843d9af9cdd7657208ce9d3f5f1b1400b847b59afd5e718d205cf17f8c92f646

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21879058c9658126a9c2bb479a16a835_JaffaCakes118.html
Size

220KB
MD5

21879058c9658126a9c2bb479a16a835
SHA1

e0770215d678782587319618f789401db822d7bc
SHA256

843d9af9cdd7657208ce9d3f5f1b1400b847b59afd5e718d205cf17f8c92f646
SHA512

64d67b57ae658509a6ebf9d6a158486cad75f4b265b99f83616112f6f56e5ebc060807c5b7c36097ad422a406c0d9018047bcc911012693c3558bc29e30d93a5
SSDEEP

3072:SDVCd8FaES9x9yfkMY+BES09JXAnyrZalI+YQ:SDhiusMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F704CD1-0CAD-11EF-8A7C-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421274265"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2508	2232	iexplore.exe	28
PID 2232 wrote to memory of 2508	2232	iexplore.exe	28
PID 2232 wrote to memory of 2508	2232	iexplore.exe	28
PID 2232 wrote to memory of 2508	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21879058c9658126a9c2bb479a16a835_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
346a3097cf3c20affa1af51aa10d339d

SHA1
d92f790492752a052119abb6ec456e9ec91f6069

SHA256
ba021aa7871247b8087e8b6bb2b52e8f8ab0fef7c84c11b784a92e54a3ce9899

SHA512
ebd17201d9f29d19fefaf91850a14ffbc50a01704b3e154cc85a41e98694650c6ef5685ce71a2e6d52bea04f4236825de38f58b5e1d6085c0822abc88205fa53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1715939db81a128c085b01e34e927922

SHA1
097838a95ba07b39aa6550903f810f4bd5c61269

SHA256
4d9b953a9df8329cdcdbda38400679393126c1ef1b6ebc8aa0e666be3b0be939

SHA512
b81ff5035d14b2c9c8acfa45b7f46e878f87a718227f60c4d8c4bceb49d26e0584b6ded7229af33c754e7244483cf2d6bdbe17c26b92cfd97012758742949063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f50170319ee378a15ff74da599acba9e

SHA1
d104b0a52f5728a6d4d217074d65461d307bf75f

SHA256
24dc6d5fadd7406f1ce96eee6cf49948b6528c37a17881849422c3793c262c93

SHA512
bf74f4f52f0243904bf603965f7e3d5fa4a7a2e1e75cfd81f9406355a125f38401b83177f59e0c245a32152c1aef61ebd70068fa1dcb6b1e13477386ddbc2d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a4079e0aef4856263f15b9995442d61

SHA1
e9796460ac65fdef17fd51ded193e8a7b927aaed

SHA256
d472aee77b2e8690dc6639ce3c12797b2b40ad1ee138bde77419af000d5e0bf7

SHA512
18032555764f9fe3cb9c57cc2b906ef49f9ece7504d4505445dd4c97c7dc7b79d0773a208e17b7be534ec1d7c9453d6f73a2be51e7f86a54efaf85106a43ad84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe3926f11a2e29cafc3859bd7e4b9508

SHA1
5e5d9cab81010a53ccd7fca60ad448a68163f2dd

SHA256
b45a079cf136efdcfffe73ac0c33731611e35333cd4a38dafaae9f6a8aedb524

SHA512
9a46a1ba8cb0ccc3f0de9a36afde3992f07c80ae4b1d7b7cb935ffc31c08af29ebdfc9e9b3b93c30d020d5bcc2da14251777b3932c7d7dece3db00237666a3fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
259eb6825df43034ea1c4915b34368c5

SHA1
3068478232bd88e2f8d4ef8c0a9e3f1ad98709ec

SHA256
aa28cc872db9c60850ab1649cfc01237e1eced1b112eca3e9bf9fae3ce6061f1

SHA512
b554c258249d29fd54a5f30b4f53764996ebddd0a4ad330b758b0ab71249d0efc6d3d3b86987e5efa31f4a973b7872c2b474e52cb458a61ac1670fcd30cab562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3779fead30234ce4e55f7e6894cdf8c5

SHA1
85e27a4f6089acfad90e040efecb365bdec260da

SHA256
19ec0a6bb7999b055290ba9d4e4b5b04d08c52ef09edd8f2d60812d303cce885

SHA512
39cdf35634c51e5e7116ff69d96685440f740a39238643426dea6d73bfb76e2d244b4e1c021cb787fd049e9955dd5663350b1079906abd23506217309492d699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9970483f1637701fce9a538c33214676

SHA1
8dc1ed00da3871151e60a08219788805c6f15dc2

SHA256
7f0d3ccb207ffbdf9398c821e341185b0e3cc281c2775f5ae54575ed17b42a21

SHA512
56b71805974bca735ff876b9c4dbcd402280b887bfca7030123bb5718c95a1cf3ea5d350aca5df47f297ac4df36de5f55b8ed2dc6d4c5de94864191c2689b312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fa17feb84cb1d3e972fe6c862da3c2f

SHA1
7c3823f5eb3cc264350b2acdb54379e42d4b8d82

SHA256
3fb0eb458c9943f20f9c711acb54dadb07547502ad05af47e1537c0a1d778433

SHA512
27b8a2151b9b654095519a3c3abeb0a11eb70ea4420084fb729231039269c54d68aaafabe650eef1c6f81b30781b6efe198e12ce10a9fb2ad11fa34bfb77622c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e49ed3060507c49a7fac35bfb36400

SHA1
43964b113e982f2c873805fcee9cfc20e0a70cb6

SHA256
c78cb4d2d28b7fb953a56d790b9643b8a29de5ab270b6aaafc3044570f88e691

SHA512
7267984085f3a65eda13d341acfa21e30e8ba4c763fa06b4d816d9f6b13f8873f29c1dcb1e63f3a361f25cf34a50ca218e909300896e75e0c12875ecb50df596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7f006a6cfc3c08ccc1731772a175805

SHA1
1e192443dbecabc99cf930ec15170f076d571b75

SHA256
62378275461ce172b15b430cc08a358669866f8577616e052f1cad86e7744b5b

SHA512
a57fb1b1a0d55c7c0d10995fe777f7bb4b33eec5c4ce769842a26d78c04a30cc9de44815cc7bbd31dd52cf085db36f49d765079483c722980c73c8e4fcbdae92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d342daa45965b8ddfade14271266fe7

SHA1
55e9cdd2a8740678fd353a82be697e4379101f57

SHA256
fc323182c94d693e70158699147f6b58db7c5cda18e2faf8341367a4ec7e222c

SHA512
05c569259031acf394ccc1fb2aaacd4e9cb474d969fd2864885461e7fb3318052f0bce69a1c1cd827a3643c279943818c0e1c65892d44fccfbea2c004066fce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
361f445abd2cd65a40e88e3506be0e12

SHA1
959f5cf82601a79f629599e6b551e1519d2790e4

SHA256
26b1b00b551ec84dc50f55d4b38690e935de05382ab0641f042f469bac66a5e7

SHA512
ed866c31096434a8318f8f53fe5bf3094a140f2b242e15690fe8faf5b0e4a2955e0314b47331e50e9aa0f4e06ec352ba46ba48ba14318f8cbb0a3331ca17f976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4bf5c42c8abdc0a89714a19fe92aba4

SHA1
2f0bc1ae4f95d6055396a8e127cecc132fd519b3

SHA256
48b6d2e9218e6b81871f9a9aca29695646dbdf27d94524be843081d278337394

SHA512
9feb6e7a7bc5653633df283b6ea13950a7aed0302923dc61be0e8ddbd564c6f1c20f3733d8db2768abcfa5fe00783dd31c9fc47842a1303eeffc1aa281e94dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4beb9d81257dcac1ae6e128b8840a48f

SHA1
fdc04dfbfac52ca9322038459fbe23f7ac286d38

SHA256
f8be9c88d7a22ad61c8183321d4d0bdd3958f08014b6fd732766ead52073b889

SHA512
ad00c4d245a08a1092f0ce003353184907a93f4ba2af55bc32683b989d77ac9e3fdb98cd8a950b148af615ecda3802f575a9be349fbfc935227c1472301d15f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28811a2c0f30bb97550eadfa563fede0

SHA1
8321cfafe4cd332919cf9f8683ac8014ea0e1f5c

SHA256
4068cd22722b8514fc67514f5de108d6c463804bb29f86b24df02303dbbed13a

SHA512
0f9c7ed723c805f33884d0bc0578fe2705892673e23ee53291a7f99c0a4bbc04b18576be00f9b56d99d8ebee622dc2dbc918596ca9bb817d22ec5941711782a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
843b30f918cc9b0a7a9831b47176ca1f

SHA1
79456bd6a06cdd9b30e2598f6fd2c4a0c110f06c

SHA256
79923b8866f8eba042e61dc51640caa29bf2be89719ebc55bc568f502e813e45

SHA512
60b4bb3fcc0f4f01f3aef4df84ff5680b980eff3dfee04cbcc43afdb685c9327d1ba01ed93ea33c04fb9346602b5e4b5da2438245bb40f0ea7033e8069585e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit