d09d64ed0e3fec898ab4da72428c20ba5d1c75e9fb84404331299a7bcb5dcf22

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0162f4132165bbefdbb6dff9ebb1dedd_JaffaCakes118.html
Size

460KB
MD5

0162f4132165bbefdbb6dff9ebb1dedd
SHA1

b53817f560315d66ac8701f64238566e51f40848
SHA256

d09d64ed0e3fec898ab4da72428c20ba5d1c75e9fb84404331299a7bcb5dcf22
SHA512

3cbfb8306bbb361bfeaae52a83bd2d71fb70a0d23fd27ed9c2a209b158f1b26ba3540f3be71f365b5a4eb346d864878bc83d1c765f3cec0ab97824ad733fd3d3
SSDEEP

6144:SLsMYod+X3oI+Y85sMYod+X3oI+Y+7sMYod+X3oI+YLsMYod+X3oI+YQ:e5d+X36F5d+X3E5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000020733e37c5ca1a0cc7e1b8255014500fad474a029b3e19e667a3bc66b1a65f4d000000000e800000000200002000000063d7c82b0d175fde2961f021893c62df8399f636b9238328603b412956312474200000003a7ceefd22c4d00254e2f47b9928873de8574b9a2b28af66a1cc23f9d4ab4b0e400000008deefae5c33c9e9f3030581f466ac3695ac6295f2c9946bf5417808ac700acb334f61bccbf85d279b4b4882b202e34431f4453677b5c071daa842775370f8d3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6018CC81-03FA-11EF-ACCC-D20227E6D795} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e084dc380798da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000cb585787a8dcc39358897d7be92849f9d518b25a83b234339a9069563c444456000000000e800000000200002000000006c9a3ba6d40fb0812db0e7873363450b841b24faa2534d12c5a5b9293ed6e9f90000000f39f0eadcfe45be784636606b1a98037a78858982163c78455af00e048bbeb67b83eb1ac03433b1543efeda176a07edfe3f3f6da5d52817e76e50fc84bc29575dc9605ed96bbd1f83b75085fd7edd2976de8001b0242dbcfba6d6f95dee6e4abee759cfd1ee3eab1f14d0c5b64d54c90725bf0f7ba7619b6b9729760a36aa66a569c7420f5be8fce46511ea43fc9470a40000000f1b0059126760bfbf396ea943abe542d247f27a688052d502bee8541d15a433687fd5305089bfeaf24546aa26d6c544f98c93b4c53bc089f14cd7db1862869a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420317807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1280	iexplore.exe
1280	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2492	1280	iexplore.exe	28
PID 1280 wrote to memory of 2492	1280	iexplore.exe	28
PID 1280 wrote to memory of 2492	1280	iexplore.exe	28
PID 1280 wrote to memory of 2492	1280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0162f4132165bbefdbb6dff9ebb1dedd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63bd0932fc182ccce280b7d9a0fc0789

SHA1
07e5a596ccc8cd5d31a8642e1e77039aa2630b4e

SHA256
490b00f491a82641b347fa8a6753c4347a5546bed72702ea8882826e76c48e93

SHA512
8deb0d472fc5dc1b2a90589a0d01369cef8c8715ff7cf29fa46d3e3eae5881d1785e654a1cfbc4296e94fca8a9727138c45562a2c712810551a64a93931e32d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d31a12ac7831657dace0053fb8e479c

SHA1
325dcdf695c9637a892f87b5336b954a9ad66393

SHA256
6598e1b68f9a4907be3a4867e55a9b456da59e615a3bf1982372419ab967b841

SHA512
69619f3f5e2e582dc22fe4248415d36de27ec9e0204d5ba2c5a2a092bde875c04582d55b74a3a575af619b76cf19b8751c96458c3e59165ff31e0fd3afc40b4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf8f37474f2c564e2502787ab6f37b3e

SHA1
78270f5d0f21faef934a31c5a7be1a6282d396c3

SHA256
c86e46d1074aa746dd388044d6de56daad10e4f5502825a406f9a3b1dbf8b67b

SHA512
725d66db64997b2e553fbf10f3f5d01af12ec5d52316a532291ce88f97b8fbbf9c0d4f94c70df4092bd660d79a426f63cfa1e7808a0a56487e1249acf235fc2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7daca6f1825808fd8241994d3babd25d

SHA1
736679cbed858629a8f06d234ec38b8fa1b68da1

SHA256
668ecb8303a40ecdc700dea44ce917d7fd41593f6efa5c744e7909c8062ff33c

SHA512
60797713018fa144db1abcc7890052adca6bdd29a47c726baf96076c6350335010fa1eda37f0148112f003ba3f2ee920fff998d2553caffa906e4a20fbe2f814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52fc2cdebe1100fb555b5e46b74c7623

SHA1
049ddbe3f6d484ae8e5b568e3c5660b790a5463e

SHA256
f06c0b9c4b4a5c63f4b49823f621bafeff41788bb624207947cd08c179f722da

SHA512
2fa91d29366493f56576d225d464db2837d7bbb421e43a4ea3f52e62685dd6c6964cec6c7fee7ed13a15966ca6a43c3ba05df9ea559b580c9c2d6bb40bd0f191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb0453562adbbb59429b6ddbc215d79

SHA1
b9ac6b95b4e008b6eab7770a7b1fd427cb971367

SHA256
2b27dd11bb642163f4bcbbcf1e913ef861653ab27451846a0eff4a0c513c02ba

SHA512
f6a2e591da8067828ece1c3ee15fcb3df972060a2ed8739ee277a6d70278f9c68c27c5dce94554ba8a28b9fe8e8ab6c0630c3aa15bb2e69ecbc129fde15e8dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dc11ccb7078fecd1eed7e03feb8e31f

SHA1
0e792b514aa8bc605d95599036cb732a8c89c83a

SHA256
9ca1c32f4e5f8f45c9a263b5f8ffd6b22ac511c675f41ecad2dd26c306b34269

SHA512
e5ef455ed8eb412a3104dc3ca9586dd1edc42fbaae6e0a40de0f1b15373720941c7428889adcbc7766902556e6c7cdb393eaaad400f46fbe6ee7bc22b5ab061b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1893b6fb63e4bcc9f0867f7cf2cfc1fa

SHA1
e1254163ec374a3e05bc2feff2c6a5cf6150b7ec

SHA256
f44f89e22fa158a0347ef87cfac9b14038acf24573d4257b2c6e910fe04a23e4

SHA512
d1619b8609797ebce0dc4559a7a35e778915c988a31b9ceb88a35205a4c896d456d62009d9320a75cbbe2f308e22a4b7f9dc93f1465d74a4afde733bc4288def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba125df211603431e5d154ff3b4cd7f9

SHA1
0148e2b2b827ffcf7b1e9b103ae7ff51f9c4e3e3

SHA256
3e8ff95cf5e6ad333104071f40a2affc413771ca5511d96543a8768add2bcad5

SHA512
80b15183e6e36873babdc9b5c8bccdeb9f2cefab228cb7f8cd6c841c1ccd36e2ab0360164efa1815bd35f86c58debb3c8d06f9452ab6af56f392ea823ee096f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af827287f46ba967223166d6b4961bd

SHA1
ffe5657398dee0841dfe80338f4b09650acb0456

SHA256
b70ff36909945635244f5607cbeecae1ec193fb60bcf896f27d8ba6fb0f01d7b

SHA512
c98ad8e992d192953a18c8ccdb95c6466980181ea3f78a1806d1406fbb41aba899ac8ee62903b06ad374c75cc9ea6517f737ab8a0dd2aa2eb045062545ad309c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a6f3d5e9fb055036c079dd05316e24b

SHA1
5fc94267f24a77cb041d20858f55a1f363c9b8f9

SHA256
d9e1512da43d206356506e85b601f8e115c43c55f9f27d7030a5f07e52c34f21

SHA512
5e1b131690df2c1629a0a95d398cdb8a277a7c5b89230f12492aab569bb0a86f79e74432ad74103925a0b1c88e67b666122d7ad17d95e2cace75d03e9a61ad21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b742299e73e90d6350171d40d0833833

SHA1
22f30dcfce01348b4fe06976f64c2a091e35e23a

SHA256
5cc8cfeca4894e4556945c1e6172fde3a8076e4c951c1e1eff5ba21dfed4eb29

SHA512
c1e124615dcee0f29ce15d1bab7fbd9c0c2ca8b370b86c393e060c7a1878dd2231590dc989d3a96190f3eaf47a9c9d10af64e8fbacdca3b93b503df352bb5e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab99B1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B21.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit