89b97604d272c1b3ac234c7d53e228dd7f4b21228445f5989df9b5fcb28f1f57

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f01ab9639b58ea329c193b15aa17f9d_JaffaCakes118.html
Size

23KB
MD5

1f01ab9639b58ea329c193b15aa17f9d
SHA1

69be11e74da82ca7528eeed40dbd657db432924c
SHA256

89b97604d272c1b3ac234c7d53e228dd7f4b21228445f5989df9b5fcb28f1f57
SHA512

6d0e69d1cc039b7f6355787c3bbf0c5448e1d2916cc34a0f8223f6b4e2d0f7a416a1d2d2b232ee0693fdf606ef1a5d0c24079135721f77f4a42363370171aeac
SSDEEP

192:uw7PznX1bb5nbanQjxn5Q/KnQiexNn2r0nQOkEntiMnQTbndnQtBX9vMBRqnYnQb:XznX1dQ/grqi34

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000052ba24b1f9c27b52b9d7dbc365fb2fce948b4509741d8599bc77592a1470b90b000000000e8000000002000020000000c4f27170a86005d40bc3dbd0f9b3adfc361dc9f682be099be5a23dae36766ec82000000027592d9a5d5aa5e5c0e31f36416161f2470c9e9ccc286a036b3619381a970dfe4000000001d304de430fa1e2cab053b4a884710c8869bd66f202f6744f9609f0915d4695755a9c74a6afe759650601be7cae80d29ed62de9b82bb4d57b940da4c2de2920	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421207763"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7928DB01-0C12-11EF-9F07-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b8d84d1fa0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000477a34ed13538a2d20a5238ad5fe27ae7e67e46d0cdaa4b0e98688f663e14828000000000e80000000020000200000006686c0352eb3acde2f5cf22f44a4943e3bcad2df3f79244bdad6cd60ce5528ed9000000047c794267445ba3b924193e6ef40c09a3d5fae9f1627b1da12b4947b2f8ed8c10f7cab9a21c5edc46febf23a4395459c24c0a18868fe83cd4f0d5bd2144da5753bf5d9d120bb86a8a7bdeb1a95d98df66782415fa010345124fb552bc20486990e14e39b29e7b1624cd61314a6305bc8c3bbed941211e54da9b3e92a7fcf4c2cdf18209d95eb57715feefdb95fefe6574000000097563d75eb8c0bee131b111c807e21fcb4e9beddb6581a983c338e41e10d7ee44fb38685ba0e61c2b2ddd73725a2260ddc43d3a9fb4e6092b76f43f4fe26a2b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f01ab9639b58ea329c193b15aa17f9d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20a1324db592276c4f01bbab7c5ec085

SHA1
501f7a89717cd0161e901d2b53ab5d62368cec24

SHA256
11d8249a83c7146d521fc9d69e05c1583b1c29dc4672408f049f974c3017b697

SHA512
0de264de462082d27c56bc7a61620beceff8c46efbc801c8609502d9ea68ab937aa092b465477776375f53b1e32ae4e9c3a93aad8a18b460a2a1d5f405cdfb11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb53f939224c5de21899b1141368ba59

SHA1
f87366b34cbd09122ba5a49277ecbb495ca13bb7

SHA256
eea679ef6ebb7140bbc36bd192e7e8e6e44a5caab6fbc8c28b849cd3281f036d

SHA512
fe17327027f5acb058b25dfe0b3e7bf959e7beeef6ef0e36fa31d434fcca70bb38ca7e5b1679a66ae651fce2cfc9b8ebceb9d07a9e79395a127a2f70fc82ddbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21488bf54503e405ac909ea3961f2441

SHA1
8895165306b871e7eff5cc32bfdc1d15780911b0

SHA256
4156046398f6217be9fc1daf5fb6481560e84a0c937aa65dfed4c61be76463fb

SHA512
5b9004a081287abe9b9b43d5beca7ff823587d2975f55618d4bdc8455f2ea68190584e21b8ae2944e58e1a9e58c7596f433e37c6cef0790d7cdb3d48bf17a093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b1c9ad5619180a95d87763195271306

SHA1
3254d59ab8618e836d381f5164928004a20338a4

SHA256
5f11a3c6995f65a83a8559cef3137252941a55c1381979fdbc3889dc0192e5ec

SHA512
6b3c08ad35c7f7460c178b8ac361a53447c48c790def599713f7c8a781beb4d49fa183784a1e0bae0e790bfcf29f91b0735cd8f8c6607d5269fd3cc40773595d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a42180c952dc9e7370317d999b1e387f

SHA1
a641306f664297907f58b06e1ec5252591a265db

SHA256
8e72cdfc5b794ff4f98b06b8c286986f8220b92425d3b74129328bdfa15bdaef

SHA512
931e013214fe35b741436377770e8d819bd5f7f5e646624171624d758c652f8ddb506b5303009ce6fa182cb5933cf112708106152dd05c0828acde40bb9e2c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcfa454a2edc6499598e303648b6751f

SHA1
2db5a63810edea8f379b1f08c5b08993690e8581

SHA256
80982f9b59e6ee17cb22f298dbc5832168699663fb9e605d5be211f92e003e6f

SHA512
76b39f95c4a49ab80d580273b8c9e592f54a1ccf5f57634d2acefcf95da0a12840bdccde92420b5e4256fd54da6944fe66bdc68670bd583012f5f069e2bb49a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
271ae901a5e90f2e79bae796b42e051c

SHA1
4f8debc418f0b83973180cd46965f22699273989

SHA256
54352813f5835eb7ade2df2637eb389f421e77c5ba41ea0bec0fcf8c71a74ae7

SHA512
f6ac7712afde4930e95eb8b978b5cffa3bcfc97552c753c2496f58145512ed652b49ebb1fec79bf2171731e1032ad622f2ccebab5643829e1891773706b94e1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de6684a26101c8db1a2d2ec82a3fce35

SHA1
60f3f5223ed9da91564cbe2274be040c7d83a520

SHA256
48ba1284e3124c46a5506f35c1ab3a0e24c08388fe5f22f5ac31c69852b41bbb

SHA512
e558c19eb4263933a1c6737e3143e4ddedab7609c14507e7613617e6f00e68caed662d4888f81b0e596478c57680a9f84255f71f68164c32f0e0476f26f2c087

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a80ce990f3599ac2242c3b2fab2f5de

SHA1
745c0a1d60662326482607a4695abab01c36e6b9

SHA256
6da179616cd279fac6c6fcd4af8ff5cf20d930b264e421492fb44effa84512ed

SHA512
290a7f88d4efe0212cdb299c5f5f77b2d96cb4b2ea90d3a89dd99908034f14fed266ffe3b71e811ebad961df84e859068de58fb8e21688a147b543f57dd39f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdf93950158d50f1ec7500121abb966a

SHA1
6a4d8537546e5833e0bbcc25ad23f72a97b982e6

SHA256
b65b974855e184321a33f315c02b86615df35283007f98d03757f432c0012518

SHA512
11e66462d6c194a310b8f5913a307ed2b4a95661193d4af2f153a0de8231285ea5c07c232d551dadf1d93d693078dd53e13dae8f02fc302992fef066e2641cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar291D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit