6d7fa6e2ce4137df2ac65119a034a577d105a22d87bee0fb99c62551b002ed91

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a0f66e72bb1dfb331ae58f9d050a1c3_JaffaCakes118.html
Size

22KB
MD5

3a0f66e72bb1dfb331ae58f9d050a1c3
SHA1

c68adbeaccc29733c893bf1b4245c3e2eb795dfd
SHA256

6d7fa6e2ce4137df2ac65119a034a577d105a22d87bee0fb99c62551b002ed91
SHA512

daa276e8982fec9310c726858010f0294484ce3c572dfe68ce3d85bca5e410f7d01638b638e142fd1c1174b15c6f488586ef478afca595660fe39355b5c05482
SSDEEP

384:m4BA/AEAW286PmjpMDBRuBUo9b3qqcSW1hiGbZSxGHp3HYoAx3HYoAAX:dBODOopMDab3qqcSW1hiwSe3bU3b7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{412525B1-1059-11EF-BF0E-72CCAFC2F3F6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d032c41566a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d33a23c4ef81a343a8185dc7289a03fc00000000020000000000106600000001000020000000b6eaf952852746bd1b54b65e3599811ce99b45bdac3b4581f622c79970ebce11000000000e800000000200002000000086b0ce090c83a6ffa0069d36d75b46e391653965f2e1140daa510c290a6f2e9b2000000018f35ff449b281d038bcf5bf2bda813c0438b112083593fb60766c7c44fd643e400000000183a22d9407b74d301ffdc53fe4e61c01bacc7e5df5e9dc48305c247a60201e23e4e44e7894876b19dbed379bdbd7faa2b6686a93839de155778133b494ce99	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421677968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d33a23c4ef81a343a8185dc7289a03fc000000000200000000001066000000010000200000004eb3ad7d6898a335446b817fd045f33ce2ab543ebaac7e37aad8e9c743e5b6f4000000000e8000000002000020000000432bb9a030f9ec8babcde6bfd56a1740eaec66ce84978f87444dddfef50b05b390000000a86fec7c80c5e2d66d4c0c5086207ec49cdc6fbdef28e1b86ee8dd9d7114982653a551ca12f87ced9f34ab2df7811b5573462a833ed17feb15328d4aa2b8127562917e5ddcde50d3bdebbfebfb72c2f4ff179ccfb98eff54beec0b50031d78dc9b0545a243db2a0256b6dec3c57430974282e72b9aaabfec1d2eb7fbfdfd5a49104c12d9e8edd2f3c4ff6e2ceef5d4674000000039e0ca8ea08a2d5e35940ba9b427cb96f6000f4a4874f38e8a39e87cead31b6f7440468feef6c3d896c0d4c3a313291856741e7d1ddf9dbf8b847598252882aa	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2056	2924	iexplore.exe	28
PID 2924 wrote to memory of 2056	2924	iexplore.exe	28
PID 2924 wrote to memory of 2056	2924	iexplore.exe	28
PID 2924 wrote to memory of 2056	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a0f66e72bb1dfb331ae58f9d050a1c3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
aa1867f7133ad95273b00bae32939fbf

SHA1
45260f0068e4268341b3ad752f03badb50f20271

SHA256
54fba486e46f3629be4d945224b65814c09f08b8ed27dda6537229e83309122e

SHA512
ecebaa272728ff6fda5e42ffdb30d41caea08e3e6c51932a692383bc2465a32d0d5b077dce19e9d16ccf7f9549dc53268a57119673e40c8169ff7bb9cd1f53d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ac784228dd1c94967db2f1d0462b64c

SHA1
27eada6cf008ff6163eb79192d23370a5ccfdd56

SHA256
0d60a8a79c2ecfe519a21c541b067b7951ab14b86eee9eb675deca7622278395

SHA512
47abf5dac8d02034bd196f80021b949bbc2b9454b48c64f39a1268b7a3ae2b604422810cc27765037842b87c31ef48b2e4774db4b8c38217a488e93950cb3803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f18f9dc7b6bb9c045f78443ef98aa384

SHA1
c3408bd7e2633d8820032c439d13a820343e781d

SHA256
5431d478b9b447c925a57478312f18f6888bb5830a866d812e16233891f4b0ba

SHA512
cfa1a91df2611a9105b126feb9cde7bd720ca77d61384c55b9371a0dde363604ce3e485e5b1fd441cb58344f5c9dca8f298ebd75ed22dc10db28c140701410f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71fa9656594d16d3ac42f15c2c68215c

SHA1
fb48777548ab90099b41e8c86ee6d1f2825cdb04

SHA256
526302ac243b06cf5c60eb40c5fbcb739c0abc0d6efe3e3be308b3543dcae6f2

SHA512
9f8d5ef31fe2c35a081dbf04e82575f66f8ad1751a9e0cd963c1c5fe6e6042cf51e3e5c67c61540b943d65d9e21c509262720335c356598dca90ce0f9fc9ddae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
900d0b88fa0c093f6db8af64682a9300

SHA1
38e5fed0aa9843f2b78cfc6928b4685c296ade1e

SHA256
164fe6f538211d08be6654a06e79ab4776e4c655a6fd0c06ad87fa469e701cbf

SHA512
e5f0b516054cf2df4c7e4f21a5d330cdbe095bd5ab9c80458d329336adb49d48771e1e37bc8dfcc7263c30ece8c3edc9d46f62e2b31871faabd6762c2bfca8a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7beb0211dbde880369fffee73af4ce7

SHA1
94d983fb36e4dc9d7c6a1465a1550718aeab9f56

SHA256
cf4ec585b0aba2128efe2defad47464bf8978fc77acad535fa213f20c25b0249

SHA512
52252fc723f60454cce2cf4530ebd2380afe3cd74c9ad613ec37e527e4834591f01c30d337e9a14af9e34a20afac170d4ceb732de0f8c8b0c7751dc145783e4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bda6f73ef48a1bfb1a101f6faed6be8

SHA1
3daad7e5d005af862971e95ece842f3348bb0b8c

SHA256
729c8138ad9f6e6c3f7d87bfbc7ce1cc2f941b683ca027b9bd348c8cbadc3365

SHA512
1417c0f4e411d84bc5033c2b76ea9c86b3d14bf3c0e90bc17c659b8273f4804234d3ac6d37c9dd3d14e39b9e104a568f97fd75265ad0f5095257d300221bd3a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2afcb0844a47640c4eb49f86b848cfb1

SHA1
a3e9d0eb74975c1102ba36300c3ea1d4fc6113cb

SHA256
337fbaa456c7ae78a79f8b112953eed17ae3a6a40944d9479fe53f23f6b5e8ae

SHA512
5386b42b3eb185c07f1440f2c242a5207fd7beb8493ae337f0410b1dd58583b749df1218db5936f522d0e6b05ea6f7bd08e7d420804bf4c0e233e1fe10c71a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82486548830484847ae2514652ca81f9

SHA1
e9d4f0fb18b98dec35823ece5396fa610a0a101e

SHA256
2bc1219c69e6af006815bf9beac24fe3bd4361edeb7771e72478ca3fa1672715

SHA512
99e5030643e27c60a79910208fbac3af69bdb2e0b5bde3564d2892a72b5c65a4710e64bf346a5cfcb4a2ebf8a3766d79988240e44344c6ca3b201454039f4664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
846950ccecf341ae736897e6bac89844

SHA1
3a14577bbcccda2fda60951b0313c4dd3da7d71a

SHA256
14cb0aa90db34d39a41b269c00356dcf3eccf0134c027ba5d97d1d822b2ed153

SHA512
163d19c5e4fdf2d3d6fdc4f5e966bf5caead04db22eeb09a7facfa10c4e25f8b2f92df9a08523d1845341be3fd6627bf98bb817103a3d83de44e865bf95bd182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b93511e2774a3e695c866e073e6212

SHA1
d9a1f2f67406a9d1c051b9d12c8c2b43ac888455

SHA256
eb0266fdb7bc2ffc575743e8fb4338d9f95bedd385f695e46f4f2c8772c31305

SHA512
d76b1d33a403d349cd40d9abd7cbf6841d022b7b588c6d2bf50bee8de2fdb8eb46509c88566bd069391f85bd2515df7371eaecaf4f5f8308f36f1e55578d8bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9e0c89666d1b391096236b748f8e669c

SHA1
c57531fd94cdf68c42bc1f14f7056aac1e3dc05e

SHA256
af643a3ba8d08ee8949fdfdef5a39810b93e787e30e9de55043a57526dfc7374

SHA512
ffe23f68f5b203a107df7ba087fb21249e0172bf6416a578c239a110a8ae9ed3fa0e662ddd5ec0fe6d32fd3bb47a801d0bc40cbcab34d04475ff955724234edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3375.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit