1dfb49795ab1ec297eecaa6eeb80f0392e3a2c18ea4bce702dc6356467e8cbe7

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

163e89bf4b77a2bbbea29ffb2da6fa9f_JaffaCakes118.html
Size

139KB
MD5

163e89bf4b77a2bbbea29ffb2da6fa9f
SHA1

e0f59ff20504ea59ee3a9e8cacbc28f64ab50084
SHA256

1dfb49795ab1ec297eecaa6eeb80f0392e3a2c18ea4bce702dc6356467e8cbe7
SHA512

8e82bba4fa8ba387295198090f5e6b8316e3b3b4bb27b22c1511ca0091337f391d0cd835b168c18f27f2071d24fe4737047d0a21bf5f83c01c5f012751f99648
SSDEEP

1536:SmNEiRLl1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SmtRTyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4E3B251-0AA2-11EF-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000dd855c9044347d4c96d386cce3f66e7d2501f0e3dd152b97eb10b465816f47c4000000000e800000000200002000000064451ee751a776b2a88fea76ddfe04b32a4de8a5055dd6f988124ab1dd0ab9be200000001446c498115a940d69882556442a517a99dc06deaffd018c1194a7d03bfd978340000000baec26b27e3a88e9880269c106141229d1d1713f9f408042c2c10f8ee1262b6bd1f1fbe348fb04da2e2eb76fae587186c03d0117d1b7a82a56c08e514ec02018	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000001c619c878a7d3fb388927c0140d800472eca492571a2a9ceed50ad5411b0c032000000000e8000000002000020000000c1d1a66ec41894d5f00036cb10e8474d48a668e68d7470f56bb2d0e1df24f3b5900000003d4a919ad34e9cd9b6ac45d802d3c5b0899b12bea35ccf66fbcecadd1f800f2c345e561d13f6c53634faac2799a62a80b89a284040862c3978a1fdc3cb3ad5a9b942ef02139d960d7b24a8714c6dcf543b9bd419bd220ecb67b6c8d03cc850ac2cffcbd3a773af1187ad34e38054ebaf780e99ea61bc5425bfa9fa664ca49ef4db614e8599e7c60b86c6d368a8e2da8240000000cdb842cedbfb619a62ed12155ad5b8d59f2fb60003152ed4f1a28215d95a80af35455c32c8bbc798959b8281a22e63342b2d040828c60b2efa331a724ea04f51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3089dffaaf9eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421049889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2548	2156	iexplore.exe	28
PID 2156 wrote to memory of 2548	2156	iexplore.exe	28
PID 2156 wrote to memory of 2548	2156	iexplore.exe	28
PID 2156 wrote to memory of 2548	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\163e89bf4b77a2bbbea29ffb2da6fa9f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f209ba27602ac8e6a2e22f882a46375

SHA1
afba29747e286d782f6c7ca9c814b0f33fa83f3a

SHA256
2a03357da08ed2f4f6251dc164a3dd8b959b099246b2ec75e9490d69c8e7f3f4

SHA512
9bd1bbfc7503c1ace7d1379ee884a1720b21647ee2e55b3a9522bcd2f3b0ad53e39b9e2cd2ef2e057f7bba0a869936a5a94bbbd9f92b9734d73bdc2ac6ab791d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7466a553453abf53572cc158d62d3d64

SHA1
58e97fcd07ee3a06ac5c59d941ed21efe1bb1adc

SHA256
564b0cf2e62152ccced25f9972bec10134baaf1c0ab80602bdbc5e173865c28c

SHA512
9801507a174cbacc95602fc4e0a01440d40a630c20997c068423ae2fcfde46e8abb6f72f0c5cd640ea25ac6f1327c045b0e0ab787f309916eb99c4f2dbbdc018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d519f3131a4b11b86591a5d0a9854adc

SHA1
5c2010bcf0ccd006d2348a30755b7b6b07b500a4

SHA256
bdef7470ba3e90a825b00a07baf39005f49bc30fa51aee50bcc5ac63c5f03955

SHA512
5be3994d5572fbe26fc01b72ab5010ecb0f5f2b9e56bc56e1aa1097baf6ee0dae4f99f229bb2bc75689f956953141e6018d4bb54288ed9192eb3043001d22eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1431353a5581232ef5033342e73a1a09

SHA1
76b0aa4795000b5e0fc002fc9953ccf290d333a6

SHA256
350c2945b10c2252f746b41b92e7822600b320354b53f0c3074ffc20d8ad0de8

SHA512
7f95ddc8ab9bf2184b5ca2122416d0cba54ba35f5b5a1120d1b83eb8c63cd8e5699af6f3d8ea1e2d311b71890bd2bafaf8df90326b5e026a3d9092b6244e3925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af813d9d6e858fbf092e1250f823f951

SHA1
869c1865de65a0a6e42744065e73a4797be78532

SHA256
226272c5d1d5673e159365b1f9f6885ee28cf13ac6a27a69f4f10b0dfd7e5570

SHA512
5077f9becefe4e1b5af4abf95e6419ad4c332e00c03799ea3a2faf3e3aa4933d4284cd985d92ae9aa9c4703dfe6832f569a9cf158e320ec91d4c44fb2749dd9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785b7509c1651f5212fb372cd0cd617d

SHA1
7cd8ba60fb1c1fb93897c0fc6f5af0aaa303c9c4

SHA256
2e062e62a7b2fc11ebbe825111fd1855c021c43d0f9b95cd3687f70589bfd7c3

SHA512
0166b0d20da1eba8b3c050e32b81174e5fbaae25ffc306caa39eada2317dc610fd6d5b4ae6f1313e36f15a30ef1d2d8172aee64067d955cba46d5fb0a8fb12d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e5736efd12f0852a778b875c4ed86b9

SHA1
821ab27d0374b0fc1b16894ff6a645561adb4ec5

SHA256
d100be0c14fff9f1ae92e8f719f39dd074eac3458243d8ca7162a3a69ce5cb9f

SHA512
a44390de034fe3c83e59e79cbe021996ac8b8bfcd0c62ef19425e4db852142bc42960d6f09720719a099ca16d9da90b986e400b5ee00aba03e3524a46bc3042f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c21abdd8d52e1850f8bc7104f71b766

SHA1
141ce6a964e59a96e6f679da59484bc8da78bc4c

SHA256
689ebadf24a7cb23c5e864ad29fbf073e9ebe75d61a2183af3d870e2a066664a

SHA512
20fec88f3759d7df9f0f97be8014401fe71e2e7ef48551fed732886d28e820e76571d0861b5d8ccf1008e726565d97f4a1e8d386a6f6be3e4ef31e698c3df468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc057f3e36bee4812c68be86c36a137d

SHA1
310b757caae3930ec0680ebc921759ed61c74938

SHA256
c56339b2ca90fed558017b1435a46bf5638a8797579847aadf8ab0917dc2e18f

SHA512
9ddc739d12857a5c09c9bef3d446bce9da13e92e462451b3d11cca24429e42c806961a0feafe625e04e90aa8ec3f2a37e86177cd8d861d68c21b047dd35ac960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc4bab9ce075045da33d08e498eeefd0

SHA1
7842b6e7a425a6154862ba99741db1cc7063744a

SHA256
3992541d56383e4584f3d9d80d6307942e9c98cf506e21f65024b033e16281b2

SHA512
83b4aadf05ccfeec7113b3db31ee9aacb4a97e47d98161d108d90bc72a4675649fa48f9b957dceadda12e3b358184bd210c73e022a566e23ca7fb86efbb49f31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11AF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1416.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit