8f830d5a77687a96f4211f2208ee2c166275b249c1edb19c3906bfe0ebcb4998

Analysis

max time kernel
132s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44e62257c8fe45de604f611045d8c578_JaffaCakes118.html
Size

78KB
MD5

44e62257c8fe45de604f611045d8c578
SHA1

4bc8f3f3c970071e122853f894ea81811712f192
SHA256

8f830d5a77687a96f4211f2208ee2c166275b249c1edb19c3906bfe0ebcb4998
SHA512

7edebe077e6a45ecd28dc682b102210746388a2b11e112d0c4a5fc3ecff27dd21eab8d2880331257b53ae1ae2008b20b8e968b02bd5ad71fe6d7307d01a8d172
SSDEEP

1536:Ewbjc0/bdluifU9+cGDR08Yz0qqeL0hmpSHUfGb06ip0kfw4Y9spqyN511GK:Ew84srT9p0A68zzYlyf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19B0A361-41B4-11EF-9337-EA452A02DA21} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707752eec0d5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000befaa1cd1662edc182c80f6ff2ee61b2f481927766699dc39d8b32dcdd2248e4000000000e80000000020000200000002c6140edcbff80178f5b4de724c54920fa79fcea2ef8ad979a0cdcd75bb81af2900000004c41a3d90489438e8d418e68ad1d108060491cf3cea9133096237dc73728ac044fbc7057baeaf5b062c2f4ef5d8404181d1e9506ef024c9ff671121e0799870bf49f9583f986e9bc5c6631167aeb7b021d7bb8ecb622eaaaba3f06e8f4eb3f6502623d0e1cb1097e14f79339cb9631ddbd54697244e54e02d666ff272c6163017527922d6525eb112c77801ab217aacb400000001a60407739cc01c5a47e7f8299f656ad1e07bfbfdaa0d78d54dd0c6c8334d5d3bf00786250663a93f7910017f32f5bbe4ef71626f7688327a7685cb22f121190	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000007a418aabc5afc1bb4f834482c39052eebe83cd82df0ff81a33db886f92131a24000000000e8000000002000020000000e35478c07b856dccfbd454bfc99438098fba14a0596b4814ff6261fda8374fcb200000000178e6cd73e95c8a9046004cf874ddbd16bc07d2d20af75e4684605622ce7a8340000000c8a1c4c9f78c5c8104f19de3aca142be5940118a2eff33a4e365ca48cf03092aab85fc48be13ff9fa366e0f35dc40e5a1b63e09f4927ca45f74aa4ad09c698e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427104593"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2788	2072	iexplore.exe	30
PID 2072 wrote to memory of 2788	2072	iexplore.exe	30
PID 2072 wrote to memory of 2788	2072	iexplore.exe	30
PID 2072 wrote to memory of 2788	2072	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44e62257c8fe45de604f611045d8c578_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11a24d50ecb04abc6022d566bd869998

SHA1
76db77d2ce6827aa3d51b7d952178419ba5ea087

SHA256
2c427533fd4da0c0b4560e2fa2696373d52c94546b7fb72fbc2b3b209236e62c

SHA512
eb58a0709df235abb7ba8582be3da096233bbe136ce76dd9ddcde4f636605c61f61e555fc4bb2435647e9b7eec8f0a18199c07b685926144d997fe55b2ec58d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a287c07a7749e48a0af8e44c7461bde

SHA1
6a81b43f67a424f829d76ac871b8848f4d4c8363

SHA256
27d3bd32475f762a26fc4bb18bfd92a80e889f64770743e4269980eaa0282938

SHA512
2b3ba7e56da06fc8e64d256350d66aaf293bbd88bd3a0a7410ba49a4837053b1c177e46e23749949cc5ffca7e9f63f59b974a69ae1fbd23e027f58a7cf1830e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
835b081da2991b012123bff8adb6e9f2

SHA1
cb3621346fcef6798b061968eb5233efd3671839

SHA256
8db3ce506bbdd6a034ef6b9dd3d2ae2e08566792d22b83f30ee42a7915833048

SHA512
a4140a459f31c17a1a5cc3f0fd96ed155cf43906eddffc0544bd2f2512bea6ae107b19b9c1454a4ea2832331717c47692f31ea465644eafc62eedd233cbcebc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbd113376ec53252aa1b82b6b0b3052b

SHA1
c6677c1cfc8dd6b72b5bf52e6a2ebf8a0b92a5ab

SHA256
1b58ec13e792a0a9b246f12ea34fb031b153529e4240a67762aa7bf641b57d24

SHA512
d3bb15aab336946bb352f795fa824bba11776834bf8df081e0e01aa2dda1271f4e22ffc1b09b75e5c7cf9e84333efd82b423aee2679e963806c18faac3436301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
748a6943eb13e731cf63ce173d3356ff

SHA1
f7ce7120605f69a28ac2404ba0ee71705eeee422

SHA256
b8c794d47668aef88957078b2b4a4f4ca2cfc3c825f03ef43a9e124ba55f0249

SHA512
ca7af5f88023ad0431f2546925193571793b5cdf420a968ad4e2ed00df8e75f42bf3eaf450f68f6c79216d3221b35b85c71861f6a413a2308ea02636d1344633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66426b6082d456b6c1830f23fae038af

SHA1
b678f6ef5f83e98cece8598427a8204f716d2af3

SHA256
d569a154e0a335aa9ebf3818ed318584180496f5c7566119d04aca74bbd780fb

SHA512
cfe7bba244625768116f62512b3ab69d393ea2e610221cda7c62611acdc20e3d12b00974364f1712213df9b46c11a27458d4a2c68b9d91c0aa78fe4b82b3110b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a439ffc32ee94d32e5e31b0c87ab945

SHA1
1766006435a05c9914c28b083559070bf9cded02

SHA256
804c3619103cd7d48409e5a2077f34d0f97d157223edc14e5b1ed9427930a76e

SHA512
2036e0dc7c9ce2ee33d136a54a287c50944a44e6711e5a16c4e9c15fc689647d1aa851fd5f8af491e615d302769c5d3c8e5984a863998a6208e3bfc2b8021c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84f960a1c842140d69adb4d1379fad13

SHA1
3ddb1da19f85d4d6a61f891cef06deba65ec95c2

SHA256
19493e104ee5ff945223d8e7c79b62ff386bc12042c21d13326bfebf4a32f033

SHA512
020522c56caecc3a3a3f4a71a7b4db5b164eadb0082236f670d84cb80beb62c0dd1b8b3438b558630c0671221757a4798f8d9b50e2ace74ab3100e98e9a97f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
720ab5b0d8df46c2b94cb2298db27ef0

SHA1
14b24501e8e99e879e901d6306f13ae2e1020863

SHA256
4fcdad840bae7cd29d2eb19984cc8456d9d366673a389ad8c560728daaaedf03

SHA512
dc1c431d19d9306f02624d1c5ca786288fe5d4c4ade9c6c7934c40109401a3e513dae9994dd094140429ab483638298c584984723a69fcf60d3661a8be6e1ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3e3f6512d0c758f3135e6d347bc6a32

SHA1
a3f58c88c0fef492d745fc2f05ad2bd918ad107f

SHA256
f00c2202821765da6d9fff6edda22c27c3f8808f293bf683fdd897c7ccf304ee

SHA512
e47014083e28b0b5fcc6c744fda79d8c2980f050ae7869d08437a1148b67d87443fc2a4e8e8c44338d2b6fb0dd130ae3a45898819b39c4e227febe98827832c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91156a3c37f50e8272e6b0d8513f4e99

SHA1
f3a270a712107467050bea6b55c80a7957b1bca0

SHA256
58456820eba585758c59a7bf652d25446a3fdca1d62ad2fca84d2a22abd050ad

SHA512
5f48c71ea3f3fe3da28bbd0834cb54b4a5d8d50cb266133b4ab4fe55fbe68d960c56e2796dd76d238b71668155c19abcff527320134b5805139551a7389ad2ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3859964b0791e6e9576987ce6f85127

SHA1
867e1cb4a512484a76d7f72f808a3306e84bed3b

SHA256
d4cb840cb4af52c378900be6996830fe0d662351659a90a043485676c360493c

SHA512
c4c556bab8957fcafcfe5ab1f20c74c3c863330f58d53009bf8e5bc11a4ab60129f2b6b7941ad7507b215037aef742075dbc0c9a9ba3a528a9279324d6f5a18d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ac4faff7a442932d0d304148f7d4f1d

SHA1
42b9a380a072034158f6bb8300d7c2870c07bf17

SHA256
aaabda933ff275dff1a92f135fa0f74ee4ee48849bd2f38be535830dfccae738

SHA512
53a3e1d0ef98fa19bfa4f5b7dcfa2940d1d3339a137c8ad1a05df471751b48c362eb3a06f72217e8847573369fccc158860e0840b956948778f3a75e30e85544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbafda44e8af6254f8753cedc54e68af

SHA1
69e0cab036e15ff0c5644756ae0a69240f356368

SHA256
bb39270864d0777ffc9e6eeeca589c4c72888272ebc55861f0ddb39d86e112a7

SHA512
fd04cea8e3389f0e09402801dfb8ce61020113a8dd6acff396edb991c763724a256e9c7e066a8eae56335fdcf45f5f1411b5eab32fef80690655a4648037c1db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daa9fb356fff31589734f65f2c248571

SHA1
5253a57e80fff5b3727d05c347d51168a9791cad

SHA256
7266e955c109793bdfdd563c6d94b931fb87c554915409dd11781e860dd73519

SHA512
4c82b4682e99d2a95a26a0d268e5c14ac261c876a3b39d9665942683ded3dbba3446804ef0c5977ea8c685996facc8d553361ceeb3daf6ce490234fb934f310b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d58b01d721ddb424534ced3ee1a27416

SHA1
1d82411e55bfd5d2ccbdb569b011d91a7c2d9835

SHA256
2b18b00106fde954439c4f999f73f339e6b9fda5563f2b9ca864a661397422d3

SHA512
0934364e858a450e9e03453c319678a6a830b54305bcd4b89ba22e5ef1b89fe93b51b19455dcac688de5439ecd2b414232dc6c95ef405a6ae90ff86fa612c044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db1a715aaacba677abc1bbfce7d08848

SHA1
1a692303952bbe77aff17d415fe11fccd2709a00

SHA256
989133bd1dd4ed50371717d5793b19a9e9602c8935d187618396c99766d2ccf4

SHA512
7b1aeee4b67173f9a7b82eb17a914852f81c20c536834f79a40a653fd2690d4bbfc6cf0544ad9cc5acd49bfe3f512a851793587d7da842b2380a10b4926d3de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD0E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD7E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit