78912b1254fc0f270761e1c64696f3be1b29e7b0ead037169fe2a637b8459e5d

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f39660747750861a7ba928a7bfa53ce_JaffaCakes118.html
Size

126KB
MD5

0f39660747750861a7ba928a7bfa53ce
SHA1

8ade5580d189308e7e65c30e8c3b0d2980545229
SHA256

78912b1254fc0f270761e1c64696f3be1b29e7b0ead037169fe2a637b8459e5d
SHA512

bf296e160601a0b92e423dfac2e587f94233db840ac2ddd308d834bedf2031cd8f35ed88a1c1fa23fc542ad33f3004e92a6b5100f512c8bc7353a4b2bd00b284
SSDEEP

1536:XmfIsGtnVNrmHejOBkozqFmJGvE88tnwHECO+rvCU:WwsALOBkozqFmQvE88tnwkmCU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420857175"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{228A2A71-08E2-11EF-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d0f511ef9cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a67b97937dbf2f80ca3fdd67ba4d92b5a9d82bdfbc82b3e6cb82ac9f67188979000000000e8000000002000020000000fc4cac8a507820ae9d24619dfe28ae2977e74de25fba9a56807d72530d6e4501200000006071b62200b121cfb4a3676d2b80a8a8d1f6fdf95920017707f4fb51d9675ef54000000004f2b72188c3c6687d0a474ce423f3e5d1f90951a84b5d8490e06c8e453c5259d72216e10760412c57af6d9f46f5afe7c9486808d2f4f5edb56cb163e345028a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003c9c1955d36d03eada585d0ffbd3b423973d7408a3536dbd40c93ea4ac9c455e000000000e8000000002000020000000fde24cb8747b8c606d935c627477ff48d273d51262bb6b9749d98bc75d99530c900000002352f8b92d61aa02c308d5cc587ec97199b1433287ac23352c29df7461980088ccb6b723fe7da70aebc2a9a750850db08b15db62ecde1de37e405d469df4b7c714b12593292ed1c7f282e5be9ea1db8ba3c85da67f74e2536a9a3380f39593758e0753c417d7a6125ca39ed7465ffe945a965b85acf1469fd949365849e2099a635be962816c83a01f7e16a9d3ac68e540000000103dd7edbd7ec585b6f29801271bc96c819267060c364b550c2fdcf2b27a2f0c0b6484443a880ba1f8d31acd3abd7890ab1a1001cc1df7b734aaf9e8b81877d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3000	2956	iexplore.exe	28
PID 2956 wrote to memory of 3000	2956	iexplore.exe	28
PID 2956 wrote to memory of 3000	2956	iexplore.exe	28
PID 2956 wrote to memory of 3000	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f39660747750861a7ba928a7bfa53ce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
23f42ca79afedb4145d3d70bdfe5ac11

SHA1
daeaba68f912f2d4a60b26bc1b01844f4e4be27f

SHA256
6cf2503c7b5e7627084bb22bf4339c4ee5c4c935e8c3545db37ce9e00b992f4f

SHA512
14dc8f79c7483ca900c10edadad04cc426a3d9fbece251f63b83b32ef0cc92429fed13f0a003845a1ec4ff6fb534178dd93eab40300cce57ce1a2f466832a91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07024eb8151886204283d41422640c35

SHA1
bc6396dd3af50fe32f9fad2e2c55c705d94c1126

SHA256
a6b934635efbce8671ee68a17685199dd60e870e8e3d565b899ce561bcf949ce

SHA512
430b1dd5a9cf7f5ef652a8e2e0abaef7ba8810648bff3893e910de85b05c47f5e0475772e71afe1e5c37cc3b6cb4a97dca5eec1d20444c6de0fb4645dfe23c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a84847559ae550ee6000e9fd996cefa8

SHA1
e5aaa061ea734f65413bf8847c9a9c857b0465c8

SHA256
e0cfadb8ea58c21b4963c72a06a56e3f8b3996a23dd8dd221cfff7da3e9437ee

SHA512
2509cbc1f91687b9a7569d03bc4b6c2557c2c580c4aee7143a41474f43e7bdb551b05086907c371039afaed986a07cf8ff77112ad76174dc68435d7b48b3928f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e0b8407e1e91566d0d2405e46066379

SHA1
28052920cf03c5a69d373e0939b6781b71a1008a

SHA256
1da16dcc17b90edca59b99784e5b75216b821411f6b21601717ae119fa2d0108

SHA512
2372effac6af522cd614b0d7f8fecff2e8f30a0fb89d70e3fb5a9e1dd3210349df899397dc282940ea160c361ae2389931a3c3fc92b800db3cad5a6b1d03b238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c81cbed3be45a57e8d346e7d12fffef

SHA1
993b83d969459aca97cddc7f190177d10ae0cc37

SHA256
b4418f3adbfded4aadbafba005d626fe145325a6be639fc053270990444a6d4e

SHA512
f1910912e3678a5e71e3e33e75fb4be1244fcee197899b7c987ee07ebc0ab3b2723137b2d93d878fd9d8048ba53e0666a0c8b7751b21e4190f074e1b941dd7e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
770d7aea2e4439140e5a6129ad3c3a00

SHA1
9cf9fc031f22e1087976cfe6284481f438c8a67f

SHA256
1c09f658f781acc2dd8a3a2cd886edfad44a754b9cff3bf306b32d9cffc6b7c0

SHA512
c8be2aa88d431602bd0085d774ae989083741a1bf07a86170b90ea4194d679f8940c8904101d5d6d6e63e740792612dd539ef3adc91a169b3432702483e7efa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb865cca5867d0cd8eb7b10c938396f3

SHA1
80d3a635fbc2224e6b63a327f1a6725c4de907ce

SHA256
dc6afbe707d4750fa175df037d5f1dbe7d8f4d0e444c7f796e5b09e4d9207ecf

SHA512
5e250979dfc64c722f31dbc3f89fa2762cc1db2872bb32dacf5fa49599216f7fd57c6ac8598db337a281f84ad424ba0f78a567f3393a4831ed098d8ac7a1069d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ce780bde592d9376bee5f7c96cb847

SHA1
383b84a46408b4df86d6572d1f21bd63c629ae2f

SHA256
8d17323fc6eec290b7139775e2667dfe77168ea9303e85cb54938f802d288a25

SHA512
6c953ee323144d5eb258ad5a15b3ab3203bb63002e6235295a4fe67084a1a9142622f1f9937c5b257aad6b0c584c46ca7f75f0f37c852cf33827af19d57bf104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c3725e9dd0b7aa3e067dff041db9700

SHA1
cca71064f1b4958bcd8a7b94cb927602db65f117

SHA256
4c17d56c18f9c8b2a0144e851eea10f81c2f3495b10b5cad85d9632e0c6b9464

SHA512
0b3d76d0962466c5cbbeca5c432097293add8ce52bb5ab915f0af46e54f68ab479b472c97db90a94fac7be858c24822cba18659a7e6e22a8a714b3cdbc7140cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50cc0783a28c4cb91a70ef6bc5b2b308

SHA1
20ebcfc41ee520bf270f36564488deb97423ef17

SHA256
12a8f6f3118849cb2aff7ae234f227c0252b9673482ba3ded34754ab39108bbb

SHA512
67611437e02f7608822f04b465baf34e900409da2bf979a57cf528c09d9c503596b586537acdfe0c5e9abf9b7aa585ea7e769c32cdd2bda5e9f477345d67982c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9d1e864ea3326a9e05c653654262b84c

SHA1
5d0a38209a0ab02c9717b9a42b0ccb486b52b54b

SHA256
f27ae387b8ef17900d042688d4cedd1ad62ca5b354b63615b831655e37b86c4b

SHA512
68a271ef4c081f6f95a97972f850ef20508a2de2192482660314caca419e8d192f2c385748b99fc3cfdcd9963e20b6f697c490f54b5e60aa552d75733ef29944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2c1f740dbe9c61a09a2c60f54848ef15

SHA1
9fd4d7672023d62644ee1369c11e7b4d2f73a8f7

SHA256
1e4af740f5e93628b7b79e49c8f82679a55cb26d7682b98fbcc34e8d898910c8

SHA512
fa7953a31633af22f03a33dac958f3dbacb9bf79151ff389c09016f6562fac2f87bba0b5ad09a3d7d63ae26a21c54a4de803cb7b77e0153a64efeee573e846b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\room_2977-20160504616pm[1].htm

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA814.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB26.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA836.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB5A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit