c9edfca65cd8892aaf83a9d95921fa984abc7d5991aff1163991fc00942ca274

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2726fb76b91990b1ce6a2f2e2a4fc49_JaffaCakes118.html
Size

9KB
MD5

e2726fb76b91990b1ce6a2f2e2a4fc49
SHA1

a14f933b1dd34ef6d7967985f374165e5d755e89
SHA256

c9edfca65cd8892aaf83a9d95921fa984abc7d5991aff1163991fc00942ca274
SHA512

a0177bc8c44c5910ad6eef12123033c9d3d39589c650a61fc0dec8e018ed25de7dbc7108d62b6c826a77a437ed6856a69b25334e0e2c775920d018a25b8e72dd
SSDEEP

192:SEEgax7TR+Z2AAbacxv2IwFbK2yLQh3E5xzs:SZDbaCOIMjOiE5xzs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000221537a85ce5f07a02b1001e243959148aa729c503deba2bd95338373b7c7e69000000000e8000000002000020000000ae29b1e01622b45113ce8eba9f1fef0e3ea8e815116b511cd45493cee6ddf1ee20000000d5bf7a3a3698b38bcbdc17db85c99b48758ab4fa22c25e5900540ccce4ba8d96400000001a743c7042fae68e0842344deeed0b2d320cfc51176143b62112d953675e7bce087d74f9e14c6f6c3c23f2f8c459af74c763af85a35eb625b4f4bd4d7e6adc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000feb6bfab18b2a250fd3e942711ae561ab5522a36a52e78c3a06ddb344a43a51f000000000e800000000200002000000023c4ded38807ab8091bf1e3e376d97ac349a22fc56db4f10ac9095d1d37cb88a900000006a04376426f93235bc1d49a54525a8e08b2a65e9a7aa7c36f35c8a918370014a58ea81e8ae9de5dc1b75814f7d47421c34f16aae26114083a7a119fac049611f8aa116e0e7b7560589dd887dd620065fdf7719ca9c557bd229ba9134252de701b66873c3132c790b6cb1a3599ad31932919607df4bc8081eb59d5ff7dc84e8a186aeed00f2a1b41700c9de6e6b2509e5400000006d7179df6924ba6a5f1f9bb0ca974fdf4d8d3275a39da4ae2339e0e200c301bf259cd0d6aef7cc5225e2825f5de28e753e7a5907372c657ca7b7819b63faa1ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8BA57ED1-F409-11EE-804E-6E6327E9C5D7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408d05621688da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418565102"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1692	iexplore.exe
1692	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2992	1692	iexplore.exe	28
PID 1692 wrote to memory of 2992	1692	iexplore.exe	28
PID 1692 wrote to memory of 2992	1692	iexplore.exe	28
PID 1692 wrote to memory of 2992	1692	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e2726fb76b91990b1ce6a2f2e2a4fc49_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f466bd4078c2c28e7f720dd786397127

SHA1
1158fd8501d855beabf026a74da54d015dc456a1

SHA256
1d637f472f8e2fde967c56c2b8b5066b4aa9d2a8ebdaf6159b527cf1219d0b64

SHA512
9af59a11f66c44ec5abe95c123c82334ed5c49f8c753579ac9d34ff08969ac5362d19780ade91b6535a874e11ba253adb628e61531495702ba06bffd77c0b706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f72cfa27c32aaae8704369b49e16a17

SHA1
a3082084d628b986025a06f0d615987c4863280a

SHA256
6b304b22c960a8f29e465e549afb6e3d8b8b89dde5be71cfe2b91143357d3dfc

SHA512
2a3997625c7a3fd978233c4e8f85226021cb5df4eb2d64b9c4a7ac4f40d590c4cb66338aefb50402560fa84d06d61918eb7afe6ca5d89919107bba277d7474d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27be61c2458497506ae2bbf83f58f96f

SHA1
41dc5965a1777d38382f275e9607176a5ef0ce91

SHA256
83d71ac70575cf25e55450639ac860367178400841c38a192b262b645136bc25

SHA512
3f87c443d8147332e710a012f8de57f782ee32fd5b3c415eb4567e5d0bb2465a79d981130b0fe708b25c0d045a549d6ae83aa0b189224cd5d8d61f3249730226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76edced8b5b0c9d5ceb561aca4c706eb

SHA1
762a32571c1dbd04343713182f3c2655f582a2a8

SHA256
9306ee3b966db40457288f40e5175298b6c37232a1bf92d8dd04fccf4eb108c0

SHA512
b6b73910abcafdae8753a53cfce30d34981cbf37970e1808598445c953e2ef101a639445922a082f7eb9a38478a87e9ee72b1f076b7c1c70bb5950a4c6d833c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f65d3e127f199e31229de2362ca9dced

SHA1
aaffe9fc54c1e96f1fecc106a490892f78000d8f

SHA256
de03d83a8af8e33a2b9d32fe4f8a51c12d6dfcf27a1843717e79cddf2bcfa2af

SHA512
c4ab7c40329ecd5e5d97de8359920aaab822403b3da348833eb9c5068681e4a7dac91fb929da29b0213c86a932b804bbe1556f4ecbbbb36ab27f97f5c54ae787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c77878f56c8cc93522b87ab2f5ea606d

SHA1
a89a12bb6e186e801b413798013a6a4b943af5cd

SHA256
bf3875ff70f97ac5723974e83855f2fc6b35baddd581e62d5c70ecba1a3318a9

SHA512
9928815b66f6686278301bfb77db4dca0ac03f9672c0ffa338f50cf3e2bc4b585e58b00545cf525a2508c1a01ffddf1b10bfcd8b1656dfaa94c58c8ecffc5817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac61c810e576c577e7973595070e46ee

SHA1
a85ded256f4b43f4a971bc4b71a5841aec04f75f

SHA256
15892b080519b2beba0ee90c815da34e335aaf26239e5f6faa17dede7b9ce11c

SHA512
550ca06acfb92bf763621cc4ae77eca8321f110d3300447be7efdef2cfc36d4825f3d4dd0de0af63138cb0416cecf301250c2cef2574eda34b7e6c6ebb6519c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59997ec43d564641053a26e7726bdbb8

SHA1
ebceff5db3f7c7b69fea4cf6132f42de67530261

SHA256
6fb0a3e62d668cf4f6730bcf4e23049f4c4194fe6d32224c79795fa4c948315b

SHA512
54349c494b332178060e180e6e74e7a5796eb99bcb9b9353e9c5dda6ae94c3ebacb2a721a5428a25b4889ca0e42f2819e8d6de53b3bec9c766176348ef147104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc2c62b99c9fe5bb8bd459649338b36

SHA1
a6bd635fb609fb84f53abd656dce835ee1159404

SHA256
2be35bb1c5c1ac309a71b9458a0dd05261cf10773431c0eb593b8825f73f9c91

SHA512
44c7cfcf46dcd8ead4a9dc1aaec8ca258589f8b3d7e4031e00793b3d4dac56efe5d06ed40cfeb5b7664a241786b2a380c83a2f01adf20079754c274899a52457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d4946c8cc0b57d5350169d1c4f0aefc

SHA1
6ea8e7962994fee453ab8d376bd03fd15f8b04a1

SHA256
d969ef8460e1f1fcf638137950cf25478b9f1c1d78767fd80825a7dc279997cd

SHA512
e850cc0ef1eed9f64f23ca4819c6d6d15fd7c2e9718d16f43f0fce5513f96a12839be0c6a26524a3d2f91a015d9c352f1ab60a18a9bb8db493e7ec6c86f5992f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df755e8c46c8b931e4bdb07b0b8144cf

SHA1
daf204c96369b7a098b8befb1397d8e171da5526

SHA256
29c74ef6c71dabb73fa1ff7b7ce01ac56b4c50b748ca6b33c80b2292d646b8dc

SHA512
8cfd1afc11eb430b3e5dc31a70e5f82a21525d85edc8d71bbd3fdd744ee249f86a0a70adb954d5432988b33b470cf6ee2de8b2f5f35ebb21e6446c976c2c28cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7096.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit