c38e1ee267870b85f1bddd07e252fa7157bb10bfd4d491d1a9f3587bad74f2ad

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1719ef4bf355f9e2f5ae0061f8fb261a_JaffaCakes118.html
Size

45KB
MD5

1719ef4bf355f9e2f5ae0061f8fb261a
SHA1

5d346e382ddb225428056b5b61a380421864540b
SHA256

c38e1ee267870b85f1bddd07e252fa7157bb10bfd4d491d1a9f3587bad74f2ad
SHA512

a305add08c59c4517c1a6e779d8d26e6ac5344066642f383b2304b2e7db1d30a2505764f88cc8cb44e70502e1b317964671d6d25b6a9d3b4aa4be2b04087ba54
SSDEEP

384:xQMIxxx3UNqIzOvHtao9oL8TwEh+dgCgLiwKgSHfy9YosS3knyh+ikS3wnDc+UT:xQlxHs8/+dgCgLiwKgSHa9hkny0+wn9A

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9F0EFB1-0AC4-11EF-9F07-6E6327E9C5D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000012dd834f0670e80912ab8a8f3db22ba8b4676950ff9139ec2d834c6eb5f41a95000000000e80000000020000200000007d2a659af63ef1b3d3e68d059c3f25f4dd7db387a3de6384f63b6490938d172c200000006887d2582929184258c6eb0f5c673f67f472161ad6da8c99772f50636653a1bb40000000a139d730ee6c1b3b23f679522b5a6ddba68f2da022a8508777085ca5a5b4fff491d358c46ee18de0a9e7e99334a8814e747ca03499d28b5a574716c076f846b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000648a00a9462cddb1d6a37a45ab362cc85f2948519528529427a5444fba608487000000000e8000000002000020000000d907b875928cc016dde1311570f1b3c87159aad91ee4ef3d90eb0e6a3af29da090000000ae55c7bb4459b573f52b12d4d1bcc84574dbb19e63a22394352654689720c436942943510ac3cdb521e54438cc50ba376046bc993ed80ab7cfd1da8af13d41757d132987319fbff97b4028c65efd71cf64896e05533d53e76786873ef0f12958ff3aec654de7466809a3ddbb7a8e57f0a41970534cc07180d98a7176f49b4482294275469f5d6c40b9b683a74872c3ea40000000edae18f1f094dbd57ffc02dc86a901389452b2e80a3afcd30145f92fc277d6457c67fa4d5e5a7dee95a79ae8bafe96ab801a38cd626ba9a3e5669dd534c65690	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a0cd85d19eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421064397"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1719ef4bf355f9e2f5ae0061f8fb261a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
691b36da8ff7a1e257299a5a2a8cf935

SHA1
b0230d90ab9a9ec95c3c8bb79d2b5e3432c03d0a

SHA256
771ec495da5343a2e587a4d82e9791dcc53f449d532ef5358ee1a1526bf1874e

SHA512
ce7e31d0d88f8545fa7e50d63148bd683e7e1fccfd04d4023dcef81e97c6f71d59a4e9bf44a600b5ea8060d8a9168edfb2cadf1daa85b285b2ac11e49289ebe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17675251af3df96ee6a934c3c606619c

SHA1
b1a9da5c44497b35d38eb8db6975f6b6fb2174f9

SHA256
dd6da3fee763b20a64a661052d197891e80d0a9a7fb0265481e5cf17a0fc7edc

SHA512
c8e43df5a03ce03c227482f12840a32e9404752de882857841b411613e7a6a766c42c92ad680536d7a62f86d7172c8734f31e98e68d6f5538a1c6cb2f3530264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffb49e5bdee35fee3d43ecb6ef7fc6e2

SHA1
f721024034c1ba7c054ec5ff88470d470f39ce92

SHA256
f315931b026a6011cbdb80a58e35cc9cb470054f14f32bc5ac5b04f056673563

SHA512
63df95c4e75fc9a0a00ea22cae97809683eea3c32b0c3fb2d0138edeaec9b266f61423aba3ec23a96ef77f0bc810df2b2955f879cd474d5da7dda7373efec42a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b116c93348bcc125f4cf6ec3bfcd9f81

SHA1
135a1ad592383f50a645dc6c63b885401d7bda63

SHA256
f6e358e22f1251812417e6fd015762324ebed3a6e0ee14c3c7873d6b7d1de42d

SHA512
15f835d088323dbf4327010287c8d2de45c40945f060f4968cdc351bc9250362c9e879ab44d06187aed7d54e07d2dcbd9c352abb0ad8e9979cc8818ca65948b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fefc01ad37ecece69101bef4ef9a2c24

SHA1
00055febaaae4fa5f7c66eeb8ddecd6afd9f1244

SHA256
507359e9f9e57cad0f183d749df99f7124ef00fed18400cfc5d6e5de19141c21

SHA512
36336c3523c361042afa28d1b2c29d04e5566625dfdca35559a004a19b18c3a51b49c74e2ff41c2b9f63e14a7730a116be8b4b64ccc07f36163c19bae6bd5066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a37708b8257df42d642a77b358bf2a3

SHA1
59c9a036e7069f7306600eab2d075e79d9c80e58

SHA256
76e6843c380b9362791e7a4e156ad0b8fd0a11e2b62046457e23618689e82021

SHA512
fade211c67bdb3ceb686e0e6cc77b6e725f895ea32c130cd0d68003b8921411909edeb2fe4c08e1016e2fc95c5c2c668299aa4952e9c775beb87a79b1082b05b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b975f4c38d258c2c904ceecb81ef3b88

SHA1
c9d527f64ac4e2e9c82b17b165951f8aa4f089b6

SHA256
49462f54a7fb1d1393d34dcf34e7042879dc16690ef0593ad80116387a04b9c9

SHA512
76b5e178df12766a94e08efc50e0303cbc235af49f2236279969e5d0b77dac8cce43429a66f13113614169f8922cdce7c7684911cddfc3e4c7f1f1109c1e06f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e17ab909ab558a1f7210986f5f7bb2c7

SHA1
3fca8a1b58135bdff8ae2bb486cda318ace9971f

SHA256
2750ef9269d43d4a4433268cb962b2e0f44b93ded0f41c9b15cfb2076f0f7237

SHA512
52734474977dabc9b9960946f13d434fbe6694bc28b8f4989ac5495aa284838460e4f3a8042b1203fd80b7e43f75c557fd4f5b7ad38b8d0437fc86009dfc0d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69736baae47d0e0f82f77e821b50e0ef

SHA1
f18130aa45ade4ccd4eb3a589a24ff48ad09c991

SHA256
8e7817f7d31e83f2671814bf82d09b046fbe8086e45bcaefcdd37514bf674196

SHA512
adbdd94ce8f6a01a5c355e8e140b9824045a93a3e7512525352ebe6c0dd6501b928ddd092b73cc8ce65ee074e9ab3c2f950da9cf75088d8ddf3ba10e5eac72c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecd933bc69f9fd3cf79d109a0b28e48a

SHA1
4de876bb50553265fa4bc300effb314b5caff3dd

SHA256
ea06868a52b2e4dbfbae656ae9d0f4af57044e789d831b9f30eb061aa926548e

SHA512
db07be58e3ae84835fca6561c3d1a3f49b55ebe8e92974d1f547fd9ea3f06fc0070d23c28fea724419638d6497f1ce2b601d69bc0066d8d9b54132eb10dc8019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e69d767963a64bf0129047f15c5cfd59

SHA1
aa342d2520c6040c2cd346fd0863d3d1da3cb152

SHA256
24e46d4a55009d7afcae8ffd90342cc7cf5a86a00cbe702c1c72ab77a24c9426

SHA512
4c047e2e5f898cfb90fa3e4bc57ee27edb6d7d3a04c5eccc388fb791665d49841cdcaebca96674e011bbcb83a367aab144254231a2204bb39c0420ba867df3bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
de6cf02adb1b0c890114a78014fd97d1

SHA1
3f1303d4acba4f5af9beb03fafa24bd24b9bf2ab

SHA256
c26deffd09a56026a714c24c7311ee4e10844e789e88d756bba2fa5c13d90317

SHA512
5bd7bab25eb4d8f9094fb497490afbe22bf5ec735525da6388f42416c6321e238dc8424edf9f6818069cd92a9646d8c835b77d213a2f7f15548c1e8e936b758e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2158.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2249.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit