cbd90dcef6be25eaf111da8109ae331672c9bff97cb2fcd822053727b984d7fe

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f08d2b860169d1c0d8b9f2e5a44a7362_JaffaCakes118.html
Size

9KB
MD5

f08d2b860169d1c0d8b9f2e5a44a7362
SHA1

67109f35fdfc780cf46565c4660adfef68d8abbd
SHA256

cbd90dcef6be25eaf111da8109ae331672c9bff97cb2fcd822053727b984d7fe
SHA512

08cac76df48241e08bb4873d933e932b8d7910ea0f2c679c6af1b390c2527ff4b54e6134a55225d9bca4f569a36d5ea1d32246bff8cfc08b847908b2696421ab
SSDEEP

192:WhsxnPz6u4PCEZ0CaR1kvcbRZy0cVsOjNtKrGh0+u:fr5i4mvyy0cBjo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{793D59D1-FAF7-11EE-B804-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000af722d6ed855a36a789e0818eece506e1700b3276594811c4958840430e79a0d000000000e800000000200002000000068b14b5e8e22a6bba191219c4b75a882db5b9d4cc50c09868829e0f9e3a2d1bc20000000bf06604b733e23907450bd20a513a8246a26e203b8c2f28e8f3a3ba597e50c12400000006cb0e0549a0997b48fd68395491607f14bd9809096f95c55edf1768e7670e448cbc7f0176640e5e85211e988792cbdefb702568b3cf43b17aa8cd5d5e7735f51	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000742bb10c7037f3eaa281612be82c15a089969ba66c1e1e61f1a29f76d6da309d000000000e800000000200002000000074879ed6fabd091c41b75266edc8bfb40b02b549b7015637ca0b9c9581b3ef4d90000000705a5dd1bcd2b66ec87f37c58e9a1cce48681bfc762df468c5b5ee94307e7ae3df28c671fe213e1372cc53c9bd92a126a953c9a061818216eefba3cc061afd942357d9df573c9f83e330f841941b25767d56dc2708613fded47475063b245695757726adb50d697daedaa67617e2bb49e80c185f4af4f4b7fdf09b88f4be4593e041ea4df0da4bc969a531d9555bdfea40000000b5b7db524995aba7ed0bf058197ae3a3e6d259c6e8842c044b6bb78edfb3dcf60fbabcd0159b28c1b0b9faef0ae3688ac84866d8afd83122680233d2346908a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419326997"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f25967048fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1444	iexplore.exe
1444	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1728	1444	iexplore.exe	28
PID 1444 wrote to memory of 1728	1444	iexplore.exe	28
PID 1444 wrote to memory of 1728	1444	iexplore.exe	28
PID 1444 wrote to memory of 1728	1444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f08d2b860169d1c0d8b9f2e5a44a7362_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb03edffd27cc8102d0726eea3093fb4

SHA1
0e7d8bb0421b3d35a625d730cf3fd173dcf41d57

SHA256
f5deeb7906cdb1e0fe86f0e8f5f8969a25361466eef77d27285acfef8f62b01d

SHA512
bbf59215a4be8e94012bb45e0e8ff31fda65e113c76482a780d0b78a7952e57a6cc1fe9cacee87a38fbc538a9a95ddb37ac1d18dc4ba7b13b4057df3bb4f7cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e85c51e4810e8395eb13c4c07796df9c

SHA1
0da565a08aa319f054c900f70332f16aca906252

SHA256
deeb682d923b9b7b76e0da44d1e8cb5852f4755761edad6524db7df4b4817c85

SHA512
f8272d179727fbcee2df3d01af41ab7b3531b216de50ffbfa121982ac34ef982a57425c7d9e62b1aa47eaa3ae6003ec0704b8240e8569ed4ad393c2e4e5f974d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2308ea8aa582cc90ff5572e435e6793d

SHA1
2c1c2f346e8318b3456c225af2211b8a688da449

SHA256
b3aede7fda149cdf7e961c3589c9dda521d91cf0f103cd7d64077ed059ea7aa0

SHA512
e4e40dd57716ded7f60493383c67dfa55009e40ca68a834653879d7e1d7f263692815088000b1235b4e5a18cd4d8899b47923fc9eee6d02011cd47aa8daa2658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
999fe54e6654721559eaa15ece9bc590

SHA1
9c57c195ab04714f37a5bd44d02290cb2091ef6e

SHA256
5db825811799fc83c428a6ee02e50f873657bd9401ee5b15510030e8b18ba045

SHA512
bbee6301fb69a748cdf4377007c93fc0c2c3a17101c50059d4f7f5bfc2529c386d2c216b9c6731cc9b1ef5b2d48d3bbd6ed42f8315c7c2695cde638222961846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0007d6aeef5954d91d5a06956a4215e2

SHA1
adca2a32ee7f6bd0df0d91e37bd90fef28def1ed

SHA256
a6b49857496e06a9f874317bf64a0ff596da9ef0ec27025e2774b2aec0ed6170

SHA512
10ae87d858198eb3e3dc566d6b8b33bd15858ec6ea73e7be06ad3e437cc38fd6e138ef1104d4001c972ae42269da4c8628e0c13091da0453d97295aa09d1f12c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b350c3070a0aae7942b644ad4f9131e1

SHA1
1d13121cc23c17b5fe6b18fdc11bf6cdf61445a3

SHA256
7d5db55c208c5ddbf304383e11baea9077fde25a912f070315495c4f5b9d99da

SHA512
ff8b82b0fbabc048ede835967a61d5beade627c688f3a4fc3ac825bbee693aaa7f54100422a30e5c3f024b04a42751ebd97fe83105431671aa400a0661f460d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fe489ac6199c1d3be7cc11809a20616

SHA1
39a10ad2f6a7603bce4c69591274b4044a48fe54

SHA256
509f30549d33f64c138ee102fb4bb43f0f1d173cbfa760447c99c40739a5f75b

SHA512
0b10b4c59b67fb613c81e17bf0f167726449e52f96134442ef19c28994b51d555411be39669a743330acbff30e25671afe1f88af7f1b9b948c96dc06cebe809a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ae2cabbb1812934b5680c94b6b385de

SHA1
375d7595f0309c066873536458787c7ce2c1c5e8

SHA256
ef26d307cad4ed18d05d84e8ba6a689d9670bfdd89c46d12afe14a4f2dda8ce7

SHA512
1e43aa713fad9bb6b5f93c68ac73d0806b1593af0b0925de7df930a317277b8cb6ab1c1da580f2ee81be1cf9a3c3486722f982ab432431fd3280cf82dc1623a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
316464809d5ec5693dfc13066a481399

SHA1
8e44d841de3cba8d79f32472b9eed399dbfbfa37

SHA256
7a02d1ae940b6024dc54ddd6908b219bffe28547ff669e99106be1753aaf035f

SHA512
95a3afa9e150c42b59292ae3d4b58f301ed408e9403605bc5d9caefac49bf5ba9dc1d011ef3e4957ce5ab1ea0a3e39ff4ba8231826de6ec65881ec4084f2fc46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee81bd448b4f88eddb968f1c4052998

SHA1
3d30a7bdf449b54dc71115fc1f1ca969b85e8bae

SHA256
7c7ff23c21975937520343bc2fe13a64fcdfe65d41ce90c314359ffdd1373e1c

SHA512
9bbd495e2a1fac77983fc927132028634a3cc891e8ed3cd07d63180783a6ec03f9522ee4716a498e3f8a5fa6bca562be38016cd4c291402e8855dfaa7154aa54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db95f9a8e1a8950c50efdc8ea013d5bb

SHA1
887eba8e99cf6a93b57801167ba4d44b0fbfaf7a

SHA256
ce10fcd894df9b2052e53769317d24b5deb76e932c40ff3b33d54f54162f4c40

SHA512
9f493a43d400ac62bfa3723ae1acf3b7e88ca807aa890075d6dea66be84af4d013579f40717dadcb73993810c39461e39005b7518d8615a305465e854c37a18d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cce0707eb0ecfdda9c06da03912f40d2

SHA1
bd8822eb4c6540904311bba26017b59c428701a0

SHA256
80f5c990663017f40ee0bf3d72d0494750ce97460f3b79a5d078235cbcd91902

SHA512
846998b3c6b5f1cf0996543b308751a1baa5329399b6ff01cb2791494c0f69e8286fdbf1a1a8fb6779fd23430df1a88b836e83d4e115e067efbca39504e62a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69d80d428a26ce6ed9f55ab093233fe8

SHA1
8c7a1f41456029949bfe431f3bd0df097049d836

SHA256
3720f68132d4d68b19d398e3fe13dde6b8eaf30cd20a50b403de71311b19461b

SHA512
6992f37a3af097c4bd3cb75f3bfbdb6073ed4f343081457d6a0030d07c80dc3b208fc5fb73750c2d05d5683197ac29066ec9bf225470086eb83b2ad9386ccac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f510010df6b535c58ff374d5676ab9b7

SHA1
6e15d9dce7fb67495a95920131dbe001f49a0961

SHA256
9d4a73981d52284f1fe6283dfe765369a6b4c2a380d01ef22320027db19c0224

SHA512
62b98f82ff5c5ac0fe214052674e0d0fd24b5c79041c4031bc8a36069c5622eab5e7d3ac58dba3cb4de31f60df80fbede2ce85f9dc70cbac5714e9cfec2f011d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9de78a9cc92fae82a32a8be51acacb4

SHA1
185460c1f138e5fb50ae8ed2240579ec0c4a4ff3

SHA256
f5c187de598b550124dbbd6fa5a424657f6f1bc2a40a80eef98441db98f61246

SHA512
8e2094eed14cca25e3f39dc363d06a81447576ac70c52e95962bfc159e9c910c99c5133e5bdd1b99e2687a12153ec0f443fbc531aff7ba37fcfc641e31b872c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505447872e521c7c02e9fc51b2a16f14

SHA1
da14e1ad259c6dcd328ae3e67b1cbce0f3456b78

SHA256
fd0308056ea6ec025ac74b87cdae4beb8bc8e66969f9db78dc3e962d86f3b185

SHA512
88943ee887ac96a3d275a4c2847be1337eda329d6bd90042df1d70e9d4588f324fe2884de956e3650d038803753c164236ec6a757203219376f471f89833bc3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e084e86acc2d617aff898243b9e4eecb

SHA1
1603d1511ceb66596364c0eeac4288406c448e1d

SHA256
40b9f157a54937a42002d042ecdf2bcd3b3515db283b9139c27f41630ff39ee0

SHA512
da17443633ca5861e1bf25f02cd19fb2412ecdea0f0acddaec39365945840d963ba18a9f4888ee89334a3b93c95b65809da89213c12f180335023704906b803a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC00.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD20.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit