b98dc62ddf9a61be503744d0dd694bff9a868103b22e150dd9e76bb60d0f5b1a

Analysis

max time kernel
128s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d1e1f2a5eadd6c689ba8f4e9760121e_JaffaCakes118.html
Size

144KB
MD5

0d1e1f2a5eadd6c689ba8f4e9760121e
SHA1

bd94aa35bd321aa20be4d1230db67bd3f277f819
SHA256

b98dc62ddf9a61be503744d0dd694bff9a868103b22e150dd9e76bb60d0f5b1a
SHA512

e2c4d37ca5283eab33e064aa69a5b2987fae1c466f751d90f65422571626b23bf051d810f8dd49b0b669e0b3ed757d93c86098b8b9e539beabc46357e9c62d3b
SSDEEP

3072:JHHWsSxUir+xmfuShT1Y9/SeMBlK4zAzt8aNflWtWysiumCUW72:JHHW3igfuQYbt8aNflWtWyvx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EF5C9A1-0824-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420775538"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d1e1f2a5eadd6c689ba8f4e9760121e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d3c7aeb19f95f954b3f30ab207053adb

SHA1
5d66a51d706b9ceab014c9d8e8ca6e73a7b0d7ae

SHA256
8a2bd84eb2807520fc38172d34b0e560435630481f3d22ab49fb4ab811fbe3b8

SHA512
98b40ce7080fa355182f8151444957bf7180e521274c54e4def1a3c376f0fb04aa7d42013ae976c92950664e902639d4ed75a71044583268fee38271c5beb8bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
533074275f46f6d4939eab9ae49caadf

SHA1
2cd5c76bd784b8cde0d88a73db23efdb2b49b060

SHA256
7f5209689cacca52ca9b53a29af41b4cc441915ea60f20cb863cc7253d3082a4

SHA512
de683e3250a2038b96f54e583f984fa08c5f59e9fde71ae3b1a880095a0b1862be1d3acbdaffc6ddf70ca82d0fe73f5c1d2991b5b48c66c1ff03b5f99a8c0587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbd0ab38c58da741c5517e7525067ff8

SHA1
b480a8a0635655dc26c206f934089db377d373e4

SHA256
37344704bdd0aa0aa5eb8b31c24d3b5e13f71cca29281bfedcf8a4ffacc1a86f

SHA512
80c10dd5b36912398ce13198f6280accb6a452dd366f340d5788f63986f253d0c580d6489f387e36bda71eb9d033676035eb66da7424b76e07d3146ba51f2704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b6d62ebc8e56925eae223e5bd9a6916

SHA1
11a3a8737f1472c90334107a258e8f43c03f91f7

SHA256
fd64528cbaacb4d41b6c1f61cf3d34a0a071f9850c8f564d246c49f5d54ee10d

SHA512
15c4185134f7c232b351b79435b4663d29e864000d74530e53cf618a71742958588761abd30d878e58cb44861a55e3d6c3a5c2c2f4e227bc3701e615dda8093e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed965680cd3662baeb0c964120716b32

SHA1
4fe612a97359d7aa5eab339c38c55d1d4a4e236d

SHA256
d40a5ae06a9a02df1cb37c8d9a9db697bcb0dccfd01a53631478ec96db68826d

SHA512
3fa6e02b9ffefc90287c3322e5fe902d8239a2c07d58ab7a0ced5f3c3d30011dab28c5519e2ab53cb371f847d3a5a9eb360736d376209578dfa18577f3d30008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19cc58db834f02e14bdc3b95e68e1a6f

SHA1
b066a41844b507df546ee4fcfab3946e06b6f258

SHA256
9020b81b71b296fbb829a45b2838d858443146704bcc477ec352043552e16626

SHA512
f4065a3809e0d248ce5e3e42df998664653bf9d3943ae1bcc8de0505b5720c62294e18099c3fafbefb7a6275cbc301e9260cd4b2df424bfd7d7f26afdd850988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
640831db1830cf7139d94e91b83c392e

SHA1
16561afe0bb9f47065b474d667b55c095162da00

SHA256
8b9f1ba8bbccee780fdc6e13308f1f3721e601c0848e5a2fe08428063f0a3b82

SHA512
72248a81473e8e006d9362abce61844a984a1f1e4e78d42d6e741d9b671560d4c2ac4e6e193cba0eb0ba41349c0d174c76ca813d8a8f3178c6fe060968118ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17e4cdd5434fbca6f1426f0c1e9ea57e

SHA1
69466deba09dcec7c2593fe9b2365c0e2bfc464f

SHA256
3e94334c0db2d16d4895075305ad95972b9e556ad34aee5812a40ac1a4cbffdc

SHA512
6cbf0d4e054a1d3c079824e44a87cfeebcdf93b816d8d32d92b20466a2e9427931b99a6eaed4bb9c8a7ea8c63036e0a53d269eae2dbb57fe4c98f08c77f0f9a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
247e24b53041a786214cd2c25cfb2b34

SHA1
c06b373cb96d123aa5bfb818e5e2b73f510a9e18

SHA256
b4008059162f38b0cd5128758d1c0e2eb2969cd60b86cef20ceb895f4bf8efd5

SHA512
84890566e2fabf9c91f3287f275ecfedba3a6c3215622933b15e309effd1e5f2b8752e8ffb2c81c4d83b0699ead2f43c4d2439f0bf065eaa7774da76c090128c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1edcdc66e63a35ac0055c4d0a93102ea

SHA1
ac5dd9d2757425a8f1c306603518cb47431deca1

SHA256
396c94e4f20e197fcd97b12e64de7829ccb5f5d356cc905ecd50e417bded6054

SHA512
e40c1a38f7aec044c78938c1033da091f3c9731689aca13e7cc50c61b4e7d1e83407ef9c6ccde91224964bcf6764bdc88b2a7100c91420f328f5c5f1c237b0ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15237d3fe07f1c413e32b8117ee5cb31

SHA1
f786c1dcac9fb730bf5f6b27c548efd764f20cc7

SHA256
064aae171b15c87ac563d954729c52e07940fb1d6ab255d35222a247cf8fe096

SHA512
a6d54eb18acf711bea04a86d6998cf7e057d16bbfc40c587252072f4da4cb96f1e160f4ef4968b3a46104500257bd57a82c2ed8881c10a4126535790b1599cfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4100b4764635b4f8b36335b12a699a7d

SHA1
8c40ea3934f062523af1cf53610f8604c53ae7ee

SHA256
92a95838e03dd7dd2447dc0b10f08d126f7a1aa89f596c129505ddbea7e57cba

SHA512
e9c1d8d5711af710dce72ba7ede0c62d2b37fd85e6049b33d66aea985b3f59e4f5bb0a863d4d1e4a83c9fc958044b06fdca0cea7d5d63db1cfad1f4285719d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93f6986373ff486e993a3904bacc00f8

SHA1
589e43eb2e1f36a12222ef8df3ef6e5fbf8687b4

SHA256
63bf86fc9519c65c0302e2d8651d2a105d75ec4e2c7d14b3c5a25e04db337008

SHA512
d84938115e97f6c91f859241cad01e31edf439177e48ab1770267889c32fc4a60b3ef342c9a01113c0149558168f88ca6c12ecc85503af0737f987f4bb77d349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47769730b6fc1622899a0280c2e91c5c

SHA1
9e056df3b60c3644788524ed0fb18ae44e693cfe

SHA256
13473091fee367829c2be438b86ee1a218d9fcd30012c3a569fc94f31e726541

SHA512
6af1e3ae7c3649f43568608efb57e4e0be105a16c45b2ba01cba91b17fe5c9fe70f230e045ad0d74c01b1518168b8c45fc815b53299ccd1e7ef189bef98241a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
088dc8ae45f7f7909e77c307dd861af3

SHA1
963309f8bb132ee3d7aaa0040715fd07b1edb256

SHA256
da194fdbb2f06ab9b337e7645956ab50814a5693c0615f579c16e55f72462a19

SHA512
e01d9433b3217e6ba659e240b6e21596f5d97a923aadbac1747339c86f28f529f49e2bb7c4cf487d815c1a2b7303bc34dd6cffa5bc90935034f2ebd11b481c87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JB8Q1DZR\plusone[1].js

Filesize
54KB

MD5
fb86282646c76d835cd2e6c49b8625f7

SHA1
d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0

SHA256
638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109

SHA512
07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab392C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A3D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar393E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A80.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit