f3cb82728907957e78d056a5bdf3e235cff22a36841287609fe14ec02a84df0a

Analysis

max time kernel
119s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fbd04f9b7708cc85149a3a66f2d4178_JaffaCakes118.html
Size

98KB
MD5

1fbd04f9b7708cc85149a3a66f2d4178
SHA1

a2347d7393d8e8c41a80d6c5c3d72d46d3f2b5f9
SHA256

f3cb82728907957e78d056a5bdf3e235cff22a36841287609fe14ec02a84df0a
SHA512

9b594cb48e638bd8154aa559fc895edd2c9d2c223947c6f7d3da864471e115ad470094fd84f64ff3494f6b2edd6ff255d218dff11f9d0d0917a418e4f09b680a
SSDEEP

1536:/ggFqpp0jBVdUVVVVVVzzSSOOyyy66IIKKGG8B8BxxxxxxxGGddttGaa22hhjjZO:/gg2pD6VxR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421225058"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dd8e94cff025df40b43ff0314732ee44000000000200000000001066000000010000200000000143f3ab72634abbd6fa228f390ff647679c9393dc854dc03e61a315bfbf71ee000000000e8000000002000020000000723e4a3efaa5863a40484bd4eb4ba5a1a264aab253302844d9fb57c9f06de1ff9000000080c7150f9e7a564f563be1520b61e20710c86ce51c4b5c1f665f33035ef19d9e0f2c1022666ce0a6e792cd8e3a3c33450ac384ed1daf0d266c41b5ff1dffc2807af5cc4b2226f199788fb680b89c402d67ed230599e96f7d3fcf6f583e375da91200c121de5dc836e91a8a051b251cd5e23224c1dd663d17d469a91b34ba7c7de4c2368a3d2dada7e71bdd438e98b904400000005ee92c33db282db462df8fb235d7d6f7487e01df10f467026b7251acbb3d1d422e27436f7243dfaef34eae6f097cb0112f8d56714bdae4aae5dae068ef2abdab	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BDC00FE1-0C3A-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dd8e94cff025df40b43ff0314732ee4400000000020000000000106600000001000020000000973eac8b34387777730ef3cf9d5112fb737f07265e0834dceb27f7cfa252239e000000000e8000000002000020000000d7dabe2e18f3712784e0efc4357b7678ae547c57320e7dbdfa1e7c8a00418a2a2000000047c71e1af4c49b1c80ac420fdf497a4e3a87ccbc855ee5b61858afbd809031dd4000000074ff28c0e8782c48eb3a704c959631e45108ed1382957befddc236dea1b801464573b2d800c2a0f2884b6d50adc8c9967a616cd2081cd24d3587498ac2e7be8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a6459647a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1920	iexplore.exe
1920	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2932	1920	iexplore.exe	28
PID 1920 wrote to memory of 2932	1920	iexplore.exe	28
PID 1920 wrote to memory of 2932	1920	iexplore.exe	28
PID 1920 wrote to memory of 2932	1920	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fbd04f9b7708cc85149a3a66f2d4178_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e4b719cf2ab226c182960377018f7fbb

SHA1
aed6fdd82892c161eb746475e59c7f6bfff2bd71

SHA256
4a5c2c79da80818029123c7702dd9b90d50637633fd33bf39fee6f92ead4dd35

SHA512
670c9190ec36ea8ccece5ef8c219986cd4f31f6081dcd2776d5af9464412c13f6f50e70ce60fbd1265c8a1667e36a350c2cf0ec03c14bb1159efad0d1bfd4ce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d23349530082385fdcaf1e0147792830

SHA1
e529bccaf051bc41f6c8056b0361b2b42993f62e

SHA256
f2b15a4b07ee37c93cbe5da2a7c05058b4273edb408f4b70cd5a00aa24ff896f

SHA512
6168b24a2189403c07b3f3e0ccf3b1ea0bed903115045385717e85b5f25c906f675084da1d58022ce7818133571288a9637d0daf463783b14d2b5bb041c819b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c25b131beb61e9d106af05a9414181ec

SHA1
38359ac6542b13de6f5a4278fc20510837fd678a

SHA256
de882b620204f459b1b5ebf8d2b2af9ba7917ca40e03bbb51c39a01121d11f5e

SHA512
fbd65841ba718b1dae806cab4e8f61ea76782f2874a61c2b02e2f7179a459cb28270aa443460c5a1bdae1fee34555fa8c7405f888923a3e0683a3226195d0dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fd44cff56d2dd7f31185b93f1b37c3d

SHA1
532d80895c04c88d4af03f73aa0b4d71431e9080

SHA256
58ce3b89a5ec870a243feb22e8d94acee829de6e9828dd2b618598435789cde0

SHA512
f01c4baa48f975567ff72561c29a143b0f4fb5f4dd9c94f1569bb77fb9f9b8006538d9741f1b9fbf1e802a1e2d056f13e38aaa1c5c27dc305e223d60dc7ed534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
061b52f5d9963857fb96e137ea210503

SHA1
64a7698d9a771e468c47cca8e2087cf48e0762c7

SHA256
27ec026badc5c2927971f12e489274dce97173360db3c590051897b08fbdfaae

SHA512
c42c5c4b8b6ebf4df479ed90ab05bb0e1bd9dfdb1309bb99b6be096ba46e423c7b801d2f7c67819aa4ffe1a3ac349db46f317d09bef63facf3d98ff2079de379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebb96eaafc8b01ab40b8f9023c1cbcda

SHA1
16666031598c2a41cdd1183c675c7e4369c7c2e9

SHA256
ccbf4127588a51d0a0257f3d0f6ff6311d11228b36e5ca9791b451ffb976f1bd

SHA512
b43d65958c8ae957ca216c6e1ff78fa3d9b54a4b28550547d4115680a878e7947e418ed8041ecec9975076513d273845c62c5dad3764194f07a724ae69e6f572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d78d67b4a63a77611491135ffb240d9

SHA1
920f2195a5de10beb38bffffcac284cd4c45d888

SHA256
c6fb5d0d06aab8d73ec067dc0f5d7f3cb891e79405f69c27368ce4c96b56062a

SHA512
787c5c2b2872fdfac43e6a12e19c346a3a982719351e9ec85d7a28bb23a5d36ae2f66579f16246e60c13e07b23e7f353d7c6d93fa61b05b02e7c2b61c95daf58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36e4ef1f90e114770c6f0efbf570b9dc

SHA1
446b5cded222efa32b6042ebc9d68bf43931f900

SHA256
bc01a89cb52d696edc963b2f54755af9622b3301f499350a47b67f35fe5783f8

SHA512
43888ca3db7883031e227ef6097672cbf954839369402f3608cdb467ed7b57508fe1acbd787d36ba94e3ea62b70bd93300a8bf0a2db48fcf43e5cf725ef73126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bb1fa49e8b20300ab157980b3bd9dc0

SHA1
43573b4197dcca4d2527ca0f0d90747212046fe5

SHA256
d0d762a2cd6a3109fbb13a8af84cf05849ccb3b5c489c52665ae10104a5c6684

SHA512
b6ec0f6f42fac0deca079c03a0d6d4f3bdeb7a1cfe08502867e045bd3ccaddf804a806f8f3fec4545ac5885723c5a983f121fae6a866f371e9d8e7560871beb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24bec9aec79b6872ee8fe2a2db4542f6

SHA1
fc51529c0941bf56707c966bc745c2b878206e24

SHA256
9fddc5ff8c1110d9a69fe950e2b3b0c0c510834d3a16d2409841a43903cef346

SHA512
fe76e974ddda5976229ba721a0b2c57393a2930e011a44d600e407fa900c66f6c4df25e63c9dd1d4d6ac1852e550f39ecd22b4afbcbe0543783fbc3f106a9444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a4169c94b762e68f3930f2dedeb249b

SHA1
9ab5ede47162b4b597043cc35f181b8b7101334b

SHA256
87aef4f268b0eae44b7f82ee9752253a61095c486d694e802186d69c9ddde719

SHA512
1891ad0765c0e28d313629e89d669e1c3209a5ca4779f7cf7e46bfc7ccf4c424ed774d94d746be1894a797ce9508d5cc405aa52dda65a76e092e523db3dba35c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
38a665de9e5fc8bcb5dae2527f6ca234

SHA1
bbc582ac6bdaa3af3e981c9ffc6cfab736d68dd4

SHA256
4c72b829c98cb9fdc918224d155cab93dcc581c8194ba16d2641166dc0aa4e00

SHA512
a4bc7beae16c041e30973e91290ca81678ee3e1b058b146e301eecd10986b27e2ca286ca10d65103d18f061125239a55f2df678e8925b4ec2bb1dbf0ff755ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar657D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit