a77a8d5d4353f8e29c34607e0781ccaaf8e6eee7bb4a64a9cb4346622fcbad05

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3075c2a1c7b71ece9c911c653f3a397a_JaffaCakes118.html
Size

39KB
MD5

3075c2a1c7b71ece9c911c653f3a397a
SHA1

4abb9c101048fd39210833a1e1cc0dca655fe8a7
SHA256

a77a8d5d4353f8e29c34607e0781ccaaf8e6eee7bb4a64a9cb4346622fcbad05
SHA512

39f1ab637196671b2b5e43ab13ed09d6291d41db8b9c19cad1022c9ba91960927fcffad8eacc5f92c1cce000cfdcc2607f00553abd9f62061a03f5cbf077f5cd
SSDEEP

768:zhq2NuVn7KKPKUGDVhi002dx01LriWWiV0AgXSgJVpmnAx8u7wE8DYz/foAJ9K:z7sVn7KKPKUGDVZ0sx01LrfWiV0AgXS3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421527740"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000020734d71fa9c894be7e1a043f568c22274b2a903deafe1eac18aff2fdb865966000000000e800000000200002000000098d0aca5d9ff0217a1d9c64591093ff6316132b957b1913dd7ce6d1e5749c212900000000d4706db1aa05db92383ad7f0114045a2f2e0de7fd0d5f83327ce4d5bb816089067b6a4d93bea3d3fb51fac8f67fc897859aaf052f861395137b1142e522d4407c6a677e33f70bd6dd4241b52f2085ff8e7ae3a3bd38c62714e94c8e1f43f94157b2563c7eeffc692aedd009a3c6b5a2be3c9a3e210897de2765000673de5c7d5f72eb2f2d700360e44b56f8333c621940000000977b6ac84eca1de2d4ce3ed0cb2896d1efb7ca8cc79e638d038f5abb3eedb0c84346da495d82c9418221212d8db59e85e597d970fa0fcc609234ceb2fa9ee9e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79652291-0EFB-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a4753a49271b1aeafa5ac51e6854d242e7bc22018b251c7d846050e0e46910d6000000000e80000000020000200000006b6b62dc6ab5acac96380677f66d694947058899b47a0a06e4c82aa660af3cff20000000251f083efee38fc5463f412c6a1c1c346c06d80efc885513981ff1065bdfe1f3400000006a07ac4b27a55920711ea33db2b8e739e84dcb05b3fa1d86fbe7f3ab4d05edd192c583f9c85b907e03cc8b138822d5bf37810069db0a90c87bc0b41b3733bccf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403bf55208a3da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2904	2508	iexplore.exe	28
PID 2508 wrote to memory of 2904	2508	iexplore.exe	28
PID 2508 wrote to memory of 2904	2508	iexplore.exe	28
PID 2508 wrote to memory of 2904	2508	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3075c2a1c7b71ece9c911c653f3a397a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
056ee6c22b3d5a35d1379fa819a28049

SHA1
c86b4d00e93d255732848123ab920d1d9ab19490

SHA256
0f795bd5568326b9fb1f0141564ebcc6f4ac87f90b65b881612e6c39741b9201

SHA512
19cb7dc96acbdfa94ec1c953451912758b21fb94dd630e182888e150ab6ee976a10215eb2dd6513045a5198d5e3e4a045cf7346f1f543b6ff7799791dfb65175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79355408615b187fb37c1842f1022e61

SHA1
ebb59f1e63890beed08735f6033e02bb4f1c6ded

SHA256
c38ef33a7205aaa2c6d9f471175f6cb1d8b480862227bd683e02ebbd5fd6fe4d

SHA512
9b966cb78a1006e7f96c9b63714ff0b3fe0d972212e37663ff2fe5ee9725fce833dc6007526b304ab34b8b85eb3bb0404fd2f3c710ae617713106f7d1efa4561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5808100b3d5d0ab996f568daf37df8a3

SHA1
89f409f25fec1d71e516e23e605f8814964c1142

SHA256
0d7e51cca062091e52f94454c6eb1a54280ebedc085a220d6f94dbcf7494b915

SHA512
370cc0b1757c98a00e5c06bd18da5eafc091814c1d43c621cddbba486790d365d79fa6753552573621d31306270e77e9984194ed3610fdb4cca2f599bc3df26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74744a70dceac59a45ddfaf16237b29d

SHA1
8ef68bd77d1625de4f3726735ea58050fa4bf6b8

SHA256
d8308fbe951b2ccb8bd2d84bfd81f549fb8bfaa3ec6f632e558aa6bbf9f71faa

SHA512
b8e977f7ec1be63810535e9d9a216ad50a2ecd0f41bc4d87e840307afa08f13a36c8b5310106b105c722e5255b3e9e32bc98338d2d7173e6a981541d39d96601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e92c557ed3d8305df8e0d8984d0a501d

SHA1
237e7138ad6f02a16c90cd1a27346931308a4515

SHA256
bc82c6564006580fd1056e2776b83d108e7109b9c32c6b358e3e4a18afed2fa5

SHA512
5b9ceb0c142a714be9670ea4a453da9472cd9e4f43b96dcf4120197403d5ea880ba3ef399d2adf2c9724161c5c4d912d62fadbcb13869cfe0d5a7371fc8ea868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d87b88fa4569fcf04214c57b6eb4ab26

SHA1
28c7ef4ac721813401b1ae5c7928f76d7f086de9

SHA256
b292448b8aab98798d6117244105de7cb5ee15e4c2f92a40d3589ae7370bc7bc

SHA512
6ae03029918d8944037b8e59b83749763405312765a22fd73290f62c221eee2e9ad85a751c90cd8885c86a9ff0b6cc01b114a798c02cc06f15c6d11928e8d694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3acfc6236fee45f66989c21842e328f

SHA1
df91fe2c5c4adadfbc035451b70185ff0600cd42

SHA256
86a21965016b6aa9ecf9e380883fb44745d837df44a16ccc2f374957325f7f81

SHA512
74f6a1c87b7eac9c2c636392e771ea54c434fd2b8b136d1aed7991896e6d30890fe0a6cee42fc60a9eb7c77c725c26dc1d684e8b93b3f0dfc779f095ddcb2023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8979b447a155710c9dd9f1027e34db4

SHA1
5652e7feffad19f995ce1a196348b8bd1d54b263

SHA256
1f995f1906ac389c83ea22364585482118ea01139b0a16366be4a7e0ee365682

SHA512
3a2a7b46f4e5afb0bc611d26a9cd5e4fa08387f6adbad8783cea13635b45a384fb0ca36500a818576f356a1fbc16033320f0d9ca74665888733bce630504d7c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e85aca6c5f8cc6327f694df09869238

SHA1
3932c5fed3b171718f1e1538a9e673f2efe128da

SHA256
5f0e32df38f6dd98b84989ea8bc835316d3cbf570977402fe5465c666cc466a4

SHA512
2c9748730fc9c2237c1afcca85acb2d4efe72e4a38d186f37698b3899075c5844ac1c7eb67edd55945d4fe603d3ad15eb0380aab369c852969038d9cf0fae5c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
567ca58da27f9ce95ffe55a749b168f4

SHA1
c1cc6869f670e1901ac77c74562f25a5949e6169

SHA256
a9ed7400b7f41be57706e3f9da38aafe13416c267b7a236aa8d64e304d2fd06c

SHA512
9b7fe193bc182b74b3c4cf5a5d5c8353773261c1404abc074dc244e8d4e01754446272ec1dc7617b535e21dc8a2738e65be6fee30f6d00e92b1618b8c5a3856a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fd688daac38463c9cc3c340c46d312a

SHA1
f95d92b747786c4eaac76b3eebc820fa26e7260d

SHA256
de278ad002e63f4c9e0c16ad33ece9d28b9ea5b1bfea189452377c29f7c60d0d

SHA512
99c9ac7305e65c4327f862665022077a1fa49cb6a159dbfb12926507baeb122079c07d3c19ad7c6808f211d6f9b7d7afd965b3fac4d5afaade1a9ebf72ec8ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0aed1089d1aebf33bc5681d08bdbe01

SHA1
ee5e5b75a27b766ae19c1f4a853f8b70ebcda21d

SHA256
b66c22c61fcc1e2a3e6e0f2c685ff5774eecd75be8890bd34116fce7a6fac725

SHA512
9207af0d6e90da41d623a7058b1015d97383f5a209b19db0cb58dd12f944d799d6d44caa7b3f604c2ee7954a72082a6aa630e206e3b54001b637b287c119af67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c5b6d1477370d7304ce2b4dc3cec5c9

SHA1
af8a7edda3a20b425133d46b04c9839822763153

SHA256
abf5502c3b58157ee65d0c66b09c09d67730717e0d7c8d7194c2e0b627c70240

SHA512
1004ba8b2aaf401943c0a6581a104a994a2b108630a3ad0a1f866b1ccb4818a3674f19930cd12ab81a7b3469918d11475e34952f307f1dd2b9919d05aed9e348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bec077340f921fe3df2687ffad458f98

SHA1
02651fc477b697b0271341847d1274198d8bd6cb

SHA256
82c3fe21fe8b9f55491a1f90d28c80eb95c2766100cd4fac0e0f7c2de08ad203

SHA512
8ec15d6953212a699cec8ffddfec483468423342abd247d51dee6a548d9589d8c0a4af6555e295f791114e3e6efe53e767be91bdd593b7e825e12eb90ff396db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
096591e66f2f22aa9a60c42028326bef

SHA1
6cc0b91605fdebfaa2fe6aacfa73a00a863e1d04

SHA256
4f22dd308d4d5123ef68ae5e923b291cd5df7752d61ff0497ce1a3124f2b6357

SHA512
0a0989e903c06d5ad11e4f1ab30d226ea273651436335d236e5ad8b28196b57e33a00f4e76cc4c5134795580ad608bdc08cda5ff27e9e5a3d0945c9c8add006b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD6A8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit