801b81111e97faa165eff3894629bb857d10fbbd228d444bbc69bb2ff6b061ce

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d9db1ea2fc77e0bdd83cc12c33f290a_JaffaCakes118.html
Size

36KB
MD5

4d9db1ea2fc77e0bdd83cc12c33f290a
SHA1

0cf31669f4d9a68a078117cc7597757814a13e45
SHA256

801b81111e97faa165eff3894629bb857d10fbbd228d444bbc69bb2ff6b061ce
SHA512

172fa2357ccc02e55d670f47afa30a4443a8b7283e5a58dd990935bb7554cb5a1406758dd214eb0af112d1d509d48881da92df2e13322e3df767cf44070edcd7
SSDEEP

768:p4FQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34a6i6781DdRA4vEOjq6h8aRlR9:uFQW81D4RA+vEOjz6raA7IaRC81DdRAW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01635301-13DF-11EF-BAE0-E64BF8A7A69F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422065267"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002041b6301b3b00edcbb7e50caa44a3a5e0d7159d14406da73c7cfe367aeb6b2b000000000e800000000200002000000039321b5b1296fcf9b3f6a3b133d8fe1ddecd90fccbfa13ba2cf4ca0ec775ff3f900000008466942892f389d8f1d3108d410fab5472a0e5153af6ba488e89db9475fd07bad159d733e2ded957e9ab1f60ff112c47e1a9b8b09424b1dc54e96ad94576d5599e4b0e8cfd717283dc21b08762d79e3d8537caab58b6eceef2102301961315082a2464dfb2c08b4971ca25a3fba2d5830de94d66680a8a32f284b619da75e4db259ea057781e29e5fd24d9aec5911d4840000000621b25d2df13d54d6342d9ae0a1ea1d2607cde8f17af7b65568a748e6ca72de4265dbd5021291631b19dd37006aa289ca37f6ae456e8da9327ed5180a2b9085f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ecac8e46eb274eb5ace3a1971bd449acc432e065b71f94b9e29af327ee289173000000000e80000000020000200000003f6f753385b34c6d893a980b871676715ec6dc5d9652fd98d2376b959d8c905320000000c02b70540ce3af04152eb0410c896ba83b4ac89087794a24c12e93d84e673ffa40000000d54aba2c8094bf40188ce24d17647fce3ca7d2eb4704daed7a008960b94a40b76d9cf744f10ef917e32277191a9a9cbb2186713f1d608c87013d3709a0fa823d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308c81d9eba7da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d9db1ea2fc77e0bdd83cc12c33f290a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05dab3f02cc20d71594991edb855dbca

SHA1
f68504dd55fef44e730e232f22d760db8a61f61f

SHA256
1cc7d6eb118fcb933e7cc331c7161da589b30809dce1124a2a93c90665de3c4c

SHA512
da0ba1825251a91284db74ccc8b6482a702c0f82a4297472a6d20a7adebf03b846c6cb5968bb01c3ec5e439005e2edd759c6078fde5a65dfd9c8d63b2cbb1bb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e57df20b9ad7a48eac00e1cc2a9c0a0a

SHA1
f2042faa39bec1f3cec0eb3c11f85fd39f5988b3

SHA256
5ca2959489c4db896f34bfc402c21e3f6721c229dffe94afc31c9f12c38ec367

SHA512
502c3d7555526757d810311b90f6bf8cd86a12de6e2cde69bf6c44fe2a7c453bf7a8a6d20fbed8e2f39d9920396b46466ad31074650e08723dd9786acd8da2cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70d0fb603ab622e875ca470eb97398a8

SHA1
c539d93083a3004ba1b7acb2187c23018f9594b7

SHA256
5e953306e4c8b0181a2112a677160132957efd4bddcded0c302b0f5d940eba15

SHA512
99faaf174b97a613e822fd6fb3c659f8803d95c562c952d45f403e901ad5cb5f8368069bb5ecbbc6c6e684567f40cb555368d92843f946af3882a0133242c588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c087ea064cd5a2b5df3ce3385e611da7

SHA1
1e06777c9eaf16f2a500383a3a67a56d1986b837

SHA256
94d94de360cb8256096d0f88f9fb85f3c103148e9125e647f440aea05435a7ee

SHA512
1e5cd5d43759e3aa5146490c99348ed9ea738dc05a7cb43c9389b61ed0578448f49ba576193add992093c569d04e28a985ad3495d0a5525c4a25631eefd1d60f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d0a6abf06fb488c0c83e8313005441e

SHA1
97d0512928c44bb23ff96bab11db883cde79b6fd

SHA256
1fd5c87096aa8e06db4ce2249254dbbb6ae12f48bcb55b011a1f2499aa166f4d

SHA512
7bdf7d1836a8cb6951ef877b2560982ff6483e76d158fe4b9d75ca14151e58963b956da261277ba874a0d8a34ed8108d8925bf062ffe085928a6e7d5dac40c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06947ef73da18e339653d6fca791bb15

SHA1
74727bf377f8389112deedf1268bfa3774439f3a

SHA256
2888c6471baf5c0731352e35e1d5b021cfec655530ae92c5934f7bdec0ac0168

SHA512
64bb29f0a05ddf2007397467cec09f59bde3de74241a91dabde8ea706b3c34d5e01f3fb59998045ad36de1381b352a7de22245bae5d092fade7d347c2c8057a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5365e5e278cee5673a23fa5ce52f4229

SHA1
d856ffa9429ca78ac9a4ce9383c6541303045bbc

SHA256
d4669c590f33386c18723c586ba7783fdc2f6d097c22d11e5b63736e3093b4cf

SHA512
387d4459aceba13f0452d9414a6c2c9007dedca1f334c36a3ae7f76db9c3867e20876a30e47e3cb3dcf19968e355aa3ced76cc4eb6234c81410d003a07340f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f74d2733b7f03fa23cdfeda99f1b47c

SHA1
f0e3865205293088856c35d3e4fd582ed301da5e

SHA256
b026a8f064aa965052d6a8e09877cfab7153ade3bfc4e59a9e7b4df331a6da2c

SHA512
f3aa820ca3515b4e72c283aae3d3b52cbde7a70f1e52359e4246131a8adf20d3e14d2dfcb9c5bf99bd7b7aa6439f85b2224b16e6eb983d150664697333e67a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
224ec4d868e6d537a7c8d6df067f4061

SHA1
ecdd7d3a1c7a1d99cdc7e724655474b83ba690c2

SHA256
2486a9e61b153d025f46b31008173101e456e42870a72b1e8a03bc889b0e6f11

SHA512
6f976579eeb427f135d53888f0d27d1b39d34dfc620ae3d1efa2f7d930945558ed60507cff97ea25f768d2c069a4ff755f9c08ddbdcffb9c357be4c3c836abc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c62740ff547eb0028bd8fb5dd6d6a0

SHA1
3249e58d5b7c3c1915685aa7f784a90eef142c46

SHA256
46bd24f90dd569c8b431a84fa10cb24aaa6406ae75653b6ee54b91da08f287e5

SHA512
5f159a2d86043d50b6e64bdc21eafe18d4ddf94b8171262e7076b69837f8a88fd79bd66f199f9755c8f8ff619c5b7e6e54ae25e4387c70579463fe05c65211e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31947b4e443e54c956216fc59361d8b7

SHA1
6b8a4fda1bec75ef932977ab2394503a274a86e6

SHA256
ebb2421b68537264335e1728023bf71133508ba1fe061d92b69463cded5a7686

SHA512
9c82289c195baaef7a08c1601eac2240456967883d98634c1777efe57771a1cdce03924c0964fec10248567f36dd27b3fbaab6ac7ffdb47eec3a15d729f71674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39e603f542113c07fc830e5098e1a36a

SHA1
1e3eef7c9f0d2012015b59cada38549116a09d0e

SHA256
4f452b40798c1285501eafb45ee6414972be2f0ddd621d200f57a7a11a5506bc

SHA512
834034f2bc4fb5c30030c237617a06e8f040400a3912dcf0e9e08007a4c5ef2e30649102e1433ad3b8783b6dc7c0c67a430ac57d4e74544756756078752cb12b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e00021ffc9376a37421302f1b8060be8

SHA1
e94c3a6c49178403afa762baaecfaf75f130ecce

SHA256
ad59a1e3f9daf4fbf4d3cf16da3cbede62f3458669ea3d8862800cf1c029abeb

SHA512
7d5d79ca4813bc375f36298683ddbec4b183a17e54a2407bdeab0dc154fa88f5fa1f6389b2712dbad9729980c7f99c8997fc97b69f3329454a480cf7f3efd3fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa700151c3fc43c020278ae3cdea2309

SHA1
edf222413bc628d985edf279b59628c9da71569d

SHA256
737ab21e75a88a560a2ec7ffdb829e67ea74deb73977ba0fef8073b1fc50192a

SHA512
a64b4153497b787a1ea93ac2d40ab1a854e417c03582422bb2c5cd074aec7d8d9730c09619fe06ed93566f19c9576dc6595d7b1e051841c47ba7265c894e11cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a52f723bd498569a79294c835565583

SHA1
8a3c1cafa5a2291c0d84bf7f3d723c110f5d459e

SHA256
ed548c0aacaa101f3d39393805cb848b11a225118736aec88a15aa6cdeda0645

SHA512
dc28d44f880a6726431785258704a24f1d8a691123e13a1926bd5eda98f0ffe9608f2488b9b4412abce5770e972d56a12aaa38d236f158ac6f04bdbb62910e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3941ca8c6f434cc28b3e23f9ad177ea9

SHA1
f20057e58acb30892603de54477b3420ab141cf1

SHA256
d46e3e6e3242fb1d217abce8567a02c5cd3c11cd1a7981e3febd7471871c2114

SHA512
767db4069c79f42a1ab63141a6939c02a007ef963ae027f2ba8bb7d65cafebc2bde8a6264c5549a4e9e3cddfba29dfd46fe17d73e9adbc183520f57d79d0830c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8d2cfd1550375820f63ce8458b76075

SHA1
ec1769660652e1c5022c8eca470d00d1dc4619e2

SHA256
e2bec5c86c466baeb12a14ab49fc6dc10fc9e1da8224a0bbd6b8db545668e6a3

SHA512
97822534e77d1ef834c97508e76e6b32f615681bee4ddc07ac2c5039771f4484ef8804062f8f2c2db8a3f4544c3c5d923e7c81545cf03aa56d8673141bdcb4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37C4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar37C7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit