6ccac65cb1f711d23c113b9be7f6fe44f3d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d97b5ce23e8c6a802f53a5557c3b8fe

SHA1
df80b384965d0286cb1a7127d0fd983b3870d1b8

SHA256
f1efc71d0e651885eec2e0338bf6d59f78afdb9099372a6406a6759b3b113cc1

SHA512
ceafcad5934080559bfae93010f9ea0d6e05a9ac613bc641a31a5ce35292369540b2ab314104c93b73d9743dc9a665263c9108f120bc91a30b6a82e95b73b186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52d026c3b1f41d5048a24172f0412d3d

SHA1
a410eb31d20c7dc6680cb0300e846030ad6e5405

SHA256
3b009790eae06d080ff395faa6462771b97a2d3ce3247103f23a45e4aee0eb24

SHA512
147d7415b102be571b3e5e5919cf04b02f13dec378489c1d3d47321e9464ce2d93c694105b4b2cd0c6ed4b26f84a87d5a48b6108787251e43c860ac65707e578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0779c823af047fda60ed9eeef4629d1b

SHA1
6fe0cd532dd7363565c7a39d202a380e236f7f8e

SHA256
e5bfc88ab707b430081df34f3ab06c4dfa2abf3423dbb8013f835ff5d4818309

SHA512
08cf160a3e0988c06bea071655c30072867dd0d046348928ae09dd7537de389069ae3fb96f1940ada029c3cc5389d8c3d5c41d21ba56e6085accbdccc7353ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADDF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB274.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit