7cd3cb61165f16faf5b1abe922c2f3b3ede5a3b30695fcdcb368faaa2953835c

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f34256a7b5b821c965d7a67a8ccacc3_JaffaCakes118.html
Size

23KB
MD5

0f34256a7b5b821c965d7a67a8ccacc3
SHA1

5fe0a2bef8665036707e59f5673cfb9107b01397
SHA256

7cd3cb61165f16faf5b1abe922c2f3b3ede5a3b30695fcdcb368faaa2953835c
SHA512

06758c3993214f04c5954d24aedb93adb5c45cebdf4f81363a1efb6414e1a58311681117f29db0adf2eb58f20175ed5b431624685f74ea8f0dc48a0ee5583752
SSDEEP

192:uW/Ib5nT2nQjxn5Q/anQiehNnmnQOkEnt6YnQTbnU8nQhCnQttwMBBqnYnQ7tnYK:mQ/kPrub

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420856418"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C317DB1-08E0-11EF-8DE0-D691EE3F3902} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001e677a516554234aaa67e39185dde51a000000000200000000001066000000010000200000002e54b813bfdc2144285ec0511b914f7a9ccf715b1628213f02da65e30b8f4059000000000e8000000002000020000000d9b6731205892a72d09ed6309bb4972138230e0e58451dd88ed2dad9da803e48900000001427efe78784c1a1dc827b112e6316bd5be21c4ba2d177e869df00566cf7f9f0c3faa0a1603a3e00981f72a7d7be99adb37500cce5381f8124c2cab38ff582a0e22b08c7cf690234b7f8c0cb00929aa1effe7dc1112eaf8354238a800556b406e76f91c6e1f6c0d640a005e694b9fe3f7d8abdb8b19b9cd5b4a5181c632bd38df55ab6f3378724401ae7713a7f70b12f4000000085d756926858841d663fc6f85313e652f356477fe2c8715184203431e2ff9049690dd247b81f12c41c82d993f64fed24922ee29ec285549e39dbac7aa700c45a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001e677a516554234aaa67e39185dde51a00000000020000000000106600000001000020000000f3e96a5f155332c8537685b28230c79bca632047bf040e194067321e3c85e96a000000000e80000000020000200000001c6b660f5c1b03ea87daed78a5f7126ee078fb1f8760f9c9429d421d1fcb8fc020000000877d6a16c3a9016ff5601a16b906b5f0bba3a5e989b4816038aeff8a61e82aa640000000df21c49b95c9810b9e48199e4386c52d223b73fc277115863c255595a691a40273d4063fd4db6486e53fb5828fd61d282a79feff53ca8823cea6691ca746b82a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8007ef40ed9cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1756	1688	iexplore.exe	28
PID 1688 wrote to memory of 1756	1688	iexplore.exe	28
PID 1688 wrote to memory of 1756	1688	iexplore.exe	28
PID 1688 wrote to memory of 1756	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f34256a7b5b821c965d7a67a8ccacc3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
882b66419de4aa152cc1cdc1afe3727b

SHA1
ecb399610f9aba970d5f39825a603913bdead148

SHA256
328e832906a77d58f97266d719569d27bf7d98cee9077cd8607565e50294c022

SHA512
20f2ec920b8727485070c0c3d0e330e3572f1d2d293ba220c0b070bbcd9f82c1b903637853a8c09b8108894a2eb6d74b629c06f456df527f2ac560b477849c33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22959415cb4d1a83229bd7661d6decc3

SHA1
d6fc6d61338de1b5cda632829cc63650d39b2850

SHA256
47460b01e96578259616c66e64a9509ddd3fb19f54ea58766556a7fc98452aff

SHA512
056cbee68d1a04ca7b75ad7023eba5135bbaf9701d32b2a6e1e900001ee2fcf460623077f396fc40b98e4ef33ea7fbbb35edfd30acd8d0078de048b3b5d1cf40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a631bb11bd545ecc22c51d13012e5213

SHA1
c631d0976758d5ff4dcf583a79a48bb4a99613a8

SHA256
90780f5b6890e65f09b9622c177e2a93cb8068306f16e27c57f21178e4cb8bfb

SHA512
5af1b2e0c28842383575cc5c94518d3c722deed39e7c3bcd3b5f001a47b5bef35162de6022f19acfb8a088e5e90e3133b77742d19df906dd710806b13905cb41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7ca221f202a1612b140f9f5cb0def3f

SHA1
e8b2fcf85e3a03703e2ee8aef7613f616186343e

SHA256
f1a21a1a0bc1226ac05538e53cec9e26ff71ed1e69a88618d5fe767463a1fc09

SHA512
6de8efdd7f1517a5e752a714d26da6446f88c6fbd077c46c236e36bf4002e6eeb532b3a27c86f3b83b98dec1f74f0cff8a5ee02aca53962c1c02ecd85f19dc6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a094e35bc4acde1cbb26cd12092d18c

SHA1
91fa1e759b5dccbe47d952d6fe028b288cfdd748

SHA256
4e1e8aea6d4f9347e6ab5f3c3356befb14c84d342853a1c493d419a48ad2e909

SHA512
22a367518b3fa0c52d7654ff3c06d645049dedeeeed648d3e3975fe59c29165cfdcd6ef87c87051e2765a4383988f703419f9fee170bdc4d86daf8779280989d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9d35f0cfa656102448a3708394e27c1

SHA1
2712c79d37f0dc32b3fc3997bcf582b7f84ab5e7

SHA256
53a2c54b233c59499dd1ae3460ab9f5646cc4648a7453789ac201a7b6f7da403

SHA512
1e0091d1cbc2d617800ef6833f7d97f2ac1526e60ca0cb1ea809b328ed673179e05815a514ac4be7371de9a5377140c763acf866a2fe4d7457947ef61887b2e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de06dd2556bc6dfa9d64899ff8743eba

SHA1
23812a9f39160a88392586d8c940fe83f6998114

SHA256
d7ee924aeb123dcbd511a403d874771ac1210e705d9fe1d140a34e7fb10d3eb1

SHA512
b6d1550fc9187b91eb0c6a458856a0906d797e64fb5b5e073417c94438d1d8e8dc700c27bf095a89225ad59b32178f9a0464a12d71c001727578b65765b62d1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
343a3b4aac539ceb1267f27aff1d7ce6

SHA1
02e35d5b1465be36e1c1fe698976e1dc080a1835

SHA256
cc3ccff6efa069fa7d24f92f748245156737d157f654a849693f25c65ee7ca47

SHA512
f3507bbb9e1b6d8b29d118fda062d03c4fcbf46caea0936a69444aa4303aa9722ad85b5ddbfab3fc1f3e2fc79585f78a88b0b973f26665039676a194a3388f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdcb211f553e77ed88ecc413129283af

SHA1
75b7a6449ba56bbcaae1b8a62cd9c8be3f6be87f

SHA256
a71a583ff0f67159f3810d26f805f44adbc679ecbba1986c3a822ad02d7a6aa3

SHA512
27f662620273436feb224328dded3be309d78e1dcdfd8f82860954a8b06afadc2ff834258a61651048dd50111b25b5aa73669dcfbf80ae2add558f722c3d926c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039e2203060026fe1041477ba8296c11

SHA1
1018898fd1f5f6fff74dfd9637ea9122f60dc3de

SHA256
fc42a5dbb9d41fdc4eb2969271b529b922486445388b1396055a1a80e7655e84

SHA512
a7ecae7c8b85b20393a0054d2c0bd81f2edf55080a4847fd1cbe501002a0e3b236a3687f54658184f2be283325f7d383363a6bca57ad7cecc883094ff05eb837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
64996f3cb7aa7890c409ad0590966487

SHA1
088be2bcc34cfd175f90b219a169f94ba6da34dc

SHA256
99b8d6f185662c185feeeb9efa44306adaed1a80fe8abace090c71ebeb02ef4d

SHA512
9cb7f42963683905a8303aea1e1e8aae8916464727522b382de3d4f4f136ec8e8d4dbd8c34c90335237bc7949dce73bad7777eb76f828006973166c517057b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2330.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit