1f6be4edb0fa8386392c51685afcac20bc0dfbc60df821ad517d37e06d9f768c

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d135c20a53f389c35df5a2f850a25c_JaffaCakes118.html
Size

15KB
MD5

41d135c20a53f389c35df5a2f850a25c
SHA1

edf00dc8be5f02cd5750f6901716c241b93d33c1
SHA256

1f6be4edb0fa8386392c51685afcac20bc0dfbc60df821ad517d37e06d9f768c
SHA512

299a4a8658a37ac5697fa2b211bbc1c877abc7bd7f9d257a893116e092b62d4143d3ec7fa29b87b047d01d115e58f62fb274bf59a097c6c33669d47346c9ab62
SSDEEP

384:xKoojOOTiiVoOiOGB34+/jIBQEWI7cQIdDpOw:xKnBeOiOGB34mjI2saDpOw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b81a5b0334b4098184d63fee0d989c03bfdb147843981009e3b06b159aff98c9000000000e8000000002000020000000282ea74a5bd30206900b1a73d550f880584f7e858c357875eec1643a2c3bd71090000000f7bfb6b2131c646c6debf4779b4dc7862ec0dec0830d6f701cea7ae131963edfab97b16a57d5a53f6b4424b9a5d920c3c9706e519b2d4d3255876e1392f83157c0a8cc6be0375215f99fd8165fa18b6e271553bc2485644c7bed16ffc08019638eec5fbc370bec7d2446671c96c89ffb108d7a15dfd6c8d1336c1a37f0978e7b831baf5299e91ee2727641c5f22eb1414000000010f2d4a8712e43360090b5e7359e6381acd4e8506fe785b2fbcef0eb1f8e7888205260bd3ba07c8aab5cd5b5867ae5f5755acf9a30c2533cfeee7bd1751b5eda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000cff51dcdda09606becb4aa9da5310e1ca6b9dfc7f0e67a4460d1d99d3a03b1d000000000e800000000200002000000078a8383df52e30ce220840db4daccd9a555c7373021b0fe848ecb7146930730b2000000095a1a37fcf7ca624cc43922d34cbfd722306067d1f6d36debceea08cf9b1955d40000000b6a3ac1431082f16ed4a9d2539f504f74e9dd9d851ead69b6d43f96b675f88abcefbdd95f229880c64b2ed2810e80e519dc6808f40a06780a1826c407ad232ef	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805754a60aa6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D03A8971-11FD-11EF-A7EB-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421858603"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1692	iexplore.exe
1692	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2616	1692	iexplore.exe	28
PID 1692 wrote to memory of 2616	1692	iexplore.exe	28
PID 1692 wrote to memory of 2616	1692	iexplore.exe	28
PID 1692 wrote to memory of 2616	1692	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41d135c20a53f389c35df5a2f850a25c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e4d3f2b8247c01743b97e422c52be1a

SHA1
9bb932db8a2e4d9061fd77f841066c49ea6da419

SHA256
87e7954681ce3aee002e37cb5afd651f9c0537797a772b21d43f6cce12b7d7e0

SHA512
5c1062556096bd499b1c71a91a84df04bbe47f2279be16bfe76cc74f126d9a122bfb5198befebcaaf080f45067d288ef7f97b2a920348dfeea8a2ae536bac44f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71e5090f15baf781f66a240e94300123

SHA1
2287af134964352278e81544de7bc06957666752

SHA256
2f54acafffb81a055dfb80fe390969f575285ef63283c9e34876c0985b6df607

SHA512
d86cabd8dcb1e6ff4ffbc7e9fe6c857563be1f399d1a3c376116a22012c65ff932136e6adf3eae48ace0947ff9719d8557824c0d544fd765a88b579734582fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df438c64008a218bd618abecaca6e019

SHA1
c7eb1b2a9520698f087dd74e13a5d3becf04293b

SHA256
57af3122d372e72c797144d314ad0bd7c0e1f9fa73973e75aa151d5cdbc0e973

SHA512
a06c0401c8dbab8eb791f47a477ec970571a560263c22e54cd4fddbcfd05211f02a51f44b8dfeabb953c1670f721862e872c737cdf983e52ab594eccc5ff1f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b4115288504de7ee6ca5302fa0efdb8

SHA1
1193dc1cefeb5b5f54d59204569f1d71ddc73a45

SHA256
6d77889e248f4049946e90a991bb3921ce821fcd46f4317284511c2623d7621c

SHA512
24a9156633abeb8e203455069eae0bd1b5fc999f1f56a1a71e732a5f7313cdc6c45832953293b977ffcf0b6bfcae345db81d960860aaf01a46b5bbdf70f30bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6754208ac041e2d90ff13ae03f5b38c

SHA1
76db2a19a93324d41631cc2fd5c4f37e02bd7dd2

SHA256
2be11a75e4bcdb8e44b5eed2a7ed580b73551c28f2f6642ffa0b14b7853b66ff

SHA512
89a1b1dd6e88d64bca80a057dc39784c8c7a47df40301e02b29273725b819c55828745b61fceb7d473484361ad20a67ad2ab0ca136cbf41a64bb8c8609ee1899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d89e3952caab60c3010fffce91391005

SHA1
cc5c154b63da9e468f4523b79d892d0bee19a9f5

SHA256
3fa9867ddd91d14dc2c0e73d6ca37984af44de1785621b9bb55b8ee83e1395cd

SHA512
8162139d8bdd430b4dc6baa61aa493cb31fb33537ebf41202096a2bb0ce268b131cb41b5bb072def6d03e4f02396880735b8a73455711c2244eb58b91e726ea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
641c16a73e78cd1ec6112e1b9901f17d

SHA1
4af7462a9711ac056f50bbc9eb4d34895331aa08

SHA256
1e9c4bb379db99fa7c47fe2df8ed26e2ba2641efc89614047f29752a09fe0ca6

SHA512
39b77c644e873da58441434eeb656ba62a7ea601a2b1e22c2c5df888f74979f9a409bb63ee635ea2cef4eb658ae84fc1a8fbc88a2ca1cb176e4ce47f1302fb14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a3d466da51016805535648a0752e442

SHA1
6b8255ed8dce453b5430714061ed613c46a6c8df

SHA256
d71dc51c5e381d123fd0f7d8ee3d108a0713ca9c25c31fb1da550ccc149dd045

SHA512
fca9e78c50ed2a8617f9374af96f304cc98c5121c84798c642b06273d33ce7b3cf5fff8df4365422dbf48b1d21e24ca97a1b2dcae4f5f068feb47665dbb950f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e26efc453974686ac8a48aa3bb47168

SHA1
152f351e4a30342fb8891720f34bc29779e04784

SHA256
de04fd5af6cfc6f0bb1505ac801c9ea546586e83aa77eba013bf77149e438f74

SHA512
dd0c12b6368dc78e6728db25365a928796d54d873068d28f69b32163445ed1a01e10336b8f47b90998ba5293d62b08f3d68851e35d55989a869ba0177139b594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
653b7a0dec09ca62b86a94751b349bcd

SHA1
654dec9f538f982abdf98cdad70bc230aad303de

SHA256
192fef8dd563bbee7e4359f9c895e4e4a40d61a3f256df3ebc051c024290ed80

SHA512
b04ae4e3386c819d07c917c67ee9529ce3e5f044152caecc53c493c19413456ca6470c467704050d5b135924c4642c1a8b022e5976295834c35ea794ac3d64e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea6158d638c428b6ee409a3ea69249bc

SHA1
b2d6d37150cbac255f286c9a3473a619ccbdae39

SHA256
06ea0656d0e3b4a377e4457a41b080681a8c090b447ec58177f0f8841e66787a

SHA512
667220b194ed41777cbb6876fad253a3239ff04398966de4ccdda0e528f92075fe49d2885114ff5addc70d0ef277074feb176130cd074f8d14d8100308c31ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3285e2c4d407b9b9cd97445e0f4ad136

SHA1
3037d2553ceae3e4ec7ab6a4f44472d7ffc0daa3

SHA256
3f533808f0d8180664763646705f6bc457b8c91b34249eac0f63c541c4906bcc

SHA512
8196e94f39ff0d4ef743d5c95ff985ee7ade866ee479e884899336994a84684767ebc92b18cb6c02c85850640dfe6256bbe7158c1bc70b32f7c03552ff935d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7383476aed6606aaaf8d01a8abcca460

SHA1
2637b69ca604959f417fb51cb9b80d872e8fb12f

SHA256
2b3bd15ca7996272b2c2f3a70c0ede6bc0bd7d2aaa4aef7724da81a1a3b4ef06

SHA512
7635e84ec9d7dd2f566277b5efe880ebb5226083e1167b505a60a44d3fb2820e359920e36a550d847e9a0b12f66ffe6e4353a5a138ec7524d047904ea50206e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07f50e6c6a49192441257bb2f7c7b54a

SHA1
e55e4f43403f3b8540e5498f8fa2da432e938160

SHA256
9b21fc6aa30fbfb0ee24f979f520a537f41053d8f50e276df3ad52c4aef6cc90

SHA512
8d64d32d0066cc618c68273765f65af6dbc49e270208dfe8e331f390f8c4dad3ba00380a5e9006f0722d8f1fe403bc5bacd10c3d3e57ade2f011b950e99d05a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
528d7dbb96076afd87d2a23104206750

SHA1
a992ceacf7fd99588e8126e8836d971fa3fba7bb

SHA256
ef7ec5536520982d61079bb4d232c5671212a9840d727d864cbe8a194f3fd773

SHA512
602e50158d1ccbb6a5d2a742f3e458a3d665990ae8297165482b6ea3c930a5bfa5b662192b64292950c2e8c9c9899faa0ea0ae82a6e069a13a12b7c966e064e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA89F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9E0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit