84871856c9e2f8b086f4bc5c27d2d663444e9ea79b88e0e96dbf09b16b3f95b6

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e416f2d06e62890aeb3e7f8fc6cadf4_JaffaCakes118.html
Size

51KB
MD5

0e416f2d06e62890aeb3e7f8fc6cadf4
SHA1

73365821eaf6b5be2c8e9dfe8d109ae04a2fff63
SHA256

84871856c9e2f8b086f4bc5c27d2d663444e9ea79b88e0e96dbf09b16b3f95b6
SHA512

c25776e69124416272e08b63044ca5c7a8cc19b19ea7c6b5d2238e26b3e48930c3f438ca27f879561a0af1624b12aa77e72b2b45a3d30051bedbdc9c1101c4b5
SSDEEP

768:SnYR49z3ZNh7YsxuaFvG/Es7nmu4eyTP9BzTJwLY6uwjg:Snl9bfisxu8kmu4eSPfiM6uwjg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1034762d7c9cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009fcecf045bff21ee6fbbd88a9883f7f3784b584c214b587baf716927c4ac1ad6000000000e80000000020000200000001628d381d972fcb2951a5b97230eb300ba6b475722d1ff1c8ba5b36dd8fbd94590000000cb3cbc59e27c9b20f8ca7c5a57efea0250e9aec8a7b24510706d24d9da8cb0cbe61134fd19923afacc3c719a7b19ba9510551ee98b6a67176eed0804fe3c173009f686ef21e1577ae0b3d88d71d7a7c5f407a34663d19c26652229f366e41e0499716c0708c40309757c7d26cff8738c288985beb0a7fd8e1e6b4dc891743068b8aa17ef58cd0628d253dee6600c3a25400000008ce29247364ac14c7bd5a54a184e440b166a111952577e331f7a7ed3e920eeb3250ff9f0e60a849785b500e608a4edd7de4e528f5401c439b62db0ce8dfc0320	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{586E2BF1-086F-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420807847"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001733d2e67112a23535ce55aa493780d5a572920dfaf7d730f31b9ffe8359fc3c000000000e8000000002000020000000158241a61661274642fcac7d0f50a366b92af655c387a8459e1693b1752cdbd820000000231bf54bc3cc6813bfdaf260f73efb46c4a32c001ed6c59179dfdb8e59d35466400000003f2086e4a1e53d2b98d04275b0ba4f552c8404e77ac5d6ff1eb90ceff61e35c8328db1af89986e28c4596cd3edb758f607cb13a0946497d55d8770fd9a7706f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2504	2192	iexplore.exe	28
PID 2192 wrote to memory of 2504	2192	iexplore.exe	28
PID 2192 wrote to memory of 2504	2192	iexplore.exe	28
PID 2192 wrote to memory of 2504	2192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e416f2d06e62890aeb3e7f8fc6cadf4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c9943cdae2097c20b7d38eb7791c2b3

SHA1
48c79ef4e10b1904a97b9356d79273ac0fbc9460

SHA256
8cf4fd1b5d2342e8afd8b6dbf765ad47abf463616d3e559e1b3bb0cf56141ad4

SHA512
602fbfdf32ddabce723304c2d93e8898b42491fa10eb7f34a88cc4394ba059204a496421a6dd7f2c8b1d160c5328e534d793539b65ff13228e46c8a72f049e1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f11d885dec9c9b28b26d799211688aa5

SHA1
fa49be9ada5e16fe8dbe7142a8ffd8aed448d4e4

SHA256
ed6560c6f16a09759acdfc6470645a4cdf8d81c4c9a8a6c566040e43a54167a3

SHA512
7402cb9a097996a6f2f2b537253c6de197435d6d7c791ef43578215768e8f00166806064c32b471795c5347ea2ec8322f84cd3ec21802cc7c69444c66c005dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c89f8b5e2ab2375832229140d8f3a19f

SHA1
d5b9a0680404c8b71784d1accf70d254031058d0

SHA256
f3b4fb8eeb49f08c35b4c85dcd797d076c393cd794034f14d6f4f275cf8bb344

SHA512
61ea9f4dd629467747c778bcbdcd91e4631064781b4a4df699720ef3e0154ed1e81c922d8d0bbdb6565225d4fe029e1e80fd370c5e4413608344ca3548adf1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6229693891a881a85d34d199d5a230b0

SHA1
2070fbf10bb1a3da49be3d78da8a44291636d333

SHA256
5145be68195e17886033887fe49566cee843aab9e590d7c5a831109d9eef6829

SHA512
0eee955ece434c65051f872a7aa1350e85daae2300b027db23908d54089da3d594272cf57753ad93eacbe2c59646e48c9b21af0e3291c83d453b9f67c57066e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2644abaf0e6d791537ffcdc8db83619

SHA1
5b26b471740e8de6b5c9cae9147f14eb2692ac65

SHA256
1779851d98d3fe5edf172a0e4278c41e1b5ba4c550f2e55b819b86ce8619c792

SHA512
dd59cc688711ad44ba87712ca33fb9bed99f1c05d294dbed5daa0f3a8dfe2a259ca822d5db80c23203ea1602bd0efd876e1131e538e153075c1dc497c7d9948c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f313c57a30549c1d10341c53a100c919

SHA1
a84488b39e2cfed764b4bbd5fb7a513e105fbd59

SHA256
28cdd3a9ffb920d412011e4cbb49794662416402c1cafda2e09cac4da2b26913

SHA512
cfb6abee511ecdf422517097ee231aafe8d702f8fe4f79d8dab95d3030b219735541e87ba3dfc2bcb30b3618d576394dbe58405daac499fdea0bada4da599442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1cec316c8f4598bdcaa3a925b05ff9

SHA1
4ba2fa552590cd00274ee4331c1166e560b3f149

SHA256
1f7f0c9f01dfb31f4e39b4647e0c878bf4a52599937b559111ccb7adab250626

SHA512
19306226be66410bb72c8b3d717f9b2a6e46a8db9e7dd7d2c4938560aa3b19d71147ab7490d76fbd7db5b07880f1eb087e305706ea252e82d28c3127a39d91a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8977182155718565768735ed0d5f9496

SHA1
575500c6b4299d352e7e809ff8f444d8e5b93100

SHA256
a11bc1b82f9ef5272ca3e1a03093612dd28d99b5450bc5abe0c648ffabac380e

SHA512
f02f08bc0986975ca41a9cf6884bec3fd7afed3a93c97455e4979e015b46ab7b9b006ebfc766e077c449c146cdecf5f2d8d89bd176b1b7dcfe3c491b0ddd9312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4932a517a51d9261d8bb142de115e9

SHA1
36f0c4edc4ce7d800145bb60577cbfc4a952242f

SHA256
a9845a4775c22bf88606684adcaa3e39e03810d336e7d25b157818ebe8f29948

SHA512
0166d1889c642388b1e3d255298f3624164caecfd3f5ef8ae7dc35e6f4b07b3f066cedfaa99c97b4894e2801431f9d4056332e82e0ccbcd85b888e42c638e23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23c58140a081e8fe4cc99182ed93e845

SHA1
fb83e299acdfadaa61182ae4ffa4a6c07873ed65

SHA256
f69a1ff3026ec8baba417a71bf9db08875fb40cfdb4e2b9a17b1219b43154d64

SHA512
fc6c4feab6d8a967c98b5e84ca8dda40081eea420bbc4276955289f14dda22d670f0acfab91f88c7bd0ade4034cd11821e28b61858115c73a1e00e57a5f81e31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4d5a8ced3d55393a3fcccc7443057e5

SHA1
0f9d28bd1806a5f486c742326561d04d3f994ac5

SHA256
b42f2ee83fe3fd77105ea4233c3fa26dc6f9e4d70bd3fc21da2acbc6b3facc2f

SHA512
8a96eb5df32fc2da373fdc7e883ae8f24dde7934af32df8635f5c88a2bcaba56ac3be7da5b3f63031aa2b556cd6019a839310e04b10a56992367f86e90ad8628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c1b06aac8212b01e46a068ed5a5aafd

SHA1
4a9e4163ce7a73f801b6c3b42bfcab9617fa322b

SHA256
3de38821c73d6cd947577d290db2f0b20cd661d58884766d588eddf4707155e8

SHA512
2aa8081287f500197030645d2e45fbe47c0f6c87770f748037ffa7a6d761f9174dfe189cad11a5c683522e58e50f74cb76ecac05dbbeb418f1694c0e6a209981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d0de6f3d337eb62ddc8e72cb6d7de91

SHA1
1ee1c71669d4483e4a3b0d04b34cf709f30cc88a

SHA256
179599caa45605ba53afbfa6af4e7413da62bf81f55a6c032296c05fe627c4aa

SHA512
88eb6fcde79c9fa3b12018d26fd235a1e3fca53d6d42b0ca47f7acac97100b109d0b80810101cbf31f12a10df1ef04bbac25d6827155bee0c2817db025931d67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dabf65b42322f1a66a7563807fb97024

SHA1
b4c5d9e1b4c3a7c10a44c75b91f1b1d105f1f40e

SHA256
4daf8469f8aa94426a139a2de176d63ec18a8df058075e0fcd207e8ae878bde8

SHA512
a8f6858627f5744dfc5339883a8c7e3a207f4bcd750b850cbd7d090906271bda4f94751601a8f82f405523ab5c7f9d1b8ea9d7810c2046998ae576dd2ab227a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de3a6785e4be428b1c00e16711d5185e

SHA1
d54dee2f49e429d90ab03b829f005c902abc7fe4

SHA256
128ca9ed7fbb419305b096a6015130d9cb79f0386b63b46cf54b62a9679f916f

SHA512
37a844e9f4da932d7314f0e7fe05820a17697ad6aab985b1b3b9477f633b15b83e1ddda16e6d504e495111603de087e90302be0076f1d2cd51409a5a870c3bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e519c8b3cf4e28646b66a991a1c37f6

SHA1
7fb032f7633ef2f677cd564d03bfdffde511a184

SHA256
ca6e94dd84ebf59e823ea72ec1a58eb0e0c19297bfc5b467832f8c1a3826e402

SHA512
de8df0261c45d6714629d59110d2aab06d127f35925d22bd0a24303950ad3eec675936f0171a1d9987b15dbf9a9ecc3cae84862b0335e809c4fbe92ea834e185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e591c2ad1df7914f09d725b10b37c156

SHA1
50d5770fed36b44ce5c5e2040fad0ae021e79dfd

SHA256
8d27bc0b47b1685ff0c3a8f5d0fbe2cb05148746b8d1f5544f6bdbfd90f361d0

SHA512
4c2dfadd1be67d6acc67900977c25d49ff7ba9878724654b62723ae668f453040194ced765ddaa489ad5bc7e7f0816645eef22c3e1952eddf25fcf8ed77e7a0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA46C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA58D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit