b7e5444d16b3d23c3224608065495657d882db9a7a2db6f71c553a00c4885ac6

Analysis

max time kernel
137s
max time network
139s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

640abe862e166ef5ad6c3b8f9721f4b3_JaffaCakes118.html
Size

10KB
MD5

640abe862e166ef5ad6c3b8f9721f4b3
SHA1

f458630f73251b2ae3d976c10411c900ff3d782e
SHA256

b7e5444d16b3d23c3224608065495657d882db9a7a2db6f71c553a00c4885ac6
SHA512

62fd7db635c98585559b8636cd858898601b2a07dcd082ab97c6304fa4b23f5434060041d117bb3b142e1965a0d7f5f9c5fe8fb770360ec14b99800c37ea8d78
SSDEEP

192:v+/Vaq95Eju4lw2XUIQLmJIEuiCZX+18i97RLrlvwusW8YbQ90SDQ90yDulmCnjS:v+/Vaq95yHFUIQLmJIEufZXO8i97RLrF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000001ddae40d22276f1995a575c3c4b3fe8492d2466ba5d9800d52c7bb1d8dd204de000000000e8000000002000020000000d287d2217fb32eae63641be1c1331b1a09c89eb61822b39e2191cbbebd407ea52000000094009c2a3477d839169c74bfd00c89b479ccdba0d6ea46dba2f1f691439d7aa440000000387b223cc1fb2ca5ddb126878da4ec91665a882133da51ab9a7e1ffc37b0bf7065ff8c34a3e52b83b83d785cacacd933a3d3886e36a13443cbb251696b9be105	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d6f5eb26efd055714216631b7b44a0fa1d3f8b7ccb14c65e5ccbabd8f814d0e1000000000e8000000002000020000000f4106786a204367067fb50c515a09a0a5b8e960501227ac79de85b9a0460d5ff90000000e0aa74682892325caf09573c99e6b88eabe3664864ad37c4b2df3ca94b297046275180f46d9abd9ef190e7a1faf32b2e98c2d6e893512e88d9272ba364e33da8e87b4282b067f0cc93bc490b37c3c9776341070b73e45303155c7c420ecd3bed092ab4aed885da0af26a237fd7f27b89956324a311f55a0626fa49d178fccdbf7ff222cd30e2986dc6cb7a8634a5641e400000005a45f134080cadc1468a5bc9fa9f32f48fabdf06de757a2218f5e88a90ccb76ee674549de87a1d2006ad99d1c4fb6d3bc8f332497f91fcdc243ba5f747d1fdf9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004cb5dc59dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0616F441-484D-11EF-A69A-C2666C5B6023} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427829983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2144	2080	iexplore.exe	30
PID 2080 wrote to memory of 2144	2080	iexplore.exe	30
PID 2080 wrote to memory of 2144	2080	iexplore.exe	30
PID 2080 wrote to memory of 2144	2080	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\640abe862e166ef5ad6c3b8f9721f4b3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5681319295dbb40765738f379409964

SHA1
60b799a41857899fd9ed3600d22aaf7f47303117

SHA256
824789596985191cd6c023f6b46f956ecf0f2e74145d6e717f633d68e51ba562

SHA512
ef8eaa704beef94073e78cd62385d5a4cf79c21d6e23dd83cbaf654fc3b5f9e08952956a32f063b3f5db9aaa8bece267d49c35340c1431d2369379898bf49009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96e183286060a7d5460e3650343d5f67

SHA1
90e3760163d6425f27192f8e767cd9f9c78761b4

SHA256
3f62bca212071cefbf295586be3e3846dab8c511a71c967ddb65468177eea673

SHA512
5502055e395f26e953836ed6ccb1f9524e88ebf9dde638a81e19ae7329ae7b5b59ec10bfcb3d9bc0a20acf52fcb40358ebcdf98939778355383ee00d7daf953f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57d2269d63981ba2d2002ac9aabf90a7

SHA1
f2cfab0806d70a6591f3db2ad5d33532e415995e

SHA256
b63125a3dc5a0d390e6266104d7854e316cd78ffb3726e5a3dc2672c1d0f44a5

SHA512
fd030d1d6c1df5b9bf260861b6ab62e05e61145b4360c6d1138fa653f02d61e2589b590c67a3852b385c20dc0470a1a4d414a744ebd3016123ec4ca047b8d2bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8e1abae75be5a574bb16365c2415ece

SHA1
6eb0c98d6c11a79a0277cb59938598551852ea69

SHA256
46b7deef9e7e99da7b81e9d429212a739e08e8125ef82321b1ae16fc25867e37

SHA512
e6f9bc20a3136c70a2ea37e875bdcbe4b1e7edf6d812581439b32ccd33dbf96940458581a29897b32a6b6f52241eb187e01691439cc9444b567488e01b42e2fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
986a1bee5ac5e74e7e828ca3c1ee25c7

SHA1
025d95ef232f12591847b01a15becca1fb9ec138

SHA256
3b707bb80442aba8f627f91aa5ea26d7591e5aad2a9d0cfd9f1bc614bbfa6226

SHA512
682dfc02f8153ecc08b81895521e36f7f0f837b440bdafaaf790d7c684df3e177830b6aa74f052bd18e4a482129b12631a9f753daa7263ee444b5952810c432d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cf42abab2d909fc585cbcae97723ce2

SHA1
0c775e50132d167150e6ff0abfcbc6b12f8ae762

SHA256
337a1175db2debcf4f3edfab2fa6ad415e8f03e95b85c59b1af4abdee1e96427

SHA512
5347005c43fda789c0bf00024fa1b9e04429e41430a81b31f5eee680d554e8aa9464660e4d265c1d4636ea26a304ed02f922488389dcd1f9ad5a5dcaf3179861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6db99d7f7dc7da8ea31c3f5a7cfed9ca

SHA1
f731ab5a452ec5e2748fd14ba75a600fcd8058c3

SHA256
1d2db5fe46a669e8d193e076ae6ccd45d89bf37f67c8cfb21fa1bcc6daf21f54

SHA512
833ef36e8b079a64502d038ad3e872d9db00ad1367231a0bfb082124132c90b953babf7a3bfcb46edbfccaa06807c824556715d07f77f312bf0c1895993a8263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94844e7a0dd64891efc1f71ffded54f7

SHA1
02e60aca7eeefe0c88280a7b7f54c55fdb71bfb7

SHA256
24e68981d364bf02df34073b9a006a096fe232d5c745708bac8de2723cff121c

SHA512
e8e310a286c9fdf0f77e24ff2ec5bd6126e3f49fbf4de35d3452ada57f7ef8c35cbfb0ce76ad77b8294bbad962dc2120edc7f1d76d714bce7a69116818a6d83a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36733414c0d90e112393021a4930c834

SHA1
7f36c31305a8f2189a53531a37eed22d28a6de25

SHA256
2e4b776e137217326befddd323cc354a68228e3a4cf40e4d02b80c0141234cc2

SHA512
62154f077d4fe6a1396e336fe0d98c63c5063279bb1162335c2678bec79c02eb1b46d72f3780a2e1f861da46b3cf280838283cbe9f1fa70af47bfa4a4a696977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa69ecca825879c4bc157094671fb64d

SHA1
c3ef97cae8f3839bb10773d413b9622e1bfc91a7

SHA256
895c242e0475dd8f3ce47ef59a5793abb54fffdb0722ebe44ecd7653eff240a2

SHA512
61e3b1b9e81b815e3311f2bf2c6845ec4560e69711953d54414d6e8a5880ee959e97fe33566c2ae9cab5d1a8f7e81bed7de684a73a68b1c7772e031c46724aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f83273268beec223e43b8d4b3148993d

SHA1
8db3009272dd00a05f549314e33555ff437fbf58

SHA256
48c22c0f2e865e2d1278eeadb0cb87afb51d19ddedbecfcdaf0c5b16c5d951ea

SHA512
fb5e6d4d5792ec3dba5a5ec2a33c912a3f0ebe6e7ec50aaf42260492c65a3c2b8832a8a2526c9a93d818e77d54c6d281b3f460b870a9d3a82631df9f1a502340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38891a3bcca8c0bb5827085e881eb978

SHA1
ceda81f8f7423c4ffeba80f66bd6b2b2d5fca93b

SHA256
97d26a5a901f66d932fd5a8b3e5bd431e10c3c338a980ae4bd89f53e761683b9

SHA512
d4f540132978a631a763a19517de40881415d95ede666216fa9df042792c9b6f830facd7e41e1d41a84c54c5c424dbfa14320ce467333838ffd017af7fcdbf41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f145c273622dcfceeb8bc85f3ad0b404

SHA1
b959c7fd9809657a79de3922a254a4c7f0f19b35

SHA256
80d707bd48e19bb68b4550f0681dfb22d01db40fb715d7464ed460e308db9db8

SHA512
f82ba561ef18819ec08d38f036a5670e31d72b0aeb5dd6ae808f1794076baf0de615cd2a4086836a7c41d67104cc0214954cb7a41a111007ff430628ff05c14e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb1c872c515b45b289a19db5988f1c17

SHA1
a6b79e76318ad2cbf4ff65e56fbbfc058f47d6cb

SHA256
3650694d9b2a59f61c37517a06761c558a07cd058eab62bdb886cc3018a5de16

SHA512
ac00df7411ff110add6b6c7412be805bbc22eb3eaf4bf1982e3cc9e8d65e45fcd41467ac7a7a62d088818334762c40369097cf612c6fd07d53fe1b47bf8b4e45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92d45f8611b08aefe4bd810d9c6032cd

SHA1
f61fcd85c07435ea4b38f9b6ff21749bcf601e91

SHA256
fd327bfac59db529b9cd1d5096a0f54e20c2359c2f82db23ab8ce93aec9e4964

SHA512
0f0fe67d27e424abb590a1b40d9fc076462e03c6e13d3da1bf21867d5784601a30cf94e9144fc81415cc485dcfbd97a8c97b665d0942b56e22ab6a7f1429818b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA4D8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA4FA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit