31d3c0983c16447e3e510ab6a2c62017b2b7a11e67a136e4cb16f7a77ad5321e

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f846e9545099bd5d7e78f9e3c8a4d86_JaffaCakes118.html
Size

81KB
MD5

0f846e9545099bd5d7e78f9e3c8a4d86
SHA1

b3c577905f3542431d65f9e6be3d35bee7e2fd06
SHA256

31d3c0983c16447e3e510ab6a2c62017b2b7a11e67a136e4cb16f7a77ad5321e
SHA512

a19bd4b81fbd6ba6440cdfaa068c14236534535c04174e881517ad23e71b81e1f4073af4061ec7542b8bc99a0b1d2edb24b2ab2beecab44584045e8e208cd96a
SSDEEP

1536:J2zevUmgMgh6iZ6qAuTzNen0tbrga94hcuNnQC:J4evUmgMghdZ3AuTzNUq4hcuZX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bad2e9059dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bf3a4c8506b45605079bb2c3df97ec09638fb6ba47e554d93ecea13a3ace70c0000000000e8000000002000020000000deb1f28ec241ec632f5cc6594e1872b643bb7a8645f22c1912adf3a3a5ec42332000000079b03de56f055d2e318367f794c1fd0fd077d290a4ea9c5124fdd60aff7f0cbd400000006f4e7f0d09f0189cac80f495e8c8642e77f1c98d45d515eb505fa222c6531ff5e2b656eb3d07c135660c083df1db6e64455ba313c96bf931f7c5cf94869be0d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d8875f79336dd9db86f96e772674ef16703163070153d3deef24af5efc27d52d000000000e800000000200002000000045927de4fbdee0e28e8eb987b3c31b7f63a049220bf70e62ab429e60dcc36d8e9000000085547e7800eaa885e3c809be90f16da10aa59070866788c393c117904ef0544f58f16c410dc9e2d0ad9dcd3651f6ce50f13b03a22fb68f5b1c83fc466833145926519f798ca8c0e7de617172b4fb9e1bed3e8a3ec46c514a629469768fd33a1fdce86b8c966767c6c18cd6821039006fb998dac72e166fa54a728f72d52a66a982a4fe7a91094c0992dcb8e5106e012840000000f410ccdc72b96ff59fcb55eae3d2f152479d4bf1eca811ab5e6256be226e8e678e6ff87700f301e6aaa3585178054e86aff9a2f2bb713891514e4016bbc99c64	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{143C45E1-08F9-11EF-BF06-56D57A935C49} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420867004"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1724	1728	iexplore.exe	28
PID 1728 wrote to memory of 1724	1728	iexplore.exe	28
PID 1728 wrote to memory of 1724	1728	iexplore.exe	28
PID 1728 wrote to memory of 1724	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f846e9545099bd5d7e78f9e3c8a4d86_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c088668db9c5acf05c7968291fded7bb

SHA1
806c71767ee9d2c0b9538072aabea73ccc60ea63

SHA256
ce9fe10e18966b19316361a955453cea71bc3de723bd1d8230630bf29fae0032

SHA512
271e4ce9aee1ae454ce9d2c78b1d5cc8bd2264b356cf121c10a28d532d2b87a40419fb9be3cc60e96179c2e0c60491da1e1393d42b35c81d66afb34146c1a9a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b0da13b1f592b823241df5bbfa5eca4

SHA1
7328b0f59674944477209494878b956ffd21f3ce

SHA256
cd09c1e15803b1b732fe48e219a55d5a0b6a1e0b642ff367640cdf60669e80ed

SHA512
1e89dcf5f95e1199544c104dc9a38c3cbf5513cb1dd85208598fe5b7e0ee54946073d0fd9f04aaa455fab3f7f48b9be1c9359358798c1a6d50bde8a2f79c1a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c31395d24f27a7b256690793aad7af35

SHA1
94c4080a24fd3ba68da3e84de3287eec0a253361

SHA256
962dd93e6be787c02b1c55bdb36eacaaa5aafe8859e3849bca6fe4704520ebe0

SHA512
6efbba286f776f1fa30fba3653f7718db9b79eb34f48796acb3d9270a9f2d140706ac1017bb575b8e39443c8f44f1b9463757781389ab9d72b52a81b861c175b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b6c5f0f5c2f80c351bed89b7f1e1ab

SHA1
2d9a123e6544f47fd76f7c62ad547d350bf83ca3

SHA256
83897e4abae943ef8c3c43072769b0c7055589552fdbc2d0cd2dcfb0f7f7a198

SHA512
daa23af70d6aaa22699e9318566ed5cdb34580d7f4eab80f296165b4528fa86eef0e3ca0f4876e2e6a7a3e3bda9dadc4c844f53dbbeb2f0d4c2e5f1abb2b76f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6589ffd1effe95eda82196a28a12255f

SHA1
96187df0ac5faeac5c835d16f5041a24dbe834d8

SHA256
01fc5fd402018ff7fb786572719f663b806f65cd18d20078a27d74aa2e65aede

SHA512
796a5f47132fef08badf326209e8a97c6b15a45056a36b1005acbbd526a869592e1a5425cb4577137ec46cf5a7f9cdaf1038624ff529bec4f8ce0189906f8922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ff4e4fd197b85780d164c23d00e4695

SHA1
1579dd0e25f205dc6d205bd1460e872837c049bc

SHA256
95e383e7ec2deb684f41e17f26c5e93381f85b7513e661faa1aa9a623580fcb9

SHA512
d032b19bd630b5d50440f560993ebdb9bb667a1fc0c0b45c917cb08268a4abccf43896c65737da67fd353328a112e3af48115e0bbb76d4d4d1c3083fd60fa427

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
476c869213f251383738c1481e21ff0e

SHA1
6c7b753d019a7eb2373ab837f807b1170075ff38

SHA256
58e1d3fb2f3b37aee2d2ccbeb9d2c6683d02b5613aa57da65277c8f0d2a70329

SHA512
708a393072c64d71f5b0526d471fc95e86d0c1ffd1723465ccb8c1fea6c05953b05d647d743e50eb00cabd645e59f97a45bec28ba13709af86c6872067c9c381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35ec9d72105336ad08c2f257634707d7

SHA1
75e2578364a3daa90a670bb716da4f5e14423de7

SHA256
78637fddbe8e104982c47bfe9167d45164c9bffe2a995e46d02553bd728a3ba2

SHA512
375b32aa68f4af3b10b9e132892b6cdb5d1752227d32b101cf448fea190d5cb87ed6c10a04ed50cc0312ed9aa08db67403996d6207188abe6f4db219344572a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cda57702337c6ea17aea9768fd18c8a6

SHA1
b7e8c6ae01503b490a92ad0274a1d398bd09810d

SHA256
0e21b6ae444a383529fa5dfd93f50adaaa93eed078ea53d2ff671194d8db6e66

SHA512
c3b05a0afbb5bed0e72cd422dddbe5e72282e16e10e9fd33a09bb8779bfb0a6e54bdc710521985df71e95b81e06d5815e11b72b36813a5671c785fea880899ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12730b6a8df774765d391072b5ae923b

SHA1
9f41aefb106e4e98ff492c2d2d05298eadbd5409

SHA256
ffebb2c1a234b04e47a2f75fc44d2db8f404c3ba9fc5e7613e23e51541cfea2e

SHA512
39b025d12a980ffef3e3db842a49f585942d117e0dbcaf8aaa0d68943be80026c1ddd676d97c8117683b6093114c2b017ff3db984292f3e51044776f630073af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c65c3c8c0034c55c6e9d9be93c70c34b

SHA1
9a19ea2efa14c1ba5c6916745f115666837fdc9c

SHA256
8b3b6aa899002082e2d178193617b2a717bf408ecea48e771309d24270acfa55

SHA512
1a49d2d2ac3c3f06c99b9167b181ddc48de0df126ae561c9d9e65d3aa24d86ad0a1b954f763b3b96c1bc8645abd78e85cb02164cd2d1e4dfc59ce864a83af161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
766cec8a9ed7d4f7c7e6b6fb12941f34

SHA1
97911a9788bf8333ca83efe5aa6042d84f93bba4

SHA256
3c66ddd473d685d993d74315acf345a48ea4d6fdd3f621369d2b0732f93cc445

SHA512
8b11dd353d399c86be3a338f1cc10c0407aaa5937b4e2ead4484f8a5d8c79a4c0fbe0c83a4f138cf9063b13ea44f7c8a1394db806b3748cbbe46dc11feec5d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60e29b974346e5ee403383b1c19e9d4a

SHA1
8a9a229c69cff890cca8d73eb32333f550183850

SHA256
dcf70936b485f2b824fa35147794bcda4c154cd5cc49b7703e518aa37b4f56d3

SHA512
9111503c54078d28fe24dabe7831963416b4040263ec963793f2ad752cc1ab7b5d1abe3ccb0fd4d783bfb5c423ea1a08be6266ddf3a402691d1f0ce5a66ad7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
784c44f2891bc1085708fc1ac7f5fc7f

SHA1
8d6da06e90056f70141aa9d281cbcd0edd81b9fa

SHA256
5e84671d79b00e2449dc4750faeae826002165140c7f390bde082f96d98e1a44

SHA512
eb53f4dad7975a55fe3ef020bd9fa33c1e4e6f447fc44c2b69bce75bccb44890b8efc4613c0cc5ab1e6a00d8494c8af57be34e90bb35db51a62dd06d08132c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78dddeecda29b8bd28c02e4449d8fed5

SHA1
6f1b99c5f409a051a3d9bd037cbca809e3630cf8

SHA256
a99778eb88203ea582b039245569bdda7f42422bc4fb0f19addb5d321c0cf549

SHA512
7d6804b9132955fa53c7444a7d7938e0aa5f7134795f61bdd6e48a4985bfa02424a925fea7c18d4f955c71874819d71e6ec5ad9fb42257ef930c01baf66041b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab958E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar970C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit