8de8cff4ace6bfd905bef3cb5f363f32e904f37305c403b34cfbafac8b969200

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29abbba8fe5d4cd9f770d8562e42d84e_JaffaCakes118.html
Size

68KB
MD5

29abbba8fe5d4cd9f770d8562e42d84e
SHA1

175a8b1a9a8e44af72e9270433c81a674a879aaa
SHA256

8de8cff4ace6bfd905bef3cb5f363f32e904f37305c403b34cfbafac8b969200
SHA512

7bbe7ce6fbc466ded54bd5dee5f687d309e7131b02c675a2693227d4869697d076335fcd4123d06859b0ed28e455a3ecccdeee7b71f08e93256480652a5ed183
SSDEEP

768:JiVGgcMiR3sI2PDDnX0g6BvIm40JOOoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:J2ZIJ40JO/TcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003ee6d76363fecc40ab60b5c4191981e90000000002000000000010660000000100002000000065b005ced94419cd9b2802d49afe40b3d2f376e961ee1b907f45fe14787dd885000000000e80000000020000200000007d58ffe7f9d670f10212074a26ceed489bf5a1cba90962fd4309093c8a7681e8200000003d5209be9750ccf5c3b92685668bab99122f4353afc3f7b13292121b5bca28f7400000009f9c68f77ae91c159cdda9eceb35db29cb0e430899eef2386ad67d433de3a01e451cfd6d3c84554acad38f4d0a10b0b25a4baea18c8f29e1483440b9a604f956	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{771F8B41-0DF4-11EF-8A74-66F723737CE2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808ccd4b01a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421414778"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003ee6d76363fecc40ab60b5c4191981e900000000020000000000106600000001000020000000f06fe0600b24ec45afd378ab7d581db6176d6348c36d4407213ef735f5d232b9000000000e80000000020000200000005ab7e464ee6277f0f54929c6d43037bae315e6d5cc55eace359475f6375be525900000009fd716c8bd84c6b55c11bc30422411ba5064791ffc0a74ec831ed26b6da8099033f88e3e0c8a005e0940f0e060e624a46d1894cee7fffa5c56360db1f0d831085159cdbd6d3da00edd27e94a7a3cdd15d73ee5914125c8ac7e9ece497a20792f4f1d938c63231e948bf9ad69f9e99d287566cdbe9dc2fca876d44a066c3961fbc538dd8e735d7eb768eae5fbe732e1b34000000007a86705a525569faf71c9a50ae875637dbecfe7a8ba86d4f1365e98f66736c3f241783460fa6936b4259ade76ba0a40b00e15d6041b61bb4b97031057ce561e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2064	iexplore.exe
2064	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2420	2064	iexplore.exe	28
PID 2064 wrote to memory of 2420	2064	iexplore.exe	28
PID 2064 wrote to memory of 2420	2064	iexplore.exe	28
PID 2064 wrote to memory of 2420	2064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29abbba8fe5d4cd9f770d8562e42d84e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2876fe7b351d051af91057ef23a0d08a

SHA1
1d639a870bf0791cdfebe497c1d3294764d7c8d4

SHA256
225b1125378cc5af5f82975270e004912127eb69a3c6793a7b9f2e0b4e2dec66

SHA512
e514d6e4bc1e18fb144da77a33b917bfac1a0adf55c2539cef1db557ada5e32890043644a5adcdfcb5ffd88ba95a7efc6a89edb6e26fa46651c68bee877086a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0adaf3cef55d99434a41d0f01aac83e8

SHA1
e2b690d91476621cb9376251d416d38cc014d9a8

SHA256
b78fd0910455ab0ea571f5bcb0f672929cb50e5ed4e11bd638710710f280ab8f

SHA512
98217d42531a3572473e813ada7138fa6bb98fa9f315ae534db03cc561956be0c58fa22ace507de49a86e080bad07e87ff89967a40a8617543a00eae8a6bf3bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d835e08c4073e031e8ce392046e3cd59

SHA1
2ad50dfa020788a7e76b19a5972099d05ba3390e

SHA256
8f46eef079d9a7e593f20e9edd62bf9b7e8e7b45d247225c100741bdbb6f5b9f

SHA512
4051cb5357e57f1a1732fead6e25c155822c39a0133a948d7fb634b67294f9980189e01840868f6abf4b7fccce738229a031c180a7dad8789b98633d6b4f12c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
370852fa7e391b238c97cea6132e954d

SHA1
994b0f17f2e3c892d004f94939f35b7cbcff5e84

SHA256
a42d4be59abe2640eed03497c5050535c8b2de40baa31f3ada0188de008dbd1f

SHA512
505edb86438633a632aa960765d394d839b97acd7beba50df4969d766c5bd25c9454b17fd05e68199ee846d5c3c081ac5535b4259f82f9433f440057fa7b83b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197af9d4afc4d304074f7ce489b24416

SHA1
2313151d7d7af9a4ae2f037035c00cb78755416b

SHA256
7ef56b5e138d9a190c9e89cfc6a143593b15d784572b4ca12bd7b281247d65f2

SHA512
f4c229261341988927a29c0af3358c8bcb729ce0b6ac98901a8d7a11d1c33e46805d6996e7d6915de3eab94f97e482cc9197b12dbf5a3d1aa5188f5e88c0ebaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae84e6adee452a6f0e1c44ee66ac5ab3

SHA1
08abdcfb2907d108d7a6e7841ba50a5c1ba91a07

SHA256
fca0aa6baccae9db8b23590db440ffd8b4dcb6eebb2c5f6f626fbdcd0e628341

SHA512
a58fc6754b65632dd3cc8945854ca75d3572877927eb4a884921398dad6322b96332658277eb7b717eb47e664f1a2be5401219f39129ceac19c77d9f11456403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87955247ef4118fec9f5ac42112a9d97

SHA1
70619cc2338941290f44584ff1cd83e86b9fb81b

SHA256
0500df58167150754fb5467fb8328b766886fafe936a444db94789f54a80ca47

SHA512
4a4b12bf8499a5af60a3aafa1c05b7dcef99cb937a026e4eb800a92d637ffcfcc7dbb043af19c50c2f9e1a069041aa996e961b9645a74d28c07f90d4d50bb075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee6a7f5b1f9b371c933e235139e574b0

SHA1
df234be3c941017bd17ae51430175b7be9ec93d8

SHA256
7bcc9a302c04b4e046141caaa54421767328730e673e0a8b010ccaae44bd6c65

SHA512
28bf0523e41a1b8b0393833e6b31edb7a11132110670fb2ab1e21b3b7f0090cce3445c38dc5b9123c104dc46c75effedc525b8d075a7eebdc2202f1ce285bf7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e68d8fbe77c4e022f8870e640d8c36a

SHA1
a1223b7e9d02755df42cceb4b0d4e210c474da86

SHA256
224f1c2c6f42fb782f92a5113b1f2fc9588f7922f0da7c97f9abd68ec860903d

SHA512
5d6bb10496eae792eddc807a8f94ffc008c375edac966aed7343bcfe0f40a31f766ca5a1b4596d31cf3407dcd82be103cb33a19eb4651d083a40afdd092659e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
dabc5103262c75be7ed5474d01cb51bd

SHA1
f27004fb616279b292667b38ccce2d3d84f30492

SHA256
f1fa06129e3130717ddc192944bc664b4559a3b3a790e2e1e5e8f1c66d17033a

SHA512
91c26e002abc3b59a10784b35a8a2eea1557d06cc56b85310cb791f060930c138c4172d5233e809b129ec22d95705bca300b37dd2e2724b81d6ab4ef212c7e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab197B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AE6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit