c89e872fc4a369a52fe16b2c4822f49036bf92391920c509873481b3d08191e5

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

134ecf7d0d0eee6b3c9df6629855378a_JaffaCakes118.html
Size

68KB
MD5

134ecf7d0d0eee6b3c9df6629855378a
SHA1

dd047d318d1056913901ebec1ca037a059f79261
SHA256

c89e872fc4a369a52fe16b2c4822f49036bf92391920c509873481b3d08191e5
SHA512

0db5b1e1e23367aa42096ff1eb2147d8908268bffc046f243b0790b64fad1acf578727e999783affd05c95f9b13f043caa5462ea762fb63d9ae64df0197764c5
SSDEEP

768:JiKgcMiR3sI2PDDnX0g6+/6OpioTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8X:JMLprTcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD619CB1-0A29-11EF-A6D5-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103e20a4369eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000007d505124ed1a72ba57cad7d6c6e5fb3c3d61335947e4eef439150056041e319c000000000e8000000002000020000000eb298551605fbd4fd141cc066b07c3ce5ffefa58be5b62ab3d2cedf91f7bad27900000004f4ec6241f767c114fbe1a48fca1b53ad705d768de6383ff4bc4991ecefe07af34c9fd22aa63b12c986af0549a27a194f99a65f92218fedd79c1e8bd11d4c5f08af5315578f0c50c569b3309e952c2131dc0ba7c6a3a31d8b87c50c442b8441f8ae0808a6357108558db2a5c54fdf779ff9296d6d2b8dbe8a0668295f4423a2f78708aa3e1404d6d3ef420a20b935c7b40000000066c2992c26fd2fe70188fc419d74cf5fa5a8c1249ada77f4d4315e0daff62be34dbf075492f39be0348c8036b097fe15371edc7fa77aa46110a8aee2c4ee284	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a336b22149c83258cb363d3e696e3e3653f7abc91adea01199e01f7a6f938b83000000000e80000000020000200000001695faa733db66367262a62323fa1a4bf8da9b452d7922584b71eb085e273df820000000d04b54f6a888704a320c80bc1796c682983dad4adcd4935f74730ff63ab1d80540000000158ff84610315e5ec8020f8d2e9f99be065e2bf5db084b3fb33c8d2ec5f2aa96475462e7b51a59db7d721e5ce7b0e99104b5ed2aba123e5e5934db0e6a0ffc41	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420997882"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2240	2236	iexplore.exe	28
PID 2236 wrote to memory of 2240	2236	iexplore.exe	28
PID 2236 wrote to memory of 2240	2236	iexplore.exe	28
PID 2236 wrote to memory of 2240	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\134ecf7d0d0eee6b3c9df6629855378a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d71b99f019edbcecde3601792392a504

SHA1
02c8d4cc06fe03842df93d99f1e850422d5d388a

SHA256
b14e13ecc7fc3543e6df39d9433f826f2547770daf1ccf5cddf5344d0e68a09a

SHA512
bb6ae69668021ba54abbe2ecdca118b35780a6683d91e6415ca52607b77afdf209ee97e7e0ef47eef96a55d28f264c2b6f829616b0f53b4e9f0c8d6b47abb173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18688ee1c116bf4c82382a79f153b091

SHA1
e146b7414a9e7fb029aa69c23c173d67cd41395a

SHA256
1e7ebc2adfc3d99228835ec9224d04acd78f6982feb704e661f1c5ec4eb61e23

SHA512
e539b52514a0be10a1fa43c0b4869eb672113de49a9bffdc7025f1c5ad72663cf11262f1bab81a5d8526371ef67923d8f689d6f01df475e34056c983749df4d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15c5b459dd3d4218a7b40699a5a75970

SHA1
9c3e4df31cd90c16ea667aab7c25a8d377d17c1b

SHA256
12c48c44db51a9cefcce18b4d2a35ec50344f5c1899c87e0cb880c233c37b8af

SHA512
12fff9b9c197596d8efcfb787f7ae5865100f2de78b2d10a17dc1508eea36c530aa2586dffd488e05455e15b866fa4cf96b046fc09fe05cd4470f8e8cf9ce43a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae802bcf497a878295f1e6daed490960

SHA1
bfbcfdee5695974cf832361d97ca253d2e329c8c

SHA256
83a5acdf83bfc92a06ef17cb998724539f4057afa2ce8c975a86336c0a656071

SHA512
99e6f28f96afef34f876c5a3412055f4f5c07d76b9c04695da67e2744e7b580d9115cc60d301a996eb8995689e2a59780c74b3e6dab9b5b88cd6c9390ff9666e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77449d9d2710870b746606adb3a6b157

SHA1
024a9fad1a30437a3cffc713770e782efd9c4bbf

SHA256
2cd8114013a5f18ed97ca532f1433061d0423b6954692550fcd0bc3b360a364e

SHA512
8f8cce9b55920091ffaf1f8cdef8b5d70142f9f6ced2dd547af3e8715d50137631dc5321dcfe1cef2de54c67516e44c1942b91c898d044c24247d6ac444ae8c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d5c84b4b50394988d74448c65b7ff2a

SHA1
99afe126ddacfaf69a3d8500d595d349129f8821

SHA256
ce62945fcbc01d9d8078eabd4146b4b100901f9fd0d0811851cf94c039aa93bd

SHA512
a2d1871f61771f0b06645ce02b72801b3a1739a35eccbc5b4969d49c5b6eb20f2c2c7e7857520eefe6f9cf98c20a29e112ae0c3dde231408b98c1565c9feb5fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5127293bdaf7b7899879a4cea563648a

SHA1
1e25425b1a9179c7007b4030e5fcc43a68e53bee

SHA256
a20fde5c2745f79575f309bd51279d36d2d6e36ff685e1615ba62eaa8d649a4e

SHA512
df440b74afa88460b1e14bbac85bbb5468b248c1de0bb313af8e9d6e05a5d78a2ddafe2e704440fa60d565de20d77570b50c4bfc668c644c9fadb1984d644a34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69d3313a1aa729d66acdaa052d08f7ff

SHA1
191ba1a3fdef2d50068236509b546f83b1b0705a

SHA256
bbfffef5c69f59d4dbb9ebe1a662babd5e70ff3fe3e2b21e2ad8fbc58c2f7fc1

SHA512
04d7ca10a714cf8dfb8c3599c2a1678e46bcfa919db9a72da55202185adb688a4614adb3d3187139aee37495ff3ee06bf0ec035776da8d8b612eb12742b96e0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
182996acaf5707b2881f927cb8988a68

SHA1
5933d79cf17136d0e44fad0ffc535d7931b002a2

SHA256
4e24964b65f61f5af3efce89868d8e204ad48abaef9251766123895ce0e842d0

SHA512
350083e2ec5c7a76998c3eec43605847a8becb261dbae9f7f12a1dbccddcd041ed8c6f6f6b68ecee6616e1e2935f92781460c093971d45f86c9bf0b3eccf28b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
565101073ee2324e2f7534809938440a

SHA1
37f1ec091e1deaf2a3b0626dd4ef0a3fe4928c8a

SHA256
18d2fe20733f4b356d20b3e88fa3829241b6823e0de455cab3db7fa6a2958dbb

SHA512
8f56f087538f9b0b32b69134aa19271a904b6b972980e9abf5c9778f60a5180d7ee9e11d4bae8030662fe3f274a07227b3fc73a9120e0d237584c742639e87dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD877.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA52.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit