396e51a9422307d82fd65543b4062527df6b2546421d2239c611c4a4457b5f6e

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10eefef5daadaf9121dd83a137fc64a1_JaffaCakes118.html
Size

6KB
MD5

10eefef5daadaf9121dd83a137fc64a1
SHA1

68541565d97b547fd8bf13913502f833cf3aa37a
SHA256

396e51a9422307d82fd65543b4062527df6b2546421d2239c611c4a4457b5f6e
SHA512

2de46fd923b0ea3a3947df6a2663d978f4b6e0245fc7914e2b3dfcf939f91b5554d6db0822e5714d2aebbcfa28e3da795ba93e2e7835aa46e5c0848be29bf94e
SSDEEP

192:MgNAOz2KLAXfgFgr2UX53gEBhLx2pxDU8jHhaub:MDHZNgEBmpxNaQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000caa30ef49f936149a6b621f83302de1e00000000020000000000106600000001000020000000eaeda95f29aa57f9a9dd6fb8a39b0cbff2c7adba974cce0798c4a20abba27cf7000000000e80000000020000200000009e8f14b489bf098f6f56840f5d29887bccb47910eea3df70c8c9b1a3fc961cd220000000ac5d9f20e4e6cc01d3ff8d2698c9b305161da6ffe3bf6b5d491dc2f2a32fd2ea4000000098cb462835aecbbdce8eda586a4dc22299e05e502d587dfef1eaa3dd77210822abe1f58bf2a3b3a765f78b4440c6be015a77fc2a644772b3adc2f3bd45dc9c7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E3C6161-0969-11EF-8A73-D2C28B9FE739} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0afba72769dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420915338"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000caa30ef49f936149a6b621f83302de1e000000000200000000001066000000010000200000006d5aa1c440b6f195e9f9411c68d354ebae36a33b44d2af75f7409e3dc9123a49000000000e8000000002000020000000faea6fd5e2c98a0b23a8e01ffbb420ffb79c02ac868aeef7c640573f532079e490000000af0a4aa9630ccd4a387048c0dcc84448da0f22d74e508da2ec5a7b91c09747def5d824797a2d6681e2bfae436466bfe99ab49963bd0fe3cb2453b80ba17380ab552ebb4b5f217d9fae05dafa490371b3dd3809ec1c532727f85034c9b6581e82a945e50cb921e0509f75fa9210a77739a0136e0b81ce9f7ef08b2b4a373d72dc0fea1b9c8dda6440c030932eb621254940000000ac3da26231fc14b4a36d9de7800c7d80387730ad0ab204be4e02aebf2f137e643c9fd6aed15893e1c1c8e729fbf8f6389032968472505d8312411ed370d4c661	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3016	2956	iexplore.exe	28
PID 2956 wrote to memory of 3016	2956	iexplore.exe	28
PID 2956 wrote to memory of 3016	2956	iexplore.exe	28
PID 2956 wrote to memory of 3016	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10eefef5daadaf9121dd83a137fc64a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
82eaebf45e5de744f0a614c89cd520ca

SHA1
6d507edbca19b233a333b5e00f2b47c14992b96a

SHA256
d0142372a88c6bb925a447707773598302b73cd8cb6dbe2e45abf44e890f5793

SHA512
3a1afc84a14022420cc55102eb135fec00b36e4c94f77ec5af56bd5a66ea8f6c5fcf14bf3842dd991eb54d026cf21744edd143277c83f37ff763500a9ca0c2fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce759b14df403ca0903880b3f72ab22e

SHA1
be5078b71069ee8a0d36572c7433beff4ec3f411

SHA256
71e7c5b6b8b504a1d82c7e9212247e7ebf0dd4286b2d860ee641aee5a62ef116

SHA512
8b78de7013b2cd41aabf4f8d7f882d93aa051ab70ac0030b39d49f859d927efaf8ccbf08453260a3f600b74158118a9e348d0720b3ac4afa350e8af0c81e7540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
642807466d6e988a24586f097b6d02a2

SHA1
d7956cbb7518a5088fe585f92b86192e35fade60

SHA256
9097e338107a1c19903fba9d22af16c2cde0e8c2886e397b93eebe5c9e267354

SHA512
24028fae6998fc08c831c2b96a8c5447772fafd4f262d9b1b00bbdc8d25d023d913f0b8cd0b54fdb9f3d36b5c89736aed5bece77a3e32b1afe70925b7c7221d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c4069450dba0053429b4ad5b097e35

SHA1
7dd63df9ef8732b031ed6a58448f554b3785b1ff

SHA256
6b036f8447d1bab43edaf1289a0d44b0c69ed19876f77b3137928fc7adaab92a

SHA512
f9ff3cb3c65f28d5aaf4baa3790a6b253766db2c57c23215901f1178a055de40b1bfc7d4f8fee0949de721c399a3ca5ef21385986cb82f4989bddfd251f1d9ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3cdb5fda18adb7fd570314fac94eec7

SHA1
7915caeb91c004fbd2e6f2943a575176ac00a05f

SHA256
89eaccdc3c8f9a7c74ad7d73909722c38b5efa4fba0a12fd0295df969719a0e4

SHA512
154db68e00a2febc280cdb74adec7be1a760834469e1f054c1406591611c35bdccf2d3597033e035e40c2f08db04c8fe60e049475f8e31c02913e57101371b0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
091843b5fa857fac7752d1cc55e538fc

SHA1
a53d5b19a85ed8627d680d86ac1b5e6fd5145d1a

SHA256
dc2efd7f60136ac9b02d93c9631288dcd1916d9c2ea672c70ca7961527e32a0b

SHA512
39c017d1356c9940b2ca181071f311ff531dc5c0234506a63e7ef5d5f57d6ed666d176901d36c4afe59f1be9c7b4483c920244bf65e389a8ec7a922d8e684913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a3f8afa0509d9c6163230b656b33daf

SHA1
a5a3ea571aa6237325a1085888215d5d4314c2b2

SHA256
abab4def9feee4aa769255dc83f5e45d1945e8fc10b46680ab425ce95dd07af3

SHA512
f0949c68671be28bc7b9af21adc8456a0dcff89c35d9fa5d6c2f953399f1eee705b178dd211e32d5a6a6dc9170ae3a2766a2e7a7e19d031700f946a53e90f9ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca86e3b09b1ad2b29ad508ceb668437d

SHA1
06fe39354824f5543fd1f8b8ad5fc1b33964de5e

SHA256
c4b2030bd90bc7da43e9fd2d13a271b0b6d4bab043a3a89616b0581fb572a22d

SHA512
771245c97faddc71cc074301c1e75a7a95ec15f901272bc202aff7fd944f41b51e6d842e1c77f03baf9ca4b1dbc1d74a71122ecba2133af48bd36aa37d2366de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
488e5afdf7c8c9f7d3c2e72b0b99b8c8

SHA1
d8656e5b44bfb59a668d6a69e90bfe5dfb171d27

SHA256
1d405a6f4ea4b44329ba180b2c20efa804ddb6854fe8b7e07e7c6e3dc77595ee

SHA512
6c1279cc992de2430aae9d8b278bbed1f7a2518b496b1c317ebce93e782d269a36f65da539a79b0c39ac13491cdd40cd5cc8019453d7d0b950fbc3281b831089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba0d6a7f1dd7b6faa2b73a846c19700

SHA1
4f03a0c81cff707888b8c615c65294bd0d5343b9

SHA256
4cddabdac9a73c9fc58a5d149c91f4eb93fc87d5106ed130f952d4c5c4958ec2

SHA512
47236b71858a71ee48b7e90bf5e5177b662594dea3bfe39a2462cb8205356e3a6aac926289076b0a82304ab7caa51af34e5c2edce07de01d18e5702345463899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d5d147e5237631f7806cc156c4a81f3

SHA1
973a4e12feebcba6d1d45571f3a4c723145e8f54

SHA256
48487e60a4c6d45e572a6d79dac989931e0c62bd208163ee33f33866b67913c3

SHA512
d028205ceca53c347f7c121c4a655ac36b84936f646f06b26e92f1275118d00d7e9e1f124b1979403c2445c62ef876822f282696c36fda38742ae34627086147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5a61032fc1c6139f7c0ad18bab8ba006

SHA1
12d35631bc8692cf917885b5f8720c544fa6ba3c

SHA256
38250486ab90269793f913b0eab74ee31276ae8995af3e13d8ad7f99ed0097ed

SHA512
b81bd94163e45fd0ee1515fb8e5148e7a050c0fff44a31867a8119eea1dfe0c01e054db157710b96a32b3b277f6f046abcbfdd4370c0212c16ad3a1b38ccd40d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2005.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit