3fcb7cabaad89b49b7f9d3ca0fffd8f935fa99ab08a89334f53884cea40dcd55

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29babdd91db15f28d2e692af9e9fc6cd_JaffaCakes118.html
Size

213KB
MD5

29babdd91db15f28d2e692af9e9fc6cd
SHA1

31fd0070fc8cb02da3d7da7d9d716f789dc9180a
SHA256

3fcb7cabaad89b49b7f9d3ca0fffd8f935fa99ab08a89334f53884cea40dcd55
SHA512

67a1e407e3aabdcde13ca9431126c90c73709549058ff1cae8a96dba5cd5362b65f3f1368c097ef0427e55a5924bf22429287f11a6940601528b6085baef3daa
SSDEEP

3072:Sl9QmI0IQtjyfkMY+BES09JXAnyrZalI+YQ:Sly0GsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80A31CC1-0DF6-11EF-972F-E61A8C993A67} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421415652"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2368	1940	iexplore.exe	28
PID 1940 wrote to memory of 2368	1940	iexplore.exe	28
PID 1940 wrote to memory of 2368	1940	iexplore.exe	28
PID 1940 wrote to memory of 2368	1940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29babdd91db15f28d2e692af9e9fc6cd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c82d36d8668e5cc744649d3724abfa05

SHA1
c769f82ecdcdf6a6ab32424e48a857dc9e00ce2f

SHA256
042a622937a2c39fc0771340d1330d47da5b4b99152b9990f887a622d244dddd

SHA512
54692bdf965be0f6789a52906b7fb234b10434bef02dfe88900f7cbf43cce6f95f0453c34e420c2e4039ba48f1ee6a28bbff81fcbd034fd1dbaa3bb9d56dd25a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a7c2f395daec5b151c9c70d0327d5a4

SHA1
5dff43ffe6f8350b6a7f37cf459970f737b89182

SHA256
49255ad1514b663540f91d89297175f929ced52d65c141534752cb51e87f8fe7

SHA512
d185cd32dafc5598bc3dee6b98246adbae58b513f645da7ed02b07031cbf60284b0ec209ad7834da9e3192221c3a28c74468f8d4e50afa3a6f55b3b99ca47e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb0523f9fbd059bbb1e4e8a7b8ce70e

SHA1
d37be54b21bd68be10317721d42b45a3dc0c68b6

SHA256
e57c853e9f35217b832383a6445b04823426ddb3577743e3fe5b9a8e4cf2972f

SHA512
09a231bc9fde0012dd5c2f758831ceadc7d5c02da216fa9c2d9118d380ba82f6ca27d39c9658f468c8afcf9648e6e9a327ca22d31e2181d9afe264137c631ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8f2b8efc0f99a4b0225bf016c4a2add

SHA1
4b1010c84852f40cb98bbe27194cb3cbf28cdfa5

SHA256
e68df629d1f1e5f09057a1597ec165e4b573376c9c593760b4525893c5acb26f

SHA512
51f2839ae9450d509cd77a820f44c7ad35ca745f9fe1d0d6ee61bc80124784187ef9f9f9108daf243b2a136a43784e23573ae00b64efae30ec2a7ed95df1dbaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e8b7a8dd9a7a6937b940a4535eaeb80

SHA1
35c26d583718b40edeb55ed034f2ff3201e439e3

SHA256
e4777922323d8d14f748ef22bda104631985916af37a54b61833f1f3c964c03f

SHA512
331c610218dc57a9f798f54ab3afccef5f8c76a27917b2b24f79fc6784ac78eacc30fce2a4073bcc01140c27487c95fa7bc4b9dda4608046a59130271049d856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
589373f31a2c69d4193917d9c1dca466

SHA1
0ea88333f467e2629450922f12d451b1b543a4e2

SHA256
13ebaa5ebddaf94a95d5fc1dc3b8fc9e92ef96554433975c45932ec0ded670a7

SHA512
fe90ae1b979f87219b765c80566a8e6a702ad8008cd56b5499e640e62ac685eb3b57ff3438713da74a6760027c9754fc0dfd743dc6b9fbc0aefc9b0acc89e4ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86cac55cd07d28e699dab3a552e4f90e

SHA1
7c5fac9da5eb4d6f4356561eef35b07570c5c7ff

SHA256
ada47b83ecba296d0c26cf92156455bc23415bad597511e19aa53e025f9794f8

SHA512
6699e566b2e608e5f7bc00809fc614210e58e1c7fc8effb26e31f7f2c3e2767a5556695fa4ba663b702469f5503b95e9413f43329a0c48056dd8bccf0c05b807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47d7440c5a9ad87d814ab58b3f83d407

SHA1
3cd8aa34b99d0ef122e37433850bcef854cba39f

SHA256
6a5752fb5a8e3b9dcae8e6552b07452548398151355d2014b3fe16a058398236

SHA512
567d84713a89764d78bdc3cb3de88caf8d4ef9f427aa9e4b80557ef8edd9757eb1a8a1a5babd16075d81ab7355e0ca17fff8e218e6dcd5d556e611fc3cc8ad95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a7e028f3a7e7e0da0677ce746380b47

SHA1
ba95edd171e3f0d81cc0f4b5aae2518acdb0dff2

SHA256
80fe35172227e020fbfdf07da8b6652c8d6d3610b1646fa07b293b659ff7dfa1

SHA512
68000ecd792d1fdf1ed709c73d404a5821508f8595450db74e64949efc3511f5efd8934fdcce06ea6a051750f628becee2fba29d9070af048318d19568c5c82e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1248809a80d00eee7d5482e69b33315

SHA1
4048b2b193c824fa7aa91250cf9bc7da6d6f6e63

SHA256
2195230c079d96dba94d900457cbc544e3174f3ce8f89d0d458eea5a61abe363

SHA512
2c120bab8bf1ed6abea938530d0d7247d1453d8d02824120748bbdac7453027ba83a384d52fd7ad3b280f732b4ea537b4341eee922af20e6b175b21550b22855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8ae4219cdf53161d65fd1d0a25275d4

SHA1
7d8f7e03aa61433a78edf55676cd2fa972eb8fea

SHA256
9d5eeaffa0e70400f16bdce407dc61376a009a9c74e9346620e1f07a1dc37875

SHA512
2edec6cf9fdbc26df848a89c9b5d2ce7ed70e0f65748cecd3cf7dbde580c6134b078990c4e7ed3892d57958939e257b04eec4c80c9eebe6738950d8c20de0a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43ae258a1509b851a953775596606bdf

SHA1
d74fbfe3451df70be5c209f2926fe2e078e64780

SHA256
c960a21ac7a97e91aeec062e212e4c2be0b1f68e5c8371d3af6f903b258818fa

SHA512
ec92d70c858a55ac8cb6af6756170d5e5936c1b831ea700fb7762966785a66179a6b70352ba38ab792c09726cc509add935abcde45b5b2040686345f49ea5a72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4b44832ac53605a2e6a55166b15d260

SHA1
4b95dc0d762dbefa243b9b94c807fbf55cf7d176

SHA256
71d2c45052ca825fe69d21ff06fc3fab7851dc754fc932e26b20ca126c7bc882

SHA512
09541cf9dfef6dc14c80bb8b5ff7c1782e6162e77366995f1a7011f718516dfe70a792550e599680028d3d7c2a70d7bd649b7e8adff6875dd78b77b6ed92de91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af99347b209f32afba46cca223e8d6a3

SHA1
f13ebbe9af809d7e7f5fe6b9303634966d989dd0

SHA256
784a7cbd277be46b711f1638a4ca2dc8f1c22decde0baf0ebdaf649538b0a8be

SHA512
6f45eb5504e4ed7fcbf74ee8387de9af909175e7bf419b73e6cc397b6a6108aa7377c66f698091f62febb24e3bbd1feae24591202c5a98869f35adea68fecc0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a5d057310dff499c137aafeadf6eff2

SHA1
2811c6b4b8c278b164de8a8e44d06a889b24b0fd

SHA256
aa83a399f4b951d9174e05cd51ebcb004de6768db32bcd7d0baec470e534606b

SHA512
00d9b4296996f745c73252ca8259c30348b80be4ae423bfc686b300752b8e5316dbd0c4864a834cfab545b2de4fa011e7e1a3db05d30522ef02cea91e2a628ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73f03376754b8186fda4c03bcc949d82

SHA1
bdba3bafdbe8550fa82ccf2e12f980af2b4db931

SHA256
a93b9f2360a5e7e6955e78be34d9e81b03a8ea45850baa875754167600fcff32

SHA512
cfdca46a5fc1a928d5b2744acaf1d236e44b6e67e2d092e74a779e42509b45b4516b663ca76bfd4c63823dfea28970904498c095d15fd52fe2f586660757bbd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6f26dc21d732d606475d1832ab122b0

SHA1
e969484b1546300b3ccef2cc48ef466c643cc2aa

SHA256
e104c52114d4872f67ae5cac6bb4fc89ad88ea75c98f67fe535c958c6d75d40f

SHA512
de50d6bc0ea9659f7461e9d1a48ec46ad5928761fb5f9e7e028cf36761bc0f37f3341d46b8ef209ef6e7d9bba9181f8e66664096cb7e7669079243797dc6c904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cffacc00c260db5ad792ea144eaabb34

SHA1
b13cac2da79bfb9604cd9c878f6fac193214bdf8

SHA256
b775c14b18712ebb120e714c4abc089f27c46a7fbe0e4392c8e4fd1a47fde887

SHA512
4a09705a9be7915c0f8655a39d0fb7f904a1816a5f5b23de451280cbfe3f519ef927cc6bf239dd1907313365de0209736c007baf5c27bd0a719e79dea7b8cb3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc6e8f942d468d2e70942e921e201f05

SHA1
d6992ea946721bbb7b5893d2543b884b17b58736

SHA256
78c8c4a43a1fc7253856e1ef4cbe3a06c76bcef6b456758242fc130008ddf39e

SHA512
8d4ff628ab52b2b1e9e3c487100d1b23a88223ab00d80041f76006f3341bb51550d6311a5faa96b988e634c88da0d37eef60decc5f07c733869aed0e715cca56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab118E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1290.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit