8f6b30e5098e0477f58958009b0fc39bfff0e565ab425c9e4d5fb47f9bb8b44c

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17b19bb82593d826838c6f512a44a0c3_JaffaCakes118.html
Size

18KB
MD5

17b19bb82593d826838c6f512a44a0c3
SHA1

a6efce94359d60a5453d25c73b976d177a871baf
SHA256

8f6b30e5098e0477f58958009b0fc39bfff0e565ab425c9e4d5fb47f9bb8b44c
SHA512

b04dd03db2a0975c61cbffee7301a53d2043e7addc235dc3f823515e9d209d75ee5a328bc898e86c7e7896c129e9c43d0d111facc5e550d90e4e267331c6a210
SSDEEP

384:WWqU09Pl7hTe8OS4f6DtbLTSrAAkIZlSXlbsBQ:Ix9Pl7Y8OS4feSr9Q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11FEA271-0ADC-11EF-910D-CE7E212FECBD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421074446"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027606f6d617734469c9a02e79b7d5f7400000000020000000000106600000001000020000000b3518b083768c069fbab395dc80ec4d405cce5917179c683c867ecdb4a0d5573000000000e80000000020000200000007a8b944fd75d51f3d06d30ede2c80e863cdd68cf95a58b71b06a69c1284b3d172000000013d40ded2d9db874e52d66cfd52ac1e4d08236812e4f7422e3a2d789e1cda82540000000afff3164530d645a89f070f481f5259a7d7c399f475c239c0fd14b14d86dcfe5d66dc474686ce4d86a9452928b24d2a9612b5d10838375c7b82a623a96530ead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103c91e6e89eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027606f6d617734469c9a02e79b7d5f74000000000200000000001066000000010000200000007e36275cf96ec8e8685c01ffcafdf779871bf44f19a0bf5223cc50d7e39ebba8000000000e80000000020000200000004e600f3eec222a2dd6965cdb4de7a829ba270e88845bce41afdeb21eca3a3be590000000d15acfb827fd6106d5cae77f12b6b9a4e7767bf6bda2f7a14e06907875abda3068965b991d2183fcc77ad84f8eed3da6fc86b1a12c4e86133273871c76a3078cfe13cb14dae9425a84555fd7d8fbbe261fdc75b752fb956dacbe2fd758a215a2e6432ee5c6d98d88dab899d3125d612f82b65dae0314cf1355cb2fb771a7309a6fbb837096caf88b3fb7959cce61b1b740000000a47211a60bfad8f67e75fdb5c9e090fc7b7e097126ec98d1a4d52a6c20a19945da5bf66897cdf7728aeb7175e9e3e3fbad10fdd918069ce396086eaa166ba7d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2388	2232	iexplore.exe	28
PID 2232 wrote to memory of 2388	2232	iexplore.exe	28
PID 2232 wrote to memory of 2388	2232	iexplore.exe	28
PID 2232 wrote to memory of 2388	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17b19bb82593d826838c6f512a44a0c3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7e78ce3e52a2716736ba87ac38aefd50

SHA1
a13abb9fa3ddce3df3c3a3d09fb0d6528843f264

SHA256
2e213884f892907543811e1c34bcc5dd95c611e7edcbaf792f6aabb6f1c374e0

SHA512
080908dff82f7d3a6bfc42e392bcbff9cd05be6f1734411ceff7d6cfcdf399e012c5d771fed7f355394af0dcb497ce040a1b3d619574d9de00b072f8fd84de04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47798e4860b5dd740a689f2f22ece9db

SHA1
43f020a0e4bdc14552f49972a6142c5633b4bf3c

SHA256
acde5a347334d7c48e2b4317439710d56a363c1afaf93291823e6841c093058f

SHA512
2b6fffeb8e478d09abd5ae4d71f1d361bd4fa712b781417976a983ad1cc22450c89725217716d49d64ca4874bb943717f47d386957970c786137030227d6a51d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
035e23513224f1ace93bf02e2c8e7ce3

SHA1
e7f31ecf676a140b1025c95b0e2073cbf32febdc

SHA256
5375e937172ed14ffee2380dedcf74a6009a55f5f924ee657f23fffaaa99d91d

SHA512
d9e4d63f51e819b9fefee4b35622616498f5294b627e0dea76ec8df4b9ff2c88e4fb4c38d3e0e8896a223291a06e73a0c2e5ca59da136791f6cc84c388f4c5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5825b6304ce51d4c2f9c98206c69f69a

SHA1
3d23aadb871b44bcfcce86f13fb21eacae19783a

SHA256
fbcd9cd7ea96393ea5c9a98edb2eab6a5936d739b5ba197bff1537b655dc806e

SHA512
c70088bc76c70bb6356c574a70d380a636749b20bdd7cdb4f6480e5b4df999749084fe15ccba0ff26329ca27f207fd7ee6e2295d7ee15dce482f7997969f7d87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5168837cd056ef66c5774eed2344903

SHA1
12b6f95a22d91357d42f3da96532d284a6eef80f

SHA256
768907803dcb7ce563ffa3e7f242a1285854f68bf569df3dbc2dc99f6e1de631

SHA512
842d5212196c7059b163b531e73f0158900b3580e47f0470b7a78a340975e7d340473a035a5270fe819a33bf3f7c5c89187a7e94a963af821860bc800cbec91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
459fbf3bdc7c09aaa2ff93677e436d2a

SHA1
c9a36775283c631cec59d08d58a2a42b38050363

SHA256
f1a1b24dd4571e6b5b4ba49ff84d9c6942716dcdfde94c6eb85886d57e0ed9c1

SHA512
b2119f0e2651e3f0077c3ccbf8e70f07acdf50c79da29d4c80782af3bf1bbc6d71693c0242a634bdc40e11f96ff92169b48479f1a4707651bdeee76e30326f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
673f191c2edd58593d0de988c17ca99c

SHA1
8020402d62f05c7921371059917a1dabff36f2ca

SHA256
61698ece947efd3d44c0175d52ae32e95565bab57b9ca438454702d50f6f18a6

SHA512
fb2f6c1ee7ef62df78cf0d334d17dde2f7f2a94b87f6169a7abfd423a35528fba949b9f14a8ed1c3fcd93ad064983a9aa8e22bdc7244292b0a381212c28669c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67bd0bec8b9949dd6907661d228230a3

SHA1
393f8c8ca49e23a3a3d4b7c664056b9e5fd0d718

SHA256
7f30edaf240651e0d98034275e838991d53d720ee26f2b13bf05729711877e0d

SHA512
9bdae0380187d974a758fb75fb85e9298d6070a7e60b241b76ceda57dd1964388f318e6e272940bc836449bd5f7ed2036b2931d41e284701ebf3b423ac3f6ca9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcf1718faeba397ea62d7b7e07a4593a

SHA1
7774eae4bb258185ac29aaf9f7d152b64e43dc5e

SHA256
ffd0f1279c7a2fc627d41c9f8953404b1d89f7064003373655e94af84d457b69

SHA512
2511ef524dd6e5f09a74a71286ae4bba2bd063969476f15de3bc0c00cf29a7bf50de747532931b3815e15774e4d485f19029c2e6bf31a1527a11e0684503abf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29034e2f9b8392f32feb66b9e671e10b

SHA1
bad347bb8e65f3fcef6ec0c2201a4e86ed28bf7a

SHA256
b2031821ecbd02456be63443c02641d647ede0bd702dac1b6cf224b207bdb2ec

SHA512
f434069f63f854a025ccdee66dd672d8d4c65d43ecd7b158a6a48b6e8093dc90dc901a06bb9d421032083b994d7adc350741f56f68aed42e44d0f2729ca10c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97453715b83aa2a2125babbb7e88c72f

SHA1
8df8a4da5991ddffa2123add229df4b62478daf5

SHA256
f0c83e3b40d55303eb4936b53c90d76b11a693c9acd44a098a88fb5ff5a87e67

SHA512
947e0060ad08bb212c3c6dbcba6eb8a72553ecc11faf0221e6ea0ca7c5fbd607d1a10b9c2cbae9667aea602ad9d98bd715c6b582ea7b214f152549cce0cab38f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
801317498bf3d534fc66491683050d01

SHA1
dd54ec06e41c347a1302ee37869b6d532026d93d

SHA256
934c3b9959f5899f99b678885953e749eb17fe1b83ed3299b8bec9b8f688e1df

SHA512
876dfeb67d24e0ce82d3ccfa99e6dfc03fb51fbd7c1111d40bf885bb835f04d480780d949b02b46cb7f8626bbf00eefa43a7e283b9301ce606a1f4ce9d1eb28a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C64.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit