f9e9b780818352b9b78552348e36ee9abd8c7b1cc7d756645ce5021b6f8278e0

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

368a6a40df2b5ee09a0f21f4f32c7c77_JaffaCakes118.html
Size

12KB
MD5

368a6a40df2b5ee09a0f21f4f32c7c77
SHA1

7b8f56c751aff0ad1e9411d7dfe89ed508a1ad2b
SHA256

f9e9b780818352b9b78552348e36ee9abd8c7b1cc7d756645ce5021b6f8278e0
SHA512

79660f5b21c54aa8c5809144435d574d4ec31a95d41ea9c9bc8ce0cfdf63f2e2d774cd0a73e87dd343c3dc997ac372a546a91f29647244167c6d39e8a4cf193a
SSDEEP

192:o2cJvHP5MG+FlHkCGJXxu2zJuAjjSFDOhmECaXFrdNaN3seMl07O38hlPnEL7XpK:SOrGJBu2tuP05Frj8MCWOn87Zt7LuH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000088c1f3f927c516985a4c67a201173f8891c206e336e97000bea87bb6eef80ca8000000000e8000000002000020000000d41bedb489990980d1fb713e387fbd117790cb82727b8b2b49e14e0012410c5d2000000065551e0e312eda731ceddf2e3c28764dc32e8fcc11834ff5568c0ff236160fc540000000eccbb685405c3b1ca1b08dee54be1f8a4487eb84dfcf7040a5571edaf66bc0246ddc9d9db270c9cddc74e62f9dbaeca0a4ae855109e9663cf6187875ce866979	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421623325"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{076FB031-0FDA-11EF-8FA5-CE57F181EBEB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000008497136a351087ffdbfd2bc78cd9a36447c5bdeed474db777d75e6e858cb860e000000000e8000000002000020000000e147505b0d230d6e95d5aa91375beaa3ded5986e35e7c2804f27b0fbbe1041de90000000d8f72a4c858842714fe72081e5df369623bea8dace58c1fbe49cc6cfea3f25c67910ca769405f9fcf6e9bd5510a91d7e3daa4c363a1dc229313ea1abd814e725a3560eb773d5a4e6f262f57ed70fbe72fafb4070fc01c32540ae9678053b6e63d4f19711f6037207d99f29720861795dc1ec38d2e44cca209853ffda43cfe0444f74e023773702d0167325939016f211400000006db63ad73f5c68be9fc3a80beca2dae3ef6c7aa1f69bb43a904355dbb2d4bcfddabc67f1af30eb2d49c5abdedc7369b4a0fb3fa188f0a0d3c8b280681c6bc562	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703bd7e3e6a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1668	iexplore.exe
1668	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2308	1668	iexplore.exe	28
PID 1668 wrote to memory of 2308	1668	iexplore.exe	28
PID 1668 wrote to memory of 2308	1668	iexplore.exe	28
PID 1668 wrote to memory of 2308	1668	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\368a6a40df2b5ee09a0f21f4f32c7c77_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69967ef4e233041d867c76e7c6cc4d22

SHA1
1d6470771e3df8b5009661fcc7ab17ce76fdf064

SHA256
ceaade8c3b1c7277b85a1996eee521f5b60ccc0a81a5db068d95b333e2a46fd8

SHA512
2760e3a1a92ae9e61093eeecdd2befdc043a16150f689634d437a132c8dae8a4d4dfc91618fb5f5454fb605f8244b910276bc34e56688774e6ac1d403199dba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fddf55b0bb712dcd26813da462df122

SHA1
1ed5904e4942c614cfd873dd9a385c270de960de

SHA256
d7e6a3b9c09be620d882d258c05b4c4290e73f140514d2a2bdc2003d89251bca

SHA512
6377fc4c6f34e6841784c8ec527e5cb4e9981adafa1249bfee197842083ff4f2dbe9425e7c126d134845a5104b8c66421f58f072a4e8b92bccf97ca29680605a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ad67941b8f17a13a4abe7c66777e40e

SHA1
96986570d5996cbc7d64888e777df8cd126a091f

SHA256
80064b2d42eea25d25e02010868f4a8643f3fddd7ce014ab651760ead8884559

SHA512
9fd5a23872f80b6cf4eb393dda3358ebeccac8b8f7d4806df7f2ef7c8ee3235c61d7beb8ffdad7cde26ad27831d7103284afb4502adabd557593737ad1bdd072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e687079cc4bb912b78f34330b105659

SHA1
83ccd4d0609ca7980f898779b8e6ef1b3abe201d

SHA256
a48a22beb3bdee2f3589229823300f813dada866a5a2beb5d3707f0c38056b3d

SHA512
c5101c9a5c7840fc245506268e036e71e14aecc63a2d6b24812d1d1d9b42dcc503f9ccd3fc1bb23ddb41b2ebac7f82c220d0a32129433e229ee9f21db4887fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c06714a8ed01e0b8321818fec156ba94

SHA1
108d8a1c6447f028c4cda0c25a7c6dea05c8821b

SHA256
606f8ef69525def5592f65a4166f435d6c1256f4d49b8def47e3930e09fd29f9

SHA512
2847f42a4aed953ef3e40c8b09da87bc4404d8921efa50b602a44af39cee681a5a90e7c44275fd04eda3db81ef4a62a571963a040f1882a18194119ad2dc1883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbce520e9e3663d11a04d1611319cd71

SHA1
fa6c56061babe116829deab0d07fdbb1142b21ad

SHA256
ed05f10b9d4a399aa10a97251b6950b37ca233c9357385dfa4687ec2aa4101fa

SHA512
25229393c7f80e97d56bb4dde85d021aff06b02002ad4564bb9e94ab61b647be08913a298862959aa638788ee0585081881fc2d7d6ea5a1c0e421645870f8239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
240c3f462ee41d9d644a3c37de757d52

SHA1
7e7faeca5d33deb922e2b331cde95a8e433aa38c

SHA256
9312f605261e4a0c4f5b161442164df617278c1e7ca96b5b151c0191e28dddda

SHA512
b8e042c6924348d06bd00faa25b106e0e5fbc2e407a95ceebbf9f3a65e5549538eae29be70b218612ec88b5ada944b7db768577a358b6752e35f837c19c8a097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a5a503f3da4a3110526db4d3c9fc3c3

SHA1
66ed70386f1023964e5c10b994ee0591c11aa032

SHA256
8d6668412f7774e797e03cc5d05087688a1626cf10e22a5fbaf431720a1dc5fc

SHA512
dbaf3492ab61d82985192f51b51fdeff917bbb06007bfa3d37ec671a6732113349dacf9157497dfffa1d8ec941d74384e9051bfaf95c9f3024be5c7f0882a256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d020baf44b65faa1ee44cc631ca06f8

SHA1
38479b7a21cbba73006eac28b51c6e91d5edb317

SHA256
8a8bd50ed0077334b72cd225dbb0c956b908fae3026d6d962859ecb030358b06

SHA512
4f98cbb684a14ea4f5a6031be561ba307571dc9990f752c6a253a0bc18816a9740cfa20d2494718a98a680428bb239a1e211e7c10fe440fd53069e23dc9b820f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39d1fcbd4bf35fdb353f2b723e56412a

SHA1
30628d6231ae04a0f6339881bc437d932557a271

SHA256
ec6a3d7deb86c3eeef4026781e6ae3db8b1af79ca10049034ccd75f16c2f72a0

SHA512
165ed2e3b7fa93ced1f8a3f60f6b9ce18fef8c836d82277fd4c73757ad4ab19a0b9d1f8312841fb7723ecfeb82cc4412f3e86e447e9be4d6aa4261a07f2a8770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12f546049e06a641d3cc32b635b5c1eb

SHA1
39789aa0ff93429d3f455121bc48356b8c317991

SHA256
2816e3d0f047bc1fa1bfbec78b49c3f40c861ab35d9154b5119975b9fa90559d

SHA512
cf0edb3a3ac2b644ca7b6896eb4d9195018113931df0778b9e0414b7b0493f024d36407b3591905d28853cbd8b55e3b7d76f49a86b5843f4c98635544a70099f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6467b652976179e42e6452ffc321c7f

SHA1
4f1a3f403eb0888238fa9d05527cbbab9d8f4f98

SHA256
4b4a8769fe28efc506783d8a0661f9e267b63e9a8b5694b3bcf11bd91b48dfb6

SHA512
7942420500221874ccfae9007d63067cc79f1be0931da2765bd67cd31215fb804e3f9ae648312da618e02b1ff50e344aefa293f8ae51b2c959b700d6f8bd1acc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aae289401844bff541d69ca9e0415438

SHA1
7cb30fb4ff8add94b7f4216beb10c81dd59e49fa

SHA256
60475e1623adbe3397fdb4d420b277bf90afd6b43d27dc6d1430079fcc267180

SHA512
581601f315f1fd02bd83bb8e7ac24077b4c05eaaf9a17f6f386212445dc78449b68153f8001e8fa92981d01cd03bd9bbad233b533b5ea58cbcf23931b31865dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9eb67d588686833b017dea67165b8b5

SHA1
2045cc74bc020a7a68b205c5410e6f3b2d0fae9f

SHA256
61f81214d5064fa1b3bd2b5b50a71497c79f3266d73b4f02683e30d5417e2ba1

SHA512
a678f0266c5270afe291ab1b729385956708c562723b1178f2a154648c04741993a05489b25825ce5e32dfd04cef7ff25e7588b69f0c09c4c262878fe4c22a78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8b3407826ac2f282b1ef97110ed8ffb

SHA1
8b32a181ebbee725601c0afbf1cbd5d149507bbc

SHA256
d26745ec481acd30cc5cc6beb0bf1b5f2ce8208ac5a30fe652e11462b92ebcfd

SHA512
b1a282004963d79dd1af8d94a2acd3e7b9ea5d3bc1aa044769624d28fb4e674c4a79058ab71c9556a653f6571fb236399753ece0dc5367f7a916c658981912df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26872c11d8c508da052eac4bb5bb7017

SHA1
a342eae7cf4ab3f7798797b1de2b5dc02037eeca

SHA256
872ce6595e477b5c4c3b8405204c15966d96db881eb414b8a18409bb51314567

SHA512
2cba916d303e33a2a9b16c253f77333c015e4b5be957c7e8a4dcde298892328c783da6afaff6ef964355f6ba85ebb56ac8456c851f8f4cebee09fd831322e4c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab66EF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar66F0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit