e85f108dc84014a3da67d45230d0b83e0fd1c7a4156b5be05d076eb2a82fd35e

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33b1999de53ae7a5f5869ba33d2d8dcf_JaffaCakes118.html
Size

230KB
MD5

33b1999de53ae7a5f5869ba33d2d8dcf
SHA1

06cac47ee9cf86b885c808a1db4aba1c1e8e7734
SHA256

e85f108dc84014a3da67d45230d0b83e0fd1c7a4156b5be05d076eb2a82fd35e
SHA512

8d7c437787b5ef1b52914cfe9614e6fb7569c79cf87d5a99629e63b83128c67709d1aaf7933e2b372eef5eece163668dd1dd91b8aa3b98f799a63b0c6e48af2f
SSDEEP

1536:drLArZUBBfAsiZ9QCATpvBt23NpCGGiKrZOao0rAiZ+XBbalIFhF7dHoEP+R:9BHLORWW4lIFhF7dHoEPa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421578686"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d878c5c83593163e3db5c49d23244fd6a3c0052eedd817c137f71b6d5e628736000000000e8000000002000020000000c21b02d9e11af5b0cddb1e4c24bbef76e2d07edbe18c547a42e0012f3be9798c20000000e5bd38d26b8cd7ab08a8fa922bbb16cc1cd36370ef6f36befdc6cb92041721d9400000004cd5fcc6650b15f3d37a3495cb81662c0a6b684ff8453808795a7792cce7d9168f77669850cdebc120fa378589da456564a6e8260f8ffc7c5b1fe07acfa6efe0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b2a6197fa3da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16B619C1-0F72-11EF-A7F1-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000041a0aa34110610eb7866dc58a6ce1f48cc26105a0682d668bbe3f7c15def3225000000000e8000000002000020000000b76b62bbca5186ecce315664491579067864ff62cd8cb4902136d74ce20241dd900000000c2d9e3bed839ab4650c195b90c8986c27fe6b13935f014e393e7fd2a27e0ebe05f783228c67b66b49a892978064b8364502abc7ba85dad735b8974775017c7330604fa59542bd874ba11fb499157a14406e5193185f50ff862184224523207e08cca1bfe1d832288c7f730c2291d71716ac31dec1aea7c6feef182297de3c03056de1663839aef06bef8963effbe71e40000000554569cb6eb06859f38420d7118aa6065cd2cce097bd9deb3b1d1fd8b39b8766eb5c7e6563118d054d21b1a294bd1758b6113093b24ba2ea467c3fb721425f53	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1256	2352	iexplore.exe	28
PID 2352 wrote to memory of 1256	2352	iexplore.exe	28
PID 2352 wrote to memory of 1256	2352	iexplore.exe	28
PID 2352 wrote to memory of 1256	2352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\33b1999de53ae7a5f5869ba33d2d8dcf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
dc6bd02abd692166584a8256b6aec53c

SHA1
0b9c07b93ff4f6c36c19a3294079fc106ae3d8a6

SHA256
6ec04456d264e5fde265b6f9806cc829eb2d23aaa3157dec522d83dfc2b17b9a

SHA512
fb6cc442ff921942be5f919e45e6e07c1a5e7ce71fd31631d238551a94f8e62d05566a4155dec7734eb51556f45d1dfc5b71c7e54710254e2f961a1d8d4b2e47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da2b3f4931668c4ab10b9b4c17fe42a1

SHA1
8dde5c6aaaf87d692f8aaf02a2e1798286d37411

SHA256
1f5993f95020ffb6f04feb25870cc0105037f560420d7645fef762d73cd8e9e7

SHA512
4b72c9ca30db64c749314cd2f5d501dd614ba14998254491c951b9f102724c3eee76cde82122745128d7e270c8d018eefb036118508e0c97fe095fc46ab1a8e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8c3ec00dd04ead3794933a7cc8ef159

SHA1
778ea8e17a1ad30157ad63d7640f081f03ad1d07

SHA256
b0c4b2850d66094282c1a98207780dd76ed22d1d48b0e54bddbc320bb1b3aa3d

SHA512
51dda07c3b187caeb10539457de4cb2fc4376238381c628bb183e3cb92083a34514d3122d5f0cf88af687fae70245cbbad6b127e311f61985fcbfa4ccd206f47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b73f70f99372c0c14a99f55e3660c4af

SHA1
aa2e1ad4e742590f1b499ce5c8ac82c9af78ec55

SHA256
4a18cd9bbc6a249e951393ed751e81020050d14d6a18d09201706cf3db0428cf

SHA512
92b8330a166e5b7cf72c10598f8b90d0c9398c47d956d4d1c78b6e84103e57fae121cf6fe137ba0709d8b22b2cc990adc040d7025abc66f525cebbc9ce4884b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71c95664ee75d44f610674f990508e6b

SHA1
cbcd1eae6e6d8641ea23ce931cc7fb2b480db56e

SHA256
247a58d37e392e3fe34305a13504301edd69af0f4cb5fc2270576378888bfa86

SHA512
5ce3c9ee42ae8605835887b9338369450e372f4c05005327f64ec9cf0b7fa3ea0d1e70c011422ac06320abd6e23627b8d7d2a97d1c1d9ee6c71d033ccb1f924a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
670cfde6721edd95653841f8a91806e8

SHA1
21fa0d00fd8cefab91cd6894d009e51d6393cb12

SHA256
049e8c94b5038a8dfbbc35a1bbcb09f24477309017243693c772dbfd6c18c28c

SHA512
bc04c078d7105639791ce2438c2db8c86e1d77a460799261123f8b87cf9a69ddedf38bbdb566c8607849457f1fa69d3a5c3a905d3f4ab9f5680be74ba4f7f2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0685c36c0bd69de792860727df8c6ebc

SHA1
2d6ed764becf9ab9fc62bbc6ee2ea7fc210f736e

SHA256
4d95c615ca7ec15ac0c062443fbd5ce7f7c902808b8d4aa311adbc56dcf73708

SHA512
090f22b725f008ec8196529e7966311c6d6cfe556b19f0d272ef5370d16d89007dc0947dfff651a8cb72a1eb6abee786aaa0a379ce130689ad4d1b9bd825e826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc6ebb712d9f734c0accf3f8f830f812

SHA1
c5b726e921623a7de03274628f5b4c873315d81c

SHA256
5c2d3b4af3582e5a5ac9ac8c743a073884ad696ae447910b2cbda639b4b58aa1

SHA512
8af63b8cb330d978d2d3ee09fac03f7ed2c5100af9244435210f4cdda61e75d046406c427cd0dae320ad1ca381444ebc22ed3b54e3fc07f177795ad27b55e693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c429bafb5dc3c0ef50646f7ffd963e9

SHA1
0f0a3a70284879335ec1f59edd5bf21df0ffc995

SHA256
5d0d57614b9cf02c47a5a4a6d145ec37e718a281d497397612b3553c9adef0af

SHA512
6303770666a975164cc79d899ee3a884a118ea91a5806edce5be3d5398dc2490399e4c15784de9769adf3f2e718c10f2dd52105e9a4d884928d4f95068e642ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b933760d4c041dc1a8665acd132e3d

SHA1
22f393cd405746940c034ec88a9e06cfbdf366ba

SHA256
190f03f8145951d4e0f32b0ee22f9edc9342852b09584dc031f053d61e18d3e7

SHA512
c576ea78e7cc6c4681b5c076425976a1b1ea43441e99f34e6e9f5df2f4bd13154cf1e8457bc8829d740084c5f70d2becae0aba8b939a4109be71961db6ad57ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6588780bf8aa4475bc209ed04632d3e7

SHA1
b092d884fc6537662a3388318c340e063b8b48bf

SHA256
80b0d098bd0de2a83e1ad3ed0a11b3b0759373d933c588c863aa6dae32f0a9c2

SHA512
94b901368b49e6c2691dca71804eddabe4c1d8cbaa8bb067281708623b1c557db5ffad0f7665ee1d6b7807ef40f11f9b17b54d2c5e686fe5abd40316280ed1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE82.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar102E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit