9fc397735d4148afef64aebd0b40329f20e9d4ce955d6dc8d27df2fee3e3b040

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

307757eb0ea6d141b0087a28db4c2c6e_JaffaCakes118.html
Size

10KB
MD5

307757eb0ea6d141b0087a28db4c2c6e
SHA1

1e577f0dd19a5ebaa5ba7e90099de37a913e9dfb
SHA256

9fc397735d4148afef64aebd0b40329f20e9d4ce955d6dc8d27df2fee3e3b040
SHA512

fadf78be61d2c6e9d52f7a8cd2ad5943799b515b1cd74528df3f8453a6e91c10578c0c74eda8d4ccf0fdc5cfb38db7289997666e2743a3e4c687fd4533b586bf
SSDEEP

192:SIZdfvfSFBsFVNGUpQYB9oGA3V3DDIYFds:SI/v0zYT+V3DDISe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807dba8808a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000183b57c1f86edf4b0a2a76f3a4a0164c9bb1bb675bf48d40dd1baf3628d3fe9a000000000e8000000002000020000000512da714ab6d10146b54a4066a509a8e7cdecd97f3bf87b2d1f082c67aee1b62200000008cd7b95aff4ddddc430b924a8de8ce456ef648b15330df35ba914f68d213e584400000005f91c957aa251a1643f9016b381a5b2f20c05ff7dd5f3da632c5b4d2f9855444b3e8dd913c8f341069a9d1d5f4bcf62ddeb43ddb8758a16260f913917c0e10d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421527837"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000d360b51b4bae4d4b056b9fada141129c41cdbe3485e6cf6fea84b2f97c85cdf1000000000e8000000002000020000000875fa2c03580f8c8c551679df47ff001851ba108ffeabe6f597b1f00078e0fab9000000092dbe087789f3378b308c683cc94ce399dfb5808cc885d125cf217ea1caae77f92b63d94a3c817809f86b0459bfd46f216d25aefc1c9112c64598e8fe2c5f382d918db8a59b8385736d42c37a0b45a967ff3682355d41f72eda7ad7890df789b76ec72cf502eeba732c634718938b7768b9b5bb908a576f3e24ecced03fd55b88d229d6387ede4fe3fe0ec623538bcec400000005a94a27367c1ba96064d9bf391307c436cc808840de90bd94cd8bcad228a1cc46858011c2b733b963b192d73e5c62a8a030789439a12112276bb1bff1c72be9b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4164041-0EFB-11EF-9CE2-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2516	1968	iexplore.exe	28
PID 1968 wrote to memory of 2516	1968	iexplore.exe	28
PID 1968 wrote to memory of 2516	1968	iexplore.exe	28
PID 1968 wrote to memory of 2516	1968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\307757eb0ea6d141b0087a28db4c2c6e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8becc864986293aa63b85656cbb59a71

SHA1
63959c33384d5dda25c329954d1f169ca5a1fc28

SHA256
6ebe7d52677cf62b81359b20c74a141cc64cf1b55ab4e33aa37ff9e04a3724f5

SHA512
a67345b910fdf6a49e97985c3ef413598c441e2c5a7706c02d2b421bd6897f1cbebc8be523c055ba70aa0ed57440e9f86c4279c061df934055f8ce57cfc43c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
285f6443c01c9075fbd8ee784c5e8c1b

SHA1
c25a6a3b5e6f0361c245886d55dccc80eca6dd73

SHA256
f0a4e6459f203b5ce91313050ff89807d41cff5c15d01b3aaf9e65ff0a4778dd

SHA512
a6ef2e61a7a19878a28662661eccdec78313fe0a81ac00a3336a4a756ea863e637d84328a071545673b757205d67f62434f9983414257b67eeb295eed53928fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8d8dcf7164c29664fdf89052a89643d8

SHA1
59d515a4ac5407ee1b1fa89edb81fe3c4b1e626b

SHA256
7099b80636d71cbe83b20f9759bada5ca0ab109ead55747a7951dd541eabc42d

SHA512
ad7574eaa45f0ecf873236e39f4399372a920a0aada7852dea555475e4444635f81c8f0988f0516ca51a7fc90f35079ada29238da3a6edaacb76318a7d1d578a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4408e418a2e40e1a06e2892acc12f9b2

SHA1
1766ecc9e2def1425eba03d9d17c12cc59244062

SHA256
70ee4694a06859a0d13c15f3442164080def43888972c42132999bb144fcd295

SHA512
12be4fc02414c9533e2e4cbc6a99212f61b4c4c354cca7ff626cf65b39a0aae50899b9a2c32adc33577d360db677f93d5ad7e4a0bf8db20ba7ab3d7c3ed2853b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
73bbe7ff9e1b48aa6473ed9199e69c91

SHA1
aa79f3ff4f36f7556f503c058186ae03576141f7

SHA256
5d508030853c81d065cb103f1ef339e6cab5cafc93b0893650c8ac795f04e24b

SHA512
5956fc0e84220b90c90847bc74ee10e3c60a8219246061a9a89156eae4702ca025109df6ffaeccac589b9b706457736786f567ccfe402a7d321553beb5bcce55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9e6c1eb473915bfd9fd55eea9eea1616

SHA1
da4c8c3353a3f68086a7362bdf2077de3c7e8cf1

SHA256
c6cb184a8da36811e6dc3118192b2c3a69a5ee9dc171bb0f9c90f0afee3b4337

SHA512
06e12b58fc0c696fbb69bc9a82063c70d291b72bcdec46360db3ea682257f052fc02917fd621fd14fa9a9a144ec979c7c8b393c5e783cfb6d974f5a4736cc563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e7c26c5421fb8cfd4df3ea7657f0d3a6

SHA1
b556d4a66f30f78aa99c4dd760ff9cafa74bb2ff

SHA256
e7346ac71703b247833b65aee26c37ef96cd02d77c86ffe32b2ab7e66d8a1f51

SHA512
74cc325f4cfbdaa9adfdfea1cd1f2bacb439fb1b9fad3196470e191e145695d36761f79e5652edf1b4d3544b3714535fd7758a5dd5af6b7ed9a46afb28604efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b8e326957e9ee7d804ea11b170786be0

SHA1
aa6c7ae9a16d519850633a8bb31eeab9cc0d70d3

SHA256
ec2077c00599c24176f8c85421e89d4b259d90469d8849699ecc9f9dc12a9609

SHA512
55d6d4fd41f0bcfbdbf115d2f803e191443b662342ed89e6096290e1d6d0cf1f7272ecfcdfe661d81c232f677515fd18932690f9f57fe671ef03ca2a02b34f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
06465898e6cf908c4eb9af0b31fc3741

SHA1
bb261f1e2b18493cec99946cab118d62bbcfab4d

SHA256
8907705cb8bd88ca98d833f528fd8517d1bc7280a552c803870f06b66164f2ff

SHA512
d03e0df1d0e3f2a5673bf0afbec63144f70d3fb2c60d1fa09222b485bb0cc3a2e760acdc06e8179261167a147897641df834438b7fb9757758f7118814673166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f1175a75eb0a83bd598d6dbaab6d92b8

SHA1
fc9e36746608844720dccebb07d4a6f3e0a08e1d

SHA256
3da03eedc6239055db94c1117330ee617ce86a6f5832e73f432c70bc4e73eb28

SHA512
9c52a53261e81025bdadf873ad6d6927d2eef5557663e1a5df7e92989426e11e911f16fb5d4adbf9af110749c16e8fecc1ede3b60ad9bbf6efb3294058840ee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
474c75a26837b8834ab2cf766ed3d526

SHA1
bd8094307118913a192f3736a75d23c83b06a89d

SHA256
5eb04861a6b2d08e8af05e266fbae2de7e94edafe6d519ae567dfa4322a9e222

SHA512
cc113a9e422c43e097547dbb25c85f12c26323e94eb6f7ea6a73082036d6d52b7aaf18bf509996f544bc61be1b40c5da79416fdfa93d8defefb09c3e41d00405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ebbf7235e1e60a9db97b99f97ba7feef

SHA1
89a64378ea25028efab0a403e092fa5d4c1191d4

SHA256
697da2aa5f091ac09f91f0f8142052ede1025c07328842641e8326dd9f4ddb86

SHA512
47c47b15922b3d1f04bfdbf339d03ccc7468d879322eb911001c36600b889b8a232ccd7c82e1966bd5f657cc197cb6c29dd1d2d88834a77b9d59cc24fa85b9b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3930c0e3caa0fb6efabf8eaa4f077c2c

SHA1
b566729509ef3dda9aadf23b851d452a51f026f6

SHA256
a89a41a955fa40023e06a2d44eca4920726a21878e937687be491aaab09d90ae

SHA512
32d283c5d95d1f416b591639a287c2c60d99739db9080ca4f2b2be193c31ced5e15cd72546785072f8ff671fc1ec1eb76d372bb9d63ae840e22f405af8d6227c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36E9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar382A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit