dd1dd6d13dd58e0c2c355b266a5b9b65ea096e090d3f80fabd6c37832b6e0e20

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe44b933f76b7f6adee6302764d1da38_JaffaCakes118.html
Size

6KB
MD5

fe44b933f76b7f6adee6302764d1da38
SHA1

9cf8843b87ffeb0728757172165180d053e0aeb5
SHA256

dd1dd6d13dd58e0c2c355b266a5b9b65ea096e090d3f80fabd6c37832b6e0e20
SHA512

3b2ef4944dc622bafffd8384285985f29da73892dc3494d62e4225f703fabfc82f71b3068562d00f9acd019a6067b8455757d20c23d5d458cecb62ada54065e1
SSDEEP

96:uzVs+ux7zNLLY1k9o84d12ef7CSTUVZcEZ7ru7f:csz7zNAYS/Yb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009d24252d45b14f277738bd38144a68d0b7e7af0462e3b26c687c9616ecd5d0f9000000000e8000000002000020000000047fdeaa0b97d159553c064f2f290ab70b32790b076714be8b092f6d539673f4900000005735c2233c94eb4006bf6f2a6be148b7c61754ad4478f5dcd376761f559a6f3f18ea101e060c1a7028b14a4755aed427963c0d81366b5fe665b98a92df0f22d1a06ef1d86bfc86970618037e14f2724bfb60751f518fc11e992b4bffdf6629100d0758fdae0ad326a528c9c09f559f7130c33cb31a068f2f54607559490ffc8b92e7a1e5440b7afe099596de9ce1be9e40000000cb53cae6d5543c16735cd23008d851fe954548d93e8171f085d27ddd4e7fce716a50813338cb6c0ea7079461106c27dbd84d6ee0a36072ff601b1dc3de6d3ed7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F98B0781-FF8A-11EE-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419830155"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b1129d6bd07905ec876b1ce6ac4fb38c551737bad127d5e1c8ca280ecbbf85c9000000000e8000000002000020000000b2ae90633c72608441fe4487285130b6d025eb25ff6e1f548fa397fbbfcb68e720000000d1ab8c87c3728dac4f450bfa3ce1a0aacb300b502da89ed3cfbf7bc30ee008f140000000604aa8e5e947de5fd205a733b32a821141f6cc4603db0776ef7f0893878a72111410663e3de900c64e92de0505b5027ea1849d249747283560253c302ccb74cd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f4a5d19793da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3012	2648	iexplore.exe	28
PID 2648 wrote to memory of 3012	2648	iexplore.exe	28
PID 2648 wrote to memory of 3012	2648	iexplore.exe	28
PID 2648 wrote to memory of 3012	2648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe44b933f76b7f6adee6302764d1da38_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a84421f232277c231ffcf785177602f3

SHA1
e52c4e748e3cbd1155c74dafdc201f5f28c73b76

SHA256
e0739babc8a8196d04762cb00f1f4ba973e9e6695bb127362440941b670fc771

SHA512
adcf0edf7cd45210b2d314c7a109f7ed8954286f1f1b6863131a198e71b05dca2b32b504ecf3e0be519d7de390635c94ec42733809abb61df91f675f1d5199a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e092e9379784d037aba237037baecbe

SHA1
efd2b7e1dbde9001c9f5774bbbd94b0d0fa44f3e

SHA256
3b8fad4638f196344db64b591f30059a5f457e55df77a1e8db4a0e569dd277b7

SHA512
f3bbe6029f50b5b9fd4f6713d8246af0aa13a4f3a3a6fb99c2445129588c54e763b1adb6f65b479be8abc3e8f46491a7fa7175a39cbdb170aa83c4c036eafbb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39325fe3a1d3aa8160c471c223bf33b1

SHA1
d817e68aed9ffbf5fd3b94e2e41f485ea7596e11

SHA256
356094710a191f518abccbfa5fa0b6735f1eb02ac7fe959849e11032a5668e5e

SHA512
28b7836de772049600f94bad99008603682e5e263ac68b31e26ca1648bb61ebda26ecb4cfa77d0863e7be871a802e08098fcfd84280bc0c34b69fce63d661ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85df49cc4f5ca5205d8c60b53dec636f

SHA1
ae1eb3a72d2b8bf4739226789b169c2b4da5ed1c

SHA256
f310bb1c22872b974ec24f7d3e7d8d4c151e3594422239da505dcbeda8f42395

SHA512
da26144e78f1030143fec8fe75fc9d30f3d8200f6fdd80f2e06faec80cd88db3d64bd7a7dff0cc86880378b2659554ecbdd821f822ad91f8d3b5b7bc08d00fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e73b7dcaa1ae3894db4f6d41535ea24e

SHA1
beeeefc1e9fb13d0af2cea3560ce41b1a879ae82

SHA256
577446560efd4b98b0c9c64eb86c03dc0f9e340ea06db5bf90fb6dd0efddd93e

SHA512
8766a26378a679bdd2e0a473f45e6357b4ec020aa14b1ad904eddd8c552ee5c3399b8c9b535b8d081109164a524941ab35f698a802347fd78a39cd5de144ff74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c6770d5253bcb5295422ff3656bc89

SHA1
34ae214fc68586f5351d3c54af70067b1c4e1a00

SHA256
3fc4ed42bb502e96127f89f257ea83cbf069f2b95ce7b2656f97f67a21885638

SHA512
1a19d82aa6b2324efb7ae7750105ee76a00541f6e4628c89941fb8be0ee5f8e705fe1243c13aee52de2f50f4b8a565894003f99360a6415d0d0fc8696478a26d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ec50188dac4be90e0dad93aff6daa16

SHA1
3d277ab9ddc7de80f669f08b240e40a1630fd124

SHA256
eee503d42cf4563b2f546168fd3d99ab73d749c55dcb0551c99031df4e858a13

SHA512
fd2942ebe1c7b8e4d5a42435f2df90a446f58ae0cecfef2b91a127840ffed4ef64721476b75d0d6e5f714c8fa1b002490ff89476fe3c5982d8bae8a3b7bec785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5679e3277e1c7ecb5c8c12cef92c203

SHA1
a388a7f0c6cd8c904a37fa21cce10c59b69dc2c0

SHA256
be7551e6a59791a99c646b52247188f0f6be9f390d3848214c7fc53176d8f3b7

SHA512
660491c54a022b114cb19c443b2b31df44017365b413bd7d08e224f12a0ed6b607a3a62480ded0fb4fa6327b4c34a1b078c22ec5bd453e0e5fac89e64b4626d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6264837324f235e985400f3f95979b2f

SHA1
aa1fc3bfa92be7f52ac57e2a32c3a1d7bf502c86

SHA256
32d09e4805519eb32490d8bf9b9cd6aeb633a748234873dc37ed30859af20def

SHA512
fa2baafee2c5fb8bf67000c1ec4ad7f45d7cc41e287e119d5963e0c39e61867c88544caf89ecf5990ba3e283b8ce363ccf679c43c50ce4cf73297936cb185ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d11e4ead13d2fb97c8e493fe9e27c51b

SHA1
4e34ef53075d795b4930e61c773108769d21314d

SHA256
25c770fccba1882d10e6b00796ee0e5894e30022c3c11fe4acbc5bf812b7b09b

SHA512
cb09c9ffad7cd41248e3cd928eba8ff22797e1b3b2b23b8b0f01ceeefdfcd829663c4073c576b8d3ac48c76454fe3254f65c4aaff09ff97b2cfdefad8afd2856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6ed056d913962cf25272d603c6f1ccb

SHA1
78f14547c79888b98a7bd5d68e0cda5074490a6e

SHA256
a9adcde399766ac70d8a80efb801d82e74cb51f51ebba37b9c410997b12d778f

SHA512
3656aaf2b563e690f8d08669967a55125810d638bbd6578498babd3897f15355f95adca7359c1ba1f0adae8bfeb934ed674726b69ab77ace46faa132c1abdd50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b32382f1bf96d0dc3f74142807bd9d0

SHA1
3e8657b5742dc67f27c8618a961f7afdda2ed05f

SHA256
82c736c7debdfe4d8d5263ac3ac8b429ed13d61755a623f1ebe5430961cf7695

SHA512
ac7cee9f2d95dd8beb27cacee7de4c7308fb675850dcce8e28e17d7ce793325f887b70aaa71a6d098402a54bfe6f719a68ad42227e71b9483601415212e08cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83573ea564fe071710a9d26915276ebf

SHA1
615a0f0e0476c179b31bf58cc42a99ebc3d5e5af

SHA256
8fb3d426738c85b9522cd7564bfef0d39f04f984d0fe4a954eee4b760f9231e4

SHA512
244352291f8a70e0180fef8faa9a3b2e65badc7b621e829cefb1881df9f44e0e448aea07b3f2b52b105ff7cb1db46466b3cf8947c2cd17ddf1b241116c191645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84da28356b6a2a8fa89319f47eb45a79

SHA1
83f080e3bc0d8b383c667c06877deb0ed832d1fd

SHA256
fea97d5892ef48647ccb46b721a5acc20a6ba295b905daed67e6cfe1c146cd58

SHA512
009db43ed344d35447ead233823627c7d6cfc59f3ad8e00ef057d8885dba3c2891586304955fa6bcfaa087e33e813f6e8cce93ce018bab74012b4d44e655e767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1cdc7347e8582efd0179a1d0e057a9d

SHA1
1b716ac265d2a68407c1b4b2985eb976ac76c8a0

SHA256
169f936e595e0669ff2f255c7605815d5aef7817dca499224be991b6d4e15658

SHA512
8dddd195c9288d840f79ab469250cfc0396a6a58f9e06228cb86c2a802259c27580c613956e8852b005a800552b0e5c1c03904494107e758cfa479d166bf2236

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC8ED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCDF3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit