a2c1f84f135b0aa0ad3f88695879e3867bf93ce713a0a5b7d387b937dd45fd61

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1171ae19009067e87aaab73520af0291_JaffaCakes118.html
Size

460KB
MD5

1171ae19009067e87aaab73520af0291
SHA1

cc034c3e3a03ac065b86e2330ea412d7e1b178ed
SHA256

a2c1f84f135b0aa0ad3f88695879e3867bf93ce713a0a5b7d387b937dd45fd61
SHA512

eca37d9cf4ee0693b99a70c5eacba03a5206464a71cff3a68dea031d4ea03bd53f641ee8152b6b1ead32909e70dfd6c7a21c5c900b01ad7ebb75bc9ba67b1c84
SSDEEP

6144:SEsMYod+X3oI+Y9sMYod+X3oI+YrCsMYod+X3oI+YLsMYod+X3oI+YQ:v5d+X3f5d+X3O5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c118d4d89dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420957586"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001b540139f12078d48d8414379690f6b105d695ebf1f34bf40df843e52a4ccf3e000000000e8000000002000020000000b620fbbe64f18c1878c62841804c8eff346fdaef806df0f918622394c5c23cf1900000009689e7cf17d34de8c8a4b9580e92ddafd713ad46b4fe90bb1255f5fd70530074184e45d62760e06242b83d0d3fb7e325c05de471e784cc26c5797136a61cc4943289fa45461e7ab7a831e7152ecda1bd8d6863acea9a71f885cae6d92a0ca59e9d668e4019fe82adc6e07a3ea48139906428b8f86e024549da65b73cacd533ca39c6a8f5d54924883dcb00a0126e280e40000000916c3b61dd1ba0dfd38d7a68bf9a099f44cd827989f413ebdc6d18cfb8c61a245ac833a15adac6c4a6b8189ce81bee0a700aeca722ba319c9c0da5932d149b37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB4FB251-09CB-11EF-ACCC-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009f511f85c1659fd6175b6e17130e0b4dc50cff6345cd965ce52ca7da0fdf0c8a000000000e8000000002000020000000b9f2fe911d49631920528815d7ecb4221c6a8398bc5b9e4d0c4f5f55b3cd3cf520000000492a9a36ed8e2c7b8bcf0c56b612713ee23bbd15e3f5d165245a0d26d849e44e40000000cc5e0760e708aae459915f8a2f4acd3c7628c2ca924452573aa953f532d079d7463e3b41806c5811756b49343e790b0c3b48ad1c3abe133546d52dc4f0b38d0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2492	2216	iexplore.exe	28
PID 2216 wrote to memory of 2492	2216	iexplore.exe	28
PID 2216 wrote to memory of 2492	2216	iexplore.exe	28
PID 2216 wrote to memory of 2492	2216	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1171ae19009067e87aaab73520af0291_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5069613082c0677b7bda36a6b713eb15

SHA1
7cc6307c377e999cdee61a86c47c003163011cf6

SHA256
178080e66af39ea47602c7ad01954a72aaeda045fbbcaf14a4f41ee14bbbcd80

SHA512
876c3397090ce9d3838cad73195680db3b49085f4df6725b87172bd3ade9e12248216e0d44fe15b94b709631d18b06c0da0e2b2cd8bc92777b478d8769c3c4f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f10d2848830335bc083f8d5a83ec2847

SHA1
880cfca6a5c074d0d760ec9fe6c5914cf2a67433

SHA256
9217592bb3e9546be9a4fa7b4f0097925571cf2addd8899fa297bae61019b1ca

SHA512
b11d7d7e9dc1d23fe39232acc1c74ca348078a44000d23045cb7ea5cd645e07e7c7eb940c193e7246ed7f1cf7ffe655441a77b6ea1afd9f36babc68cbb82a55b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f15651c83a678aba76fd072811e3c3d8

SHA1
57ff536208c877a5b09959f035d5ce2c4b5cda43

SHA256
e7e29ca20e3fed15d9819dc9d6d153dc7d52ed34f717e601f88bd9662994e1fe

SHA512
4ce83efb107c1fa4ddd671f6ff757974a1dc606e8ab16e2accdefd6ae2dbe03313b260422575266967c0d2e048e6529e298cec3bacc70e255c5cf9392ad41c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3d2b7ffd68002a7813625b7ed0a09d3

SHA1
d29f9420efebed392014e39b1cf3dd6e27f6e654

SHA256
7c2ee84b063fb5852e8cd74f5d4ae6a2b942ed964f50fe085857246d41331962

SHA512
8fde391eb6464bb2af58011ef9d960fc0f14b44fd340930360f0a287a1b95bab4a579e5d001e2c189868378f55278dce1fbc4cfb7a0d1993054c6604bff7ea51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c8dfc1ba687a707469a9bb42aa45fbd

SHA1
8cf65893f35de09e0e7461b233201838f97dfff0

SHA256
b05de0d96c2caa158ea40d0a0ec6e9389bed4e3ced5f75c4b6656bea72e129cb

SHA512
57dc1b1ff2837b1e825dfad8410e4be86cf18e41f45099fdc3857e53a0cc7f1204ff867f0705d4eadf7c154f45fc1668643b409bb48032ec80c3237b34138afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e14fb0b597237ce8423876f3daeac8a7

SHA1
fe2965e672b150bf3c5269a7e91758591c783da3

SHA256
1a0884f63153d9dd4df4375c266a9e7d030ca4ca4de4d229424b3502e174a92f

SHA512
59667c1a27ed320a8eeae5264a8c10a11e9207d061c56263968e3db1d61b2cd482f64686433b65eb1f34a1199e507cb1a8d3080a11f22f64e90cb977666af94d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a47efe62d55eb21cd924a87db2d1328a

SHA1
85d756287eadc8feac866fbfccb896efd6d5cc5d

SHA256
c1724470d0c50950da8aecfdd207e9fe96c52fece2b6a01d95b38298351892fb

SHA512
490f8f243089489ea157acc9f2cc1d51ff52713ee0d0ace541e12a7ed73295a262c4cfe92ffcf5fade7f0da15d7f8801551b8fc9e0d405ee2eaee8c6333c2a31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
139d3a2b7ebf21bb71ab746a791c2c1b

SHA1
f83e0e6b3438b57f74a36fc8fa36202c6035fbb6

SHA256
52f3c460eaaa7719bf618e816580cae131149b0cf9aa990605a51be4379057b5

SHA512
034966004a27811beb7d39638b963aed9047108a0b3b94a0cf5c30688b9573052c8f6caee65e30f71ed1ea162e13155e7c99f3efa7f04dad02edd0d95556bd03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c9d519c98fe304cb98beae064aac0d5

SHA1
6f1626fdb842712e7995afcb9f93d7bc502e6a3e

SHA256
69cce7e45ff3102ccc0a58bca8c439bbcc69e66ca9a47e85d438dccbf46623d2

SHA512
e94de94d27bcc62d1d0555bfd3b60bf544c220784bee6389cd9dcd40b2c7b6d36ad12701fced2e81de17cd88f5d7851818734ec1d729f390d594143338613cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eebce423daa00d9a6d9a397c509574ea

SHA1
753ebcfcae252ca1aed5cfb215414e470291215a

SHA256
926049cd6c4b0e60f4d8db4f02060ae3a92a5a2281dd17df0c5a2c13c8617251

SHA512
774ad81d77d8f6379b13a086228fa8e5e747265fd98ed8a884fdcc60d2bb0e360b94908b08a781b4daf31bf906bfdc6d6a2db25c032d29b5f300249534b4440f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5f1ef57e286060e9fb8e4feea9bc26c

SHA1
f0f2b7828a9e2396bd4cc411b14ccf56545da617

SHA256
ffc452d4ee16fc3ed9907c4b9b7217c2b011a470402ae3c16f3ca6233081f82e

SHA512
3bba1a88ed0e5f13b572186714f4d131d2f49a3d148aa83cfc69ba2209d87172603d0bca855763fa2382244d12860f723436120c4eefee0267ec0b6c812161d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdd98f9d62758b0fd46d399097f792f0

SHA1
4f608efb99f12427e6d27f0a4a080b551d90adcb

SHA256
59d1927a049af19a8fc508f822293798e05d77be2b906143170343c4a8d3e9e9

SHA512
a8fe988779844384d7d0e44207028e3cc11b96ae7f51a7bb19466014087095231f7ddb02183c461a43dd085da45f48845327340045cf28d0993e1470c11895cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2334cf5447aef5da06a5ab3e233b2b92

SHA1
cb1326b68dd087eedd879d2248e1e3029584e319

SHA256
5aa11853ab767c13dc9a89dc0983f77dab5258c8fb851ce8d10e98e51ded65b1

SHA512
529fe0058ca273cc18dd2127c5c04b4977bf1c847eb8fd7b9cb8d4a214a5d9b3320da2c9477195a874a31fdfefed060b340194deea459077c3ccea8b1cfd5ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d91a9d825c9137bae6a91e2904ffdc7

SHA1
1eec01129a5fe148c2ccf7d3ac886a374364e56d

SHA256
3d31ad3bdf819caeb2e7f0cbd9bb27c7124788791ad852115683a9bbcab53dea

SHA512
8defea807f5af285e5dea363dffa09bf5811e9f52d41b23a463f4e895167e528f95e6c84ab3205ad93b2099097db713862110eae78eee2786c33eca313f970b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab986C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A37.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit