e03dd213df4e4b64031972a5feb09ca4af95059685d35cc434d21603bb437136

Analysis

max time kernel
143s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

133226ade92a3cd944258b3f45d1bc8e_JaffaCakes118.html
Size

4KB
MD5

133226ade92a3cd944258b3f45d1bc8e
SHA1

172714e4b9a241af03a374f39b72c0beaeb1f52d
SHA256

e03dd213df4e4b64031972a5feb09ca4af95059685d35cc434d21603bb437136
SHA512

9d768399185c15d143f7c71aedb9b4aaf0b45a90d00090092d5459b31ab447071b114ee40d88bb02ae9b7ca145f7867c9fcf859ee174d853842c11998d4cc262
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8okLSZ12A:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420996058"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c16b29490df9f84e850a8e9ec366d4c600000000020000000000106600000001000020000000566a35617b6e5df0fe8928e9c841e35c12bc456c417ac24c7f8914808ea604b2000000000e8000000002000020000000e06873c71a3e499c92a47b748b37f1401d7add4f34c90b95dc9f63d104b8b355900000002eece265ddd5cf1a8c52ab918ffb4074443c3071ee5803e71c5bd42632a8ac4ee8a0842f6627d59e65cfe3952263af41120e27dee24005bc57979029912d1698b31161b6c52b455d70c299bd6617c866ee7442f4d679a9198c3ef29acdd57927ce6a980a23bfb47638bdb649ba2e8cea30c153cbb7bb5349cb9acb2390758619d3bf01bc6a297528190f91be8a7f597240000000a4886e232426e3392f536cb866b43a60881c87520c64fc9902de2c6c12ec794f5233f2f4c3a7195ee9e477ff6ab52377cc1ed6a58b40280f1268b65f3e5b78a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806d5c5e329eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c16b29490df9f84e850a8e9ec366d4c6000000000200000000001066000000010000200000007f3681ec25a9a673a4a839e4e6f4f0e896325a14ac879674d8f64056eb4181d0000000000e80000000020000200000000b9605d7a34c078f8d88267486a18ad92bc36954adc5d17e0456ab1db43398a3200000002c2f647a3a99e19ff28b3120c30cba643f86431b8b225d21f38e0a36d484b3454000000080c5e818437e7af4a855634f0529c3c329d135b8d7d28fe796c1e97a64e70f461072c8e27b4d9d011463dbd2e01b77f3c8b41e558e2577002272fa6ce50a76f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89C51121-0A25-11EF-9E06-5628A0CAC84B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2212	2356	iexplore.exe	28
PID 2356 wrote to memory of 2212	2356	iexplore.exe	28
PID 2356 wrote to memory of 2212	2356	iexplore.exe	28
PID 2356 wrote to memory of 2212	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\133226ade92a3cd944258b3f45d1bc8e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9320cdfaaa05bc94ed28d8d9eea8516c

SHA1
ec91ce68c4a33dbfaa75b8c406a05994a6e737be

SHA256
edd283e4099af6610674ed5aa02cadd0e840bc6aaf678e43fcb5d676da3c2b67

SHA512
1f2433121a3fd572e1799a9b75f1819b96a3473460e96d4c3ef336f3e08188efb49798026df14bb72530433d5e6ba2812e2a2053b5aa6cdfb4b8619e328c6bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a9c4e2357c8606a7df14fd881734196

SHA1
8c98e096709d76935d790c7468d340f0faaaba2b

SHA256
c1e46c6fe73cf4b4ba70e318134c58a53fac59ac1f336ce08d172e0e4b831700

SHA512
ef71428ce8ad4f50134671e7627679cc3bccadefdb2c47494178981551e56ce9ed165a49f65fe4a8ab93387000e8b2ef5a9c43527790137bf2252a2648e44355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f198a2a0c4e3e8228559c5f19574ba5a

SHA1
66c11b743fff1ef9036b820c1d4572420373cafe

SHA256
aeedb48f23b1cfb62fe1f22f2f32384cd3fa7413d5e2b58178336608cc16d4b3

SHA512
d1721b97763bc342e0aba032edb5c9c985c961991069ddf6ca561c56a3330a9ffbee3343d40945f397428a470521824e066d976505d504989818815a3d040776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7311ba2d40604c160018c827b0ecc4c2

SHA1
76cddab254525a695cd999b1e7b329352a4cb684

SHA256
c93ad025501d469988511e18ae90ac82c573d9135069fe349d49469e106d21bc

SHA512
28ae59448c8f08e5f416cc0144c911a899e85db6f6436078b2f056047acbecabd5d0369c026d7935227808f754582bb19f6ef8a9a3224d5b88a9db2b0aab287d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48506efbb7295ec7fc3b802c4e4729e0

SHA1
3f69da4c6b7168f96ce8ccd8ecce11bd5cd0d3c8

SHA256
14d03de32e6579fa936913b2d03c480c78a9e94f961fc31789d438ced7ebbf64

SHA512
4cf48b0c031495e8faf0b0b63ed845e7e51b9c692416701ba5717e26567f2914ca91237692161e1883f54c445dbec719f9097acf9a23341201b0d5068108115f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
571fb2c5b8101cdb58f96eabcfd86cb7

SHA1
9a8f513953f49c42e2d69d4d5fe43d725da8b21f

SHA256
e648883a8011e0c0e9482ee64d9acc8b3e6294379c2b221e9a86b708de5dd08f

SHA512
b450d654ab734ef59cfe53b6664473b2683bad2f0e28624f26d22dc5d85e7f9a3b99ebf2b3b0a5eff84f8007f073fb375d80cb3a1af11e00c114308f4ee43c30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f44446dff4c4e54726d33c349ae30e8

SHA1
a03315050dc448143fbdcdca09db338af7643ac8

SHA256
c93c8a8052f1fe3ae58c2cec31ed987819009331c1ef91af5ff236b188ac68f7

SHA512
db5f3ae168a58cf382e2b35f187d597af7dd53c6c6285ea9ca96ae99f47ddb16ad941179f440308560788952f3bb0d189389908de56700cf3888db727eb37ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c69e94f165120c30c9e9938dc357140f

SHA1
7668df535a5e5ebdf947ec4707e90f85e1aa4a45

SHA256
b69e34569fe1b04d56346d9600a937d58361890eee6344bcf5dd5feae4ab85f5

SHA512
2152f186e9e4ec88a955b336902616052c67ddad845118b0c570ae868c98fc58f9717e4a14f24abdf6a62708e497a1e8fd53b0638f74ab60ec55740000b3a3dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bfaf5b06a6caab24518c6ea460c786a

SHA1
a15814af872d33836c1a640bbda3447d95ad265b

SHA256
d9cb75fa5e460043dc6008639b0fc1ff2fce0d936c915bd9a062af6b11500840

SHA512
17d7bf08b8c4b495ec4f672d4b49926361ebee373fa1716a9dca56544c9ebb0427971dd80cb3a013877cc2943365b4fe30b505aef0ca8afd305008115d58bcfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7060bb504cc37daf2adcf6ea0d12e6cd

SHA1
2ad5cebefa6280409d445c6d42a8380df76dae97

SHA256
2449b74d74fd2200bfbbd1b65c773a79a5b9c4c3f4a73a87a6cc5016af3c8cc1

SHA512
e4a95e9b2de419fcb4bff2a79bdc21cc6d98b9828be6989c8950982e9780e2036ff9b051977da90a31f46dd379e554c0d748a1fb548d79a4f42d148a38e5f73f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b8deac3e785a755e7c98713d36f1447b

SHA1
e32eb44ae8bd39aef3413ab7bd154882419a33c5

SHA256
3a2f76d1afa97f93fd07b441d3a50fcb97a8b60ea634a277f16ac645a3c606ae

SHA512
dd2b2e63a7193754713ec7219dd1a6e5218c2d47ca74219fcd8fec106bed8232d1e85fad925fc42cedd988b8fde24c7419351a6c24c262c4055be4651a883936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar20DF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit