dec3934ef63e1a7ebd185c387dd4cf38014494df2726edd8a4aa670041f6cf09

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29fd9831317f47acd92d5dec5bdfdd6a_JaffaCakes118.html
Size

139KB
MD5

29fd9831317f47acd92d5dec5bdfdd6a
SHA1

15ca68cf2904daf7211f2efcc8625f5cfffd4c04
SHA256

dec3934ef63e1a7ebd185c387dd4cf38014494df2726edd8a4aa670041f6cf09
SHA512

06be107144b89cb8d2a3f391f1d04e85addb036adc2f8180b6fe311db120f2e4afd14e24f2c5bf4fd92839ddbab6457bd037207905f6856767cb02c992a3da2f
SSDEEP

1536:SWNbgugyl0pyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SWG5yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AA74A41-0E00-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421419911"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2568	1936	iexplore.exe	28
PID 1936 wrote to memory of 2568	1936	iexplore.exe	28
PID 1936 wrote to memory of 2568	1936	iexplore.exe	28
PID 1936 wrote to memory of 2568	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29fd9831317f47acd92d5dec5bdfdd6a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ba3c65f3fe565ad32097147255a89c4

SHA1
ca291c4472213e92808afa6ba552667ea5f2f6ca

SHA256
2d1be33a85aaf00712cfbfd053e1ad24bbe46150a4d03c5aef5760863b3f72c4

SHA512
0fbafbdfca548d14dfededd823d559a8d95941610d5730ab99b8b24f8c70457185ff75f38a027a7acf16bcd61974de6100b2571a9da1a53911efadeee2b05d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
879a1a0dd79c1f375a63ef069de9b805

SHA1
74b84a315b032ef74f178bb951079f7dcf05e6b7

SHA256
f8e193ad3b0c10c542d61af6a5eb38e96cd68de51a311127316aba1017cdd7d3

SHA512
61fe6b9e98ef18764df27f4b379d8e8c7ee6edf50a6d7976d2dc0ed2f942625729b3114843f4ad8bce87115200718b2e02aa12785255b351ba98173c8f7bfc4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a58010c4bc925fbfcc745ba04fe332ea

SHA1
bfb5da80f1f9d0ee4a2f2c879252f9bcd3788d39

SHA256
5568dc70b24b29e6092e0595c7afdcdb48b887f28270565892fea07185a905b6

SHA512
a0929d70a75d4c343c97cb511ba6ecb4862fda80db5d392599b06c0c56f2393c29647a8bc9c1c5e796f555983faf7d67d640a2f4f4a4f39f006f7414278dd5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
793cd14434474daa8f87ecaaf9069732

SHA1
0523e7112cebffb177a3358467954a5065b3fcf3

SHA256
8f0ecc8ce37e3a993a3fa5524a6f1d7c48ea7feb96b63c54073719036fe4df7a

SHA512
e4e88f92d19372f7a10dbdd5bce603e2db5611655b4d465022bee0a00b048e0236da917b83bc0c442e01793c661d19a2840ec406267e47c2dcc5b67b70341a1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62cf0976ca22d89e5365197a5f808b53

SHA1
01e8e824c89526360662dcfe36243b31b701a062

SHA256
6cee9f2396f7e8beb1329b1892f9894c11ea75fe2495aee5ca30f9812824018d

SHA512
73aef7245aabceadede33310d016fc8a47108f6355e9d11c09592cbb6cbdd584e9f82d6b4ff78646d3abd21a61e0cb9e0f0b53bab54684c2370a4bcf0fc6df22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
884ec4340bc10e81430dc2904e34f8eb

SHA1
1544946d124a71c2e8b6a00e749c766ea86c5028

SHA256
8bf70f8e4095d104ae6265005e3d61bb7aa847209f951d658aa902db3d8fe351

SHA512
121e28e1a41b00407ebaaabbc4a52f239b140bbe643a4348031da0ca612c485f8e47c42a930e3ac076d20c923e492b0b20898b11b86c6b7ddd12a70e90a8edc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc2ec6b358eaaedf96fbef60fba2f9d2

SHA1
6875904554b1dd8d5660bae2921bd2e344e16095

SHA256
a2c95819ccfb4899556a495ec7a765ea4a7715e26b2f27c215deba62b5fd0afc

SHA512
33dd14305d0cc95153f48dfd74599cdf215edf2a9e79dd4d243318010cb40d526e1a7894830f642c1751ce6597a8d32724472cf6fe7a01d5904c795a9b514a1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fdf2bc9611d2f13a3a59c7a442e0c88

SHA1
d620981807d6b6d95793b6f47d5e3313144f0c09

SHA256
2e56a01bf749893d032e7a38ee006544b5ceb55cb639700bafdb7cf9cc64092e

SHA512
d87435a62e288a1caa2a8dddd69ddb8becdec5232e1119be0d87fd92330dbb566231d3db48258efb1db3be2b825dabf35736c5dc48402ed116ab2607aa42533b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b116d9d5788a92e301b7076d0860821d

SHA1
29882be96c4f167f8cc74a16648c46b420e2b81e

SHA256
719e0de8facee6ef58bd386f08b093888b0e019dcc2a22f76f5812f8e7963662

SHA512
136891894a9558fd39f2e405fbb2670702ed93e5db7f4f68e88c8b82377f1cb4369a131b3d878380b3cb4689251a52bff3ea60f1e69e0987d95fb6eccb94d5b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6e51d829124ace55ec86080805ad849

SHA1
5b60230e849da1b51458a2fd4936a569a8287bb7

SHA256
672a53dd4ad54825aadcf88d76944c398f4ac79bd72eee19b769e9ed90f69720

SHA512
def9ba82ae438ffd481da0a7d962f4e259d426d00ff44fa4ea1c7439cced16864f3a473b2bf2da7fe1f395ca3c4a164e331703423e79a4eb87b952a50fd1974d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4292ed8da812dfe1a5cffafd27f9f17

SHA1
295609d504486f74aafb8d106adf9aa5f32cea3a

SHA256
64120ab761736afd5c3fe76adadee083a1941268a413cc490791c31f977ee3dd

SHA512
5ecd552348c0143ce0409fe083e9f8e995145248c59ec62247f95ddbe9430b38a19910b620753205e49a141a8a751beddb66cb456038713ed32651571b4e2679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ae2e96441f3680d20fd294293e75d79

SHA1
e9f036308bdb322c3bc293ba7fe02b56f31d475f

SHA256
7c1ce795e65f80ea1634ce747d3935cfa09b85db46581db4ae5465e89381e3fc

SHA512
c5e1b70eb492b2ca11a3055c038e71a3e0145987bd2d2e147c2cbf0be947e1222ed517fb480668496edd22d1bb6f3f2c3c59a329e5019922e0cf306895d60d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caf44ecad309b24364561cf8b5c7922b

SHA1
d5dc883025828eb5468d6bf5aaf69972fc7b8ace

SHA256
ffcf90cd2e2830c187b44f81785632c21c7d8625251b70c220ac474a6874be1b

SHA512
bb9b066ad2c0ad585eb96a01eb97c56ccdd8763820d29e733b865576197d07c57944a113d6f2d57d7bbef3cfc9b7e2cfa7390cfb7d9376d4f431e9b69bdc6d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94c54045a091928558b7b0c0c7034edf

SHA1
5f8785683cffd14734ca7d4b70e3da95afac6fff

SHA256
69218ccc4a00ef5ae08a7351119842e9ed4e2e394a5f9059c6b3173cde746202

SHA512
a6df66a0f7e24f5b30c17bcb15eeed6d556047925697bcdb9e7d6bae4985cb48b5e4dd91510fad110e6a906ec64fdf5ec7dcdffab0a64b3bdb0157c14bc95f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cbd9cf0ba82cd8a2c5e5b69fd134d62

SHA1
0a741b4f69ecf8bd7bea9a16a85df00c16ccc9fa

SHA256
73bc086a5445c69f5365983930209653a5d65ee89df7bbb6111f6ab65ca10431

SHA512
15cc515b8e5059fd6aa1adc4250750c8f4f1fa4e2b149d37437f98322ac1323bd17ad59650d452609c3b3142c40cf0742d1b242c4fcf2a0791ed4fafcb4c76c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dd396b87f3bb6d092b74a05684b371d

SHA1
241e56f00f143dd6db07f21b889810da290d059a

SHA256
250daabfe83e5ed73a95ff7375f2540a81d1d2137be74e442cee16cc37f865f1

SHA512
35b7a85b66d638d8889b4640149023d687f2363d466eaf8500589b4851c46a8fc5cec621a43b289d447d701a5c75966eaf4936d99abf43325756e5ad4a0cf3ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abd8cda832b409f2d18fa99a87c96eeb

SHA1
ebd9cd1cb1ff980e2cd27ab1285e6b05d88bc5b5

SHA256
91fdbe784c49c10836d905c476d377316f129b453bdc0a1a705fe8029ac924a9

SHA512
30fc55689c83971b51ea417a3b2af16f81ccf98d31bab25e960100e786ffb42c06018ad4a29089677369d70c82202bc27c4bb8b65cff2077fae3792404dbe717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6580bf4ad2e0cdf10943dffde5d513c

SHA1
b6c2caef36df58473d99628afb8200bda8aa17e5

SHA256
3d3b43f6e0def33e1538e6e0c3507a092e9778311e9f870f7d8592c11c7ae6fe

SHA512
e276816026ea17716399ff4ad37783156876b538e1c8f4916fab34601642c9c7b2a2d2dccf520d32cbdb1f6cf8459f48192c920a1c549372380d86a131b860b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95BC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar968E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit