cf5fcefb8490640522f2757342b0336dba974886de2f2d47b3fbb6d5ad5f76e4

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2111af4b9f566227ebdad959fbb6b37a_JaffaCakes118.html
Size

460KB
MD5

2111af4b9f566227ebdad959fbb6b37a
SHA1

ff8b549cce617b098f8b1920dc7f1af2d00f9bdd
SHA256

cf5fcefb8490640522f2757342b0336dba974886de2f2d47b3fbb6d5ad5f76e4
SHA512

7071ac5bb4ed6a82eed405544df7b2dd2b35cff2a1440d3a657daff94ccc18383bd6be9931652d0e1615aef3ee0908bbcea1727c632d5b777695f8230a629d25
SSDEEP

6144:SYsMYod+X3oI+Y5sMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3r5d+X3u5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c933af9ca0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6A559C1-0C8F-11EF-932B-4E2C21FEB07B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ff2323d395b634593a09de98d8c384d00000000020000000000106600000001000020000000d6f0c4fa9c25e3ca4fb924e835d17eefb8c325e663b9b240159991ce768ae0c4000000000e8000000002000020000000f01883bcdbc49fd6e5981b6e9c75905aef5f51f9abecde342cad046b1677d79090000000cd495c2ba6e78e04c95ec62d7bfc9296c52fd2e63cc59564e7b4788c84da30ce11054063da4bf9c857d5e4578711e5b3cc78fe88cadfe1a181ec0535cce03d38be61e10758d485b6429ab497ae0c19d53b821f9048c59bc69d1656e199772e0eeb886c0d88a76b1b693ba4ce1fb38fec9cb451c2fbee0dae1c5639350fd20433a22c420438b1cc1959ad2ce63752706e400000001627d69adcee2690c2f6c4411ac5625713ecd76a4c0a1e2183ad8f5d553ef234bae479d03869c453a4ed701170147e21af1c9266c8ff31267908f794ac5733bd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421261606"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ff2323d395b634593a09de98d8c384d0000000002000000000010660000000100002000000049c046f651c01052287b6731d76dee028227468fc9d0020c86e69eeb08e14a1b000000000e80000000020000200000007ae97af3a8590bede7eb2c7f3b053566398287cfc76f79231b7bc67bd23f18f82000000089e201ccb974b464ef9a1efdccd316d5f23b34486bd02cf7c53ab8a9be4d57e3400000000bdbf5172c5e86b8aae077bd93c6ec16c5080a0808655a35efedc3cd96c6dcad85fc0df6707c4cda3c6eb03304182674cfe45eb56e4a8133ec1049673a167e77	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1276	iexplore.exe
1276	iexplore.exe
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 632	1276	iexplore.exe	28
PID 1276 wrote to memory of 632	1276	iexplore.exe	28
PID 1276 wrote to memory of 632	1276	iexplore.exe	28
PID 1276 wrote to memory of 632	1276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2111af4b9f566227ebdad959fbb6b37a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b5d0fe316c3207ec16d2ba718daac74b

SHA1
3ca08b7df60c15f4f7e5d7d2016aea7f9afb849a

SHA256
1e98243882c94491e3ea0cd5275e59108e513ab1b6364fbd33e5727022f38185

SHA512
064d4598762f4bac6aa79fcfff893fc7067600fee9a6672710c12dd025f31ebddd421705e10c9f6d49e08d2e3caca9ccd105ae1682db964b1176d21fb9d56814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ef82ed970f338df94e4bb22dc09216d

SHA1
ae2c32b04078b2556935864523b1829f83582bfa

SHA256
4119c8f7fdfd82e0c222729fa1a66b4eff6857e1d0b5b8b79464806f66ca4841

SHA512
d097485ed6382e3cf49d9b2c30ccc7e0ad362e50c4d172760e9f90384029c3b20168248af916bf8e65d4b8b09753f50038806c15730e71d3b20ddd47b6f8d4ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e70a2b2dcd9831496fff40364e3fe02d

SHA1
9c53d24ddb85620c6ffe00f49be2c05a043a527f

SHA256
87a386713a6000eca36d057ef7787f28d298a9629cf200b0fed23d0837a9fb7d

SHA512
7acfecb4f720a16bf67c2799ab4a12010c65bc4c6d706c0196630c09d3ee6ac6dcb88fb25c67113596edd07ae6148ef8de40e8f2fb643e1fd14a0f29bf33be74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11b93ec895ab6a2c53ea8502c0002dc1

SHA1
bd4d0b5146a89fa45170a6db1d050452b45ec49a

SHA256
6af56a419d0a22415cb3cadc1a25d1a0cd6316a71ac5d031af00a35ce5eec169

SHA512
678765e89bdcb4706e4c05e37c3ff8bee80b695a5dfa57fd2672c2ff2db2bc20ebb21bca98483094d2c270af5e08b4892f265a62b1d34edb5af67a193b82617b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74204c76b72e2a09d9cf0fdb56cac890

SHA1
6804687771a5184fa6319001ba5360b8f98f7659

SHA256
969d800eb532872096d69761f1d542d6a338b89bdd4257143629014c35534f5f

SHA512
a1903b34509b2daface0df678bdf966d1298c2e07f1e1ac80a5f92e3048621ccac68939f1185b29c2d6faf7d804b1952a73811ba6619a5b0bedac8a30a5ec935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
465465b2896d58be7d17dc034a80c4f9

SHA1
a8f72413a2d88565d1233be912a179a0ab41afd0

SHA256
d35b8f5b96201b639cacbb65b38d10eb00a4d27396eb14903a653f1e3f48b4d7

SHA512
e9c781b85bbff9e740d6dfca4b2b108b27d728f7e77791b9424637b3ae17a81c4ae768c737aa83317849cfde8437e9177ef0feb487c3038cbe545ab9ee080a92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3cfbc2c3953d2860172ca50c66f00e8

SHA1
d2a19dfb84beee59ed5451df99d92db2420f99c9

SHA256
b93f1f94c7c393df513fcc11f7a5fef5e0017477c0e14a44fe28ee6c00df86b0

SHA512
79317e4cb8eb2036f06de5f367582f69b39b6ea3398c0dfc676baaa5ae1f41aafb7f564f9496da44a2be8e0f385e9d6bb1bd1e925a18f693cdc2f211e4ab463a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4e228ba00550b5e99bc273053c57035

SHA1
e7cac2c42799f36e8651f00ee738ecbbf3c25fbc

SHA256
8c39aa30fe09b6a79cb78546b004a8186c1c109e1b7becb000fdc3d3479cdf80

SHA512
c95633c2e74a52416069f03de8326843f675bc4b7e61f5890cf0c6a5e9b18caf66ec5cf120357929ac05a9564ec24fce0e3adcfabc5fe36f7fb0c9cf4af1af9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3632eb9d81110bde91a9e53624403477

SHA1
cb19e6c0ae4f9bd180b0f79937ed3e6d988755ca

SHA256
209e55fd7d5fc9055965c245084b50dfe143574b32504e49fd444a67cd76facb

SHA512
b17d34bdc839a0ccf421874dfd082970e6e42b4dbe917896ac8882eb0d37f389458ef870cfe7b1b124c6e7dd1f5492f4133f2fc5a1557e560ec3831c226625f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44fddfe274c3aed9b8742b6a399343e2

SHA1
6ff75ef3ab0599b234ef6cd517519488c0fb131d

SHA256
0a7be5bfc74459443b7f4823d9d4e7b46eb8d7356b35fed9dd3c49d141bd16f4

SHA512
5488d30f960de228ffe9df319ceec9c460aac56e2cdd61eeddad6ee932e090b665387c05b6080d53412c601014a8b177d8abc359a60485b09a4aadd74a1e400c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40d76a97afe6f0022070214a32754cdc

SHA1
dbcd5e580b34f2818929bcbb2f661f1e554d64d3

SHA256
15863e272521c81cbb23463cc38167f3addccb8e13eb273233aa31551b1e6b40

SHA512
7a1cb4a1e097e50f54b1ee73fce3799d4ed846a01bf1232a60e549ef28f22319f4a16b53a8dfaaaa1ab52f3245c810df238586c1d158b1984e1e632e48bb3622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
78344c0b57cc15dbaebbab03812c2767

SHA1
f30be8355848683836d251f7899c12ca25141b2c

SHA256
1476606707dece3763785c9015cd9ca9716a54f1dee8ee800953d2a74f53dba7

SHA512
da7c9f0685e49f6088f494d2a7370c869dfd436b2bef6460e7a2aa17d6d7d230a3171eef4e9796a760e4b0008add8b11c9b3257a6619499583cef3aa6957059c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F71.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40CE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit