7e77d2a367b763aa257577d1822fc7cc28d2b4bfcfb214ce24d0a9bfb5b6cf1c

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11b873db5683aec36d0d8ea949ce9bf2_JaffaCakes118.html
Size

69KB
MD5

11b873db5683aec36d0d8ea949ce9bf2
SHA1

1b3655edee06a44e5647173f145cdbfaaffb0f06
SHA256

7e77d2a367b763aa257577d1822fc7cc28d2b4bfcfb214ce24d0a9bfb5b6cf1c
SHA512

1546fe497de73dff7d870685630841cf1adead7e302e2bf0b8ac8c7975cfaa8074a06158b2f35eed2147be48900ad89a5ae0fb3332a461b54fc539e1861beae2
SSDEEP

768:JiegcMWR3sI2PDDnd0g6sCN6oTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8sB:JiOTSNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420970287"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005735b5e925ab920f448eed18687e616b5378aa680b1066a0108862ae1dc7109b000000000e80000000020000200000006d17c2fa8f5b5d966377746b7b7522192434e2f111e488548265a06312ce9140200000008acafab5187751c723e4274f9881d74dc0da5a9bc4a1ed1ae016a35595487d5740000000096f1e702e8e6b9103b69502325ba4896eec4115f63fc615a009f1edb17229d447d3e5707ee6040b1ea892542a2da4f557cf1d41e4b70fb4343aa51768908d65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C00C791-09E9-11EF-AF73-469E18234AA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c99d60f69dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005b7d6dd4a56c99d5bb83fc38d3d166654e93d740aa2aef9e1261fe7eaccd92b0000000000e8000000002000020000000f3e150e2e4497c197bf92df05012efdb10e71d7df79d963feda1338c9ea3b4d0900000004a45dd061cef628747dd69bfbcbe06a8972932f92d753d94fea02230c7db32f980a1013ba846a8475cb096dbadadd8addbbe5d4ac56be225f3a509285c50d4b75f4f2ab540769661669d3a8c9d32984bb0cfdfe9c9ed03b804977f6698e6d8af40ecdf7fb738e05bed75554a2bdbb98ac73f0db94280ea8171d9440c4c7bd28d0aea0ac4ad16ee3436ea6e7a4eed2566400000008c3eb267bbf95ec51f1873654ebb09ba6dd227c1c468977aa1419ea62e0af45851f206ae9ee48f61a7ef54e882f66bd962ee04c1df94b52899dd1dc40c364219	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2740	iexplore.exe
2740	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2636	2740	iexplore.exe	28
PID 2740 wrote to memory of 2636	2740	iexplore.exe	28
PID 2740 wrote to memory of 2636	2740	iexplore.exe	28
PID 2740 wrote to memory of 2636	2740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11b873db5683aec36d0d8ea949ce9bf2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b42c4171beea854c0903bc06ed88421

SHA1
e4877b4cf316e9a39efbaf8ce8bd6328329e068f

SHA256
b0e7e788ecc2dd5a7f955696ac459ea973a81ada162a3a73ad78483a584d2b60

SHA512
95932f2569e5c7a97894d02856c383232fef0821da91b392a8d8ab96418fa8765ce754325a49c308dc11ab6b72927464016215c783a7238628cfd05053eace05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c548ed2302f7a19f84cce5649c76b8c4

SHA1
f99dd1fb1ac4eb4ea09dd226872de8ff794c6144

SHA256
43fafc380488de1532bfa5c5a5ea90efd9f870a5bb6f4c555491cb7b1dccc801

SHA512
03232238dd7332d9066e6a2d650c401a8313d94a977729f12cf42ee4f19993aa5232850229f1557eaf2526edd167d691b495fd10af8d6add0a003120826dbae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7766034109c3f2cfa9a3e9c484bc36b2

SHA1
d674fd093ac95ca9f4459a9b0de2833ed41a30ec

SHA256
acbe3a90408ec76ee70c59b5c0843eb5e9587ae97ae2dec16067def5756c402d

SHA512
e5cff00773429743e83e7e2f99673d7fc35592af87776f0090ebf74f78ca1eac9ad5629117a08d1e344a5e06e59184b6856b5975d937bea59ab642d57dc73474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4c426669039e0f947829be0d9cb9ba

SHA1
322ff5d62986e829956ea5fe6d2ecf60fac14dff

SHA256
88810bd630c450d6230b308fa56beb8e5423de5640c5df467a8cd1594793e985

SHA512
6a9d82615ebdadade4648c19c4201b6ced560337cebe6bc6e326a6d8a1dcc70ce6ea4cbed23df071429e5b2a17b67795ac9cb6b5936e8dbb514cc818bb818519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb5624e5427c61eccf0e41a328c4643

SHA1
61a962e7424f40b6bb782a0ad47b4d2f1df1f615

SHA256
61f4cce5e480ecf931f43383a924155afb1a2720ad1ea764e3dd997b2b452adc

SHA512
16baef95136b85f39a6382541a4179a44dffd164e5b061b0103f9da69fd7b75be13f1ddd4d003b20871cbc597a5cbce47f30adfdf3d34d05cc7d4edca233925a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39823bfbbe760688e3f5b609f54797d2

SHA1
a91a359624cb9d571ebda05ada405211175218d9

SHA256
bf532205530bfb878bb5c736d4b72a6c0181de84341aa5e69a4a17da2fd846da

SHA512
61c47333a26aad0169069f5eab15556016647f24401332d83a1d844b4010ea9f89e35fc1ea77c201ecce8cbf5f327c62ee6a6a5e6564c66bfe49686f9e7df42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39c7293cf12228891719679c3a384d2b

SHA1
1e3a5f898f413eab0e0eaf2561e4bf2b1d4e3594

SHA256
753b4af3e1161073263a27594e96585ad22021c4934439cfbf9fdf31e85a4c64

SHA512
550146ba8c042baf8fe9baf3a9963dda2f171b6c3d51cd3216ba8185d71f2dd3638bd6bbef6ac4ffbd7256049d1dbc8c940f81eced8601feacf35b357d3a78b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aff4b4049e056cdd426e705ee3c71c62

SHA1
baadaabd76b0f4495a5b8a68160a42cbfe1d175a

SHA256
667e68fd6ad29595d37b1ad20b28df7a5e5a8bd78b9332871c27572081d67a24

SHA512
ba6bf09628f82a762b989c0c0bba9e5207443d545c5165bd9a51ca9f9d38d37c9019859b6e8460169e0c45dd7d42c68a9ae3368cea2f8aabe6b0c7412abfe843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed4bbcafe2de89d058058e17284ae6b8

SHA1
f1a2bb005d0278998a9658c8a2eb85733e52121a

SHA256
d53b5adcb1a368699fc6c311ca41dbccdc53a7d9350fccaa90e6155f1a218602

SHA512
929ff9021d4ff6c120cc390afd4980e774d49eb80545aa9593b518dda1fb967dabece67cc40f9282c47828549e3cb848de51b5b5f4ed210cba106d634d22b553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da66b0d60e1e538856db4338fc2f0416

SHA1
77ebac27b6150fdece43feb98645fc85a0207e42

SHA256
c5b717bdbd015890b64ebc17727653c407b4f231f1d3c676ba4b7495c04dc320

SHA512
106ccfa483d7cf000487697eb6e552601a3f0bf8d386603ac3132dd12eb04fc222e998f1c0a462005ac812c558d0624e79a266e4522b61ee61899ff2f6ad8705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dc35bcfa9ee29e4ab57bc80cedf48d9

SHA1
2201ecfb1d5d111ffdab3149229f1e59f8cc1681

SHA256
ddfe4b65f8a17c7a61654b5a7153c89eae1f3e6397ba218d4d660cc4bd6c1711

SHA512
b7b3d7474db4eadb0f441261e2e0fd18ac0ea9701b4e4b83cb2b8507f297e342efff41cdf33de73359fe677d3f173568a3ef3ce29139848d735701002051130b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa3f46f0466c5df522031d92269af975

SHA1
5b14a72098707946c90936a4fd4806b586f176b7

SHA256
2cc5b46275778ca876b240192ddd2e7d7c3a6accaadeb21344115b9796c086ab

SHA512
8c15f686283101d8acf83e2f6a25bd1275ac618452109fb56c295928c7288de1b6e69b0eddc972b35b7b36876bf0fa85730604752293c52238b28df0f5390a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5efb1affdf80acbbe5cfa404a41ee1b1

SHA1
b47d60ba5faf436f20147db15a731a8bf2243256

SHA256
af00db26f7b0af208e5d13b47e85b1c3979080b5b1d180ef3542ddbfc7e66036

SHA512
f19eb7efa31f30f8128b4822596f329123584c1f4beba7bf7864e2a9a3ad304ca7da5d1c8dfcf080a6dcadedc2a667454a238062402ce0e9564c02c7786f0143

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AFA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BBC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit