1aea7194e425e34b83b0b45c7ed9a970ae4a89440df8170baf93e556db25e69b

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13171f2654cf39947ede1141c3c8c9c9_JaffaCakes118.html
Size

62KB
MD5

13171f2654cf39947ede1141c3c8c9c9
SHA1

b3a56baa5fda639c8827297ee08bb0ee9b9bf2cb
SHA256

1aea7194e425e34b83b0b45c7ed9a970ae4a89440df8170baf93e556db25e69b
SHA512

d71866fd3538afe2d655bd986ceb3d32633b27728b2581d75b532b33519277a30d47d75e49c401f983c8f8edcad9349e51f9d5fda9867be7345067ea90c6d116
SSDEEP

1536:JhwJ4Vz4VPLkLz4VcThpc0zbrga6vLNniK:J04Vz4VTk/4VcThI9TZr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f214bb2d9eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000603eb7b833f10d92fbf43df0cb516b4d77a05ab6aa14bd26998c32c446ae5005000000000e8000000002000020000000903e2233caab7ae798785df80eeace37e963f5c57e3cd3ed6380b4102c62cb0d90000000fb64f4e7802bc675b9aaa284eeffd94495953694110069d6e286c9f4f209625823ccc2446036be593727d726ce91791bf1ad63ba1f2cd6893f2658d883a11ae7b1216facfe8c09013397ab842570f72841c9deef05692d86ac1bc35a8c5f3549a4504135ef922f83ec8a4b11a9b7ff917ca825b1d07987e190ddb0c8456eaba491ec9a31248d28504a3eb202e9c1514340000000ae844f4b8278b49b9b5a7c17310cfc14ad60917903881764e54ea45f3f8754bc3ebcc79175bd4fc5ab539a06310e3b29e0c50ab242937cbdaa1e453b172868c8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420994057"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5BDB8B1-0A20-11EF-9F01-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000df49b19007a36bb44051f7f49be652a68a30e5287f9e38a70c9ed79a8c1ddfbf000000000e80000000020000200000009feb091ecd88a82c49050bb4a6365f695436eaba881c4a083105e2a447f0f306200000002d41be3d55c61a0a043c2b5ee2061ac313a4307d92a5e273bb1c236f7bcf3d2f400000003a88548fdc27414b8c43e3fdb8afa527920863f4f8bf6a43f16eb6a34d6d8888160ae4fabc9771f52c0ceda51c5f4c1e2d7b247211ad19f9625431aa200b2fc6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2896	2764	iexplore.exe	28
PID 2764 wrote to memory of 2896	2764	iexplore.exe	28
PID 2764 wrote to memory of 2896	2764	iexplore.exe	28
PID 2764 wrote to memory of 2896	2764	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13171f2654cf39947ede1141c3c8c9c9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a28cade07dc024bf446fd0c79033e39

SHA1
dbc717e5073827f3fa06b4e39195608832f2fd9d

SHA256
04e4adfec36d63778add4117bc56e51849e18c8bd0bfa3a59b7243fc5708841c

SHA512
2b3cf812260164222558bbcc5ee6362a53691eea81c55ad8cbd1c619b83fd5d809429e6aca8f038d67d4b108e5749072abbc198206c7fb8a13402c23a25e3256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d03f3f6ae3db31390f1fa607ee826206

SHA1
6a04ae6cd86a3378b1161a6f8f37ce01c3467499

SHA256
243b5faaf8ee5323eaaa36e6a4f79b740f6d776a4de229ca647044cb1419bafd

SHA512
7dd6b96bcb240190c5d35afeeec83064e2eb702741d45d9dcb3ee1a05c56d4bd6f05137faa8442e0c4f648ec55690fcc25bdb24a3415f04a7d5775ae9cb593f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
595bb6ca708aec373d650ab54c39d9d2

SHA1
23ac1a13b8c8f7b5ca44a55d14e646c76972cfb2

SHA256
648063d9f452885c16202af24ebd70bd2f57a25a3b6f4deb721fe069ccd69260

SHA512
c04837895a7ade59cfac54c0bfd49b512987ad0e40c83b25cf5198321d11b81b71afd1e1e1d7bda9da2057030a8bb4ba18aceb1337020d88987dd9086c59ebac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fc2208e20234504f2e85db0a4cbf4d9

SHA1
6194d23b8bf63b979f6b48b788577552dce5e08a

SHA256
3e5df986770013e64979251002f9207dbbaeeec709d73b7b69bc830044b86ca9

SHA512
4dd20350bb245d4d76adb5e45f63b79f01617ba646ec3aa78bd05789437bbe13e4cd5eb505106d009831c26c4c627c7d19d5d2f1025440d520fca1ebf93a3960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71d2e72568801dfc656dd9101621f51d

SHA1
9ebdfd779038b59fcbb2334a263bc82f977288d8

SHA256
8304b307366b957d3b50436f40d5d652344d3f4899954e7cba739f4b8bc19bd1

SHA512
2f782a9ca0679fca498b506bfc97b213d9d33c852640471331ad8bec47f5813372d9f30159e817a91e875cc3e6e01a0275084bb9cf75c45b53ad7e4fa4ae4790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89ac1db16af56cbfcb036660bf9c8104

SHA1
ecd506fbf228eb532156a74bc6ab26285586d3d0

SHA256
8805558c79a063fbea504264b9a795e87c7b941c25faff0b702a552035eb8f76

SHA512
bb3b3b33b9da1805900ee788ccbe6fc51f54f6dc5474f2847fccf079f7a6d34df8bfd86d342a8437e2beb6ed5d7c7559fb3872b8fb1b6e0c33b6ab4d96dbfba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3e1e9b7d5d221a74ab628f6d401baee

SHA1
1d342dded114826d6aa18dd9a3fef7e68067ece2

SHA256
92699e5f069be0a65d4554f21b93ddcadbf9f731f72a39c2b981304e8ebc39b1

SHA512
dcdaa6a7a59049a16786d423cc5cbdb50bab58c6458c5b52bb075702306ce333517285e1f9878c1cea262edfc4554f5cebbdfbd8f7c5110f25ec78046cc641cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eed53ef5b37e0d105aa2896217662257

SHA1
93976dfa920b91e1b51c286196c6e1e6bda04d5e

SHA256
0bca677c0b6a9827f0ff4a94fec0a1e5ff274ffa1d5361e2ca6b9c468f2c640e

SHA512
26827868f2ead54aad5cb1ed010274e3dd2b96b7fde349cc842e1dbd328eab7dd4f2fa46f20d5ef1e9b515d211d03841e894969fdabd36db156f6149fb368055

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1bca17d7f5bc1cc68336f79666d495a

SHA1
b42e318e7e70bc9660095e21ec9654f88b8ff0b0

SHA256
1ce2e6e77d0d88d1a177c380339adcdb937d701cadd89f6d687051bfb5337bce

SHA512
a5d809654a637126c1e009b0e2185a71620e84b4cb753da7d970e9258133ced9d618c84b1c15b90da9d4e59fcde01a2ead8bf9da999d08dea1a3e55f00efb8d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd1b020b5dd823fec6b2e72463569305

SHA1
3e136c06c97ad2deb71d2a56555ee6feb22bc802

SHA256
0a68bf6987b8fc0cb1ad8b4f70aa38491d2e983982559ffcf7147b86466f077c

SHA512
1b9ddd4df5d7d14d7670e30aa8c3a5ee4b4ba974668f14d536c53944356ca28f7a8a1abe8adbb74de72a0cd1003b930b301ad8e072f0156377e5eb600db3d258

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0b3a4fae7847d6f11804895be037dfd

SHA1
1cf3e3200bdde21460572dc25b2c692b3cb469a2

SHA256
4a055189d7f0c08140f3bc76bbfe22f87ed1d9fefe14273cf3998483fe4db774

SHA512
871705b1cc3cb28ffe253f6db66a26f3a4c9254c1f2aebcd35b44f1a38ea4bd7203f13c3b3ef0d54af012e9458b0d13fbfbd86b8fb9750e0c5ce71cfd4ad9d46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d5dd0f52f1ec794c407a3809d88efbf

SHA1
ed2423da9137d2006121a7a1b519ab85737120ac

SHA256
e2ad5f4dbb72332f91b515497eeabe8b54cdde2e91c04cdd9248b508ff95a3c6

SHA512
d4728d79ed87c58aea39e42440c5b483f0a5f007677878d57f154a6a9ae19922eb655129e484b2e325cf0d1c23bc36e1371f5c39a572f809f60ef72b90e357f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
509eaa64ebc505daf4a2172387b9cd61

SHA1
80b88d7d6241ccb84ec894821154cfa5cb558677

SHA256
7ff71efd1c14cc41c6386c5c8a87b2ceb30fa631fbc04536fc35fe84f4c386dc

SHA512
5e8ef315c273ae54f8ba6669d32894a3d4adcd9c21e81f9dc66f9c62c855d14b48874c3d10aadb191a198715b6552e8d0ba126300060d49e3bc6d6af0c72254e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c364947d11599b6375d9a522ce39667

SHA1
2be528ed3a26218c9f39ce6b76d08d2ed04a5981

SHA256
dc7693ea36256e0cfab514c4c7fd38b7c463cc19a54cd5425253f95f0633cfaa

SHA512
8051f9842ef0870ae793dc24b12d093f7355f9b7c28fea3ea1cd8b4f5f95c037dcc34045efeee0e2a3bb51b757d7bf9903bab84fdd0452473043b28ca2f6d0f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebbdae5e741e69b4639d3cb6acf4bb15

SHA1
e663a16117a23af1553a7f662b644ec97942fcdc

SHA256
a0fddb32cded9a106c8c8428ab85135275401c8d61b61eba20d0fdcab2b7cb62

SHA512
61c98a6617b0cedf5a8827bc87ce212e634540e5e0343adc434eeb25204cb4c6e3fd943a8be41ef229a387eaa8e0e8eb2968a7536ef1b17764c99f19cc6b666c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b807c12dae8bfd5cd11d451040fece7d

SHA1
9417c5099ecb94ddf65e496df6dcaa58fc72d7f2

SHA256
ff00a88f0bf92dac6c1a346929f29f2e82933706ec4de7798a322ac881861990

SHA512
2a885c0fd923b676d6d462d00560bcfa7964b02a6cec585ae73b647f7244246d50fc10d49f583f1b94e02b929c77d8ea1770b2e1ddf78fc2a78ff66a09e15a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB703.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7F6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit