ea5c7f268b3cb1968cb043d6fcca46fb44acd6fff136bd90c988ec8292926032

Analysis

max time kernel
132s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4467291c5c90d336f7573e47a6ef327c_JaffaCakes118.html
Size

66KB
MD5

4467291c5c90d336f7573e47a6ef327c
SHA1

15dca1130242cb325178c3a10932084332849d00
SHA256

ea5c7f268b3cb1968cb043d6fcca46fb44acd6fff136bd90c988ec8292926032
SHA512

cb4ba7c17adab38b1a0208c2a1e3bab43ea58adabeb3c1e3ac0deac4ff2485db056fe3944a11b24ff114359043f214968e46ae8fb0332534ecd3ab476179f8e7
SSDEEP

1536:fA+yMa867458BiAxLJCUjTU6hzZ5yclzH10yJjmwG/IDGWBpipVrPcsDWEjKNIFP:VyBvA8BiAxLJCvcs30IFP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427095052"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000fd3b70339fe18c4cc5529279db07dbd5e33f2b964e7f08228ac623df4ecb5f1e000000000e8000000002000020000000ef2c741e8ff9039e051b7edc4d648fd075ecd73b801a072fb8f059343923a3129000000045cf59696d2717bb6c3f5741047a7ccc20ba49fa54c2ff777853fdee2f3b0be3aa705ceeb424a2d90b331ba80166b1ec03be73fd2761a73410362027303ec953fb4ee813d14f10b07041a99bdf3ff283a04af0e7926af569659a97093bfc429dfa1e98924d1147685227adbcc39c52245367cae98c3b01aa0d8dcde7c57af0b210f3ab39f01af6b371554467bc587d2a40000000048f83b9bb595560679738057cadfb319d6ec103ee3eb2b8cfae6846651dee5986378da2071c12d39822c3b2afb8070864363332274d28584d351c6c16bb9904	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100426beaad5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2D15031-419D-11EF-84B3-46A49AEEEEC8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000efc46cf4f16700756a345792e7788814c8f1eaf09c65b55be6db48769c5d4fc9000000000e8000000002000020000000898d359b056722954e234b308e396dea57836e17da9b1a8c2743d207c5517c7c200000000731b8dddefe7928df5c6383bbf2a979dfb122b3568b881735e76f615b75c83640000000c952bfa9f2ebc174192d2f4ab012207458cd9754d3ed1ad51bcd21a5733bf7ae0c56193a0d3fbd5635df1d3ee83a7cd689a2938ad63c87fdba88617c0cf9d57f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2332	iexplore.exe
2332	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2832	2332	iexplore.exe	30
PID 2332 wrote to memory of 2832	2332	iexplore.exe	30
PID 2332 wrote to memory of 2832	2332	iexplore.exe	30
PID 2332 wrote to memory of 2832	2332	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4467291c5c90d336f7573e47a6ef327c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_DE59F8C40B88A0DF57DC57DBBEDD7057

Filesize
471B

MD5
412001ea272120a9f862306394e0e56d

SHA1
462fe53fe4178d58952c745fbba1976bd863ef6f

SHA256
e18bbc0300a6a70db80e405e62758603d7cf6f6263fde7d79e006c02e7a4e6ec

SHA512
1f1c46736fac6f6f760b9d9090a29704de212eaba2f49f22838129894123649ebdb0346fbc13c879ce94318001b32350f7619fb71fd905681aa109734892298e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4ba9522c190742df3fede9191412b9d

SHA1
77cd41268952123d23c2228dd0e7e8992ff814e4

SHA256
b84ef9e2f6c6c47494f113af60654237ced09f9bfda9f2ed7bf3ce68c00f82d3

SHA512
ebae8b863650ca3b1c0c67ff0c6835d8a3b4a10cb70252802446b2917fe1474baff81880f95143173a42b12dbf8147ff8dc8b4c318c830545a7b0156e62ac3fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db6f3de5885d3f7534ec305282d2e2c9

SHA1
4546d532d657d0b1cf5441b0676b4028b3e86ba1

SHA256
3c201d0d3caff9df4b01faee56fae21f233680ce2c66cb753c259a304e1c1c9c

SHA512
383f5d3d785f08998726956998efdaeeb07687e6042f5db268d63985404f89c50f6d1f53466eb73ad175ca4f72ff627ba857cad52d24016f82111ce2d76466ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2356581fd66f0e462193a5db25521c93

SHA1
a8ee22816f4a0d15467c90ef26537d9b57b58b27

SHA256
834592b02496e8c47a1adcc3963a3f71d40eb2763e31fa374cb6363491a3246e

SHA512
ac9b58d8cc942dd66cae7055c15a693c7a318275d5d633663076c8b46255ef2218d62e30db9f9d88dfe636c0530484de9c824d34ddb81fd95b6766f9106f88f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b5c52013512ad948f441b0fe3e1177b

SHA1
28a8559987798f1ca825e922b3423440a1d7be30

SHA256
e3dd62f2b39e13aede201c90410db81a3147d1e562268b1701bc577ddb1c25b2

SHA512
0aa3e0e769111187632413a2c9e5dba9bb9fcc87c4535d151ec686021403fcacb518ad5d45b710cba99f449c7f98f7cfbb9d40f43fee5fa2934dbfeb204ddd1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7098993e7e83d0a32c6422692a5e7ff

SHA1
53a8343934d6422826ae7cc992ffdc33d2026d79

SHA256
5645540ae07aa0b807ced86b38091f1a8857235efa83aeda98d634ac828638ca

SHA512
5030614ca634e6323cc77fbb0c9e8c3298908ff595098a40204c727cc07f7786e86a757d8b37d3a177cdbf55a7739d591e4298c9da4c874003089f2bfa106539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dbd4bcfccfc2ddf261350725588a82b

SHA1
12b2dd2b6878d6d5e515da00117d97d48c573a77

SHA256
698dc8f2ab2e6794df7100ddda65a38d106b20c7791e2ba7855cfbff994100ab

SHA512
c064e8cdea7df2a15d5542a75dbb575491dc1d710d8ed6feb25b2ca7db56699e54cd41a65809d99fd7a643ab48292325409627bbdcc3597e4c7a63b7fc81a32e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07b7199ae94c7ea7c189504c542f5e64

SHA1
65fcfbcbcca2c8a641623ad1c45df745f1b59b6a

SHA256
509dc0a422341081c62179adff7546a0a75cc4ba5fc366446d542cad2a26e4ec

SHA512
577945a3a6fcf991502741d9e60b92b9123520e49737d983d8b650779dcd5ad3e6318e084723c42376a82d7d7fba6b1798f4a64381fa5fb2edf74bd6cca497a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a48aa44698fdde049a6dafce44ae366

SHA1
53794da0978443c95966a2554089b343a75e331b

SHA256
ccda1bed1e33714a3192538b1831b894b3586328f158a2702f78f48ee0d93290

SHA512
2cc2f2e6f3e4bd96d366d2c8340a4411e17f829f013e982c2be9b7ad4657552666f5aa2e838c0a439c3066adb37229a1f7fc68c2ba17a1fef7c2f6b01121ef52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd1bc7a634f497532c204be5a57c8a15

SHA1
a1f9d2db292f4d0ee5a0d0a01c982976fe2522f5

SHA256
0d72bbd6d054453ddc913acc185e5cb4b894b647630de038a25ad6505f2b0bd2

SHA512
b3df2ce4ff6f84bd2156c9f4e8415e1b9d50d15b041252a5d555fce73f424e7781e896b0ab6c3078a8bb884a9a415230016bd56f303e96759b5afb3161928427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7H6XY0V\544727282-postmessagerelay[1].js

Filesize
11KB

MD5
16f1b19cd042265a234dc208fd7efc64

SHA1
02f67c09980ab6057f073d29f4c3f2792257d3a3

SHA256
509be2bf36ff013c9a1c31ac54b751aac2401f14496662a16ea8af6903d21b27

SHA512
652ce3d209d5d4c1e39f06e41e87a14a3174419b8c9cff8e5683846afb51f9f4939c41fb51a7aee67d9d26db80b370890182ab7df089f826479d3e5e2843566e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7H6XY0V\cb=gapi[2].js

Filesize
136KB

MD5
5a7616280268d3642196c89bd5a7bf00

SHA1
0350f9555271f57d150da785524e095a7e8eea56

SHA256
276ab13834ac74ad86344346135288624927cf2e8c5cdd589bd4619fcd467c44

SHA512
76381e69a4c24798b68e95dead45543e0f685dceda39ef73d49a65261db91d07c8aca0171b97cdb173c0f21d52aef3d6c6699ab62d511e3796dfbcda4b26bc63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCY0HBA7\rpc_shindig_random[1].js

Filesize
14KB

MD5
8fc4756eef25ac14a3bf4de7140e77c2

SHA1
8adf8ff177443487e2a4a3b1f169709c6a3b1863

SHA256
dcf3fa17017f5b2bad8c179c85be50ed73378139972b8aa1c6502f0d84195b8e

SHA512
a8a37785774e4185bfce8acdae92a2f71ecb7069bbebe23f7ab35f0bd655f66d02f2570090225324a5ef738ce68c5166772d9c375fb42981308e2bea734a456a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\plusone[1].js

Filesize
55KB

MD5
3c3dbbdbbf4872e02524e304f8be81e5

SHA1
5a2f8e19fa6013d8a3766001dcd070d74d725a7f

SHA256
33400ad259cddf0871d1ab4f88169efc596cae3a5b9648c96e991a6cd4b5843e

SHA512
ed73c3434b83c26726a6d8b9bf8aadcfc4804fd540e719046a7b4cb1c76cf89d0675b91c341c8ae1e3b8f6d7c2255a52fca941cda3fcbf907c1d6f88c4299eb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9740.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9746.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit