a8d43e9da8326437de6f11ae509393084739ab14954599201df6ccf6c12fc1f1

Analysis

max time kernel
136s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94847fe49da6bb606985a5b5d4920f6d_JaffaCakes118.html
Size

137KB
MD5

94847fe49da6bb606985a5b5d4920f6d
SHA1

55b9332d083d2e6c03e0c0508e63a28b25540fe5
SHA256

a8d43e9da8326437de6f11ae509393084739ab14954599201df6ccf6c12fc1f1
SHA512

00c4e612df0213e126abcea06d13658afaadf0bbfbdb7157b5c737df59c310f2c9266dfb481f48ff9a9d776d1570cb1931311fd6273a4d76bfec3fc11829c460
SSDEEP

3072:SklyXfM2OBSyfkMY+BES09JXAnyrZalI+YQ:SklyXfM2OJsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000094013802eac58727b0188fead68a257c7332a8889574fc7b87cd5abe15cc63bb000000000e80000000020000200000001607f75c7c3e87c502c188b52d09a3c5586e639c2221c42763a6d96cadd733b790000000ba0b37e9038b36e489dadc0ea8df48ead7ceee0cb3fef5f75094c33210453d740ed808aaf84ab49fcbc35dffb7e1114d023008e4cc4365c8cc1d36c0a4d12b9cc05ddcdf3c271140b6b7cfc60e2156eec7d76ffe5970de3289db54c485dd3ba8405be29b677503e6f27605f342e4586abb34c62bccecdf96d7d6eda45eb244368582626f9e4cb8a88db2a62f152928b6400000009105a615fead175f24e302a36019a5a20c35621ec387a8dc91594881fbc05d5dac98a968830f170e8efe594f777a2fe15669a11c28c87440ade03dda7fe27ccd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02cfa696bb6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56638681-225E-11EF-805B-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423659273"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b7ec1993510202b153e5b17ced60d4f629bd8ec169f64c2d59e67934d3b4f201000000000e80000000020000200000008df539645caee7d6b8d1605c50fce7709b22f91bca3e72a89a5da7436e28c5d1200000008342ecd62e9ddf062865b4a47cf233950bad6dac046b726f81522a34da48c4c040000000608542c64e6535e22180133b44d4fcb3f42e2ad94ad2974ef49a86703f53e354578cb773bb9e71ed6f6427aba407fbd6cb27ebc43c341c7b667d515204c2ddad	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2356	2436	iexplore.exe	28
PID 2436 wrote to memory of 2356	2436	iexplore.exe	28
PID 2436 wrote to memory of 2356	2436	iexplore.exe	28
PID 2436 wrote to memory of 2356	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\94847fe49da6bb606985a5b5d4920f6d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c422ac351d350e01fe70b021245b610

SHA1
20d02f0e6900e048a36be0a52a3cdaf49965c60f

SHA256
be98d16afa88d3f3ede6b89ac2d06fe9dcb0e01e651408efdeec5e19f0ccc128

SHA512
c40b5d01c01ec3ab43fd18695dbc026dba4ac745daebff0d54cf27938d16c80e2e8fcaa92a4ef3ba7077756fe3fd6cadef4b0f0966dd40fe6bb4229fea8310f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38c8e066acc512df25c0693e2e4e7135

SHA1
07cbdfd8a70198a921c478329fd3ea9d1306be1c

SHA256
1001c2f58f5fa3d1cdf81e01bc8d39ed2fde1176ada939077cd0d53e2beaac2d

SHA512
5bf8e21c039b46ec1f1cead11e69e0aba788f0d8adcb4e87c3a158ba89db01742e838a11de4a920cb495613e255fc3c162be81d6833e1d9e6be4454439c66792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b39aed314a90ddb78e837acdf5077d6f

SHA1
f2ebe373398e4bd26a20353beb9718002e736740

SHA256
c96efe7346dc24e5587f4e7c8da4fec4b95aa271edd0215aa64c1312edd7d1aa

SHA512
508248d3a3b70ce676aefc7702ad03897bf1c8037bc22b00f0aef83e832b38e73d3ad2a88aae8cd42fda7c49bb4e8c90838d70e2577acf1708494f71868a8c49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
becc9067dfe611c095a3a9cd65933a11

SHA1
18f57508f382ee373a2db0c589bc8b579b5152e0

SHA256
89709762e154c366a0039b048ed3bb422c4b1361e040a8e9647305386fc5f17a

SHA512
a9371d6e619d327035f0f3f0a1f2c87da79223f971f49f260238532bf42d659daf9972355a81f1766a13f7d6b4f7b51d326c68fdda4a24125143cfe86ec70a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8c8601579e9ea333e4a0e417e4d4d4c

SHA1
1ea63396b8235b37bd44deb0e822128c55cbfea0

SHA256
a11bba63c412e6fd3e3b686d8ab549b828cdf437a2554cfccc49d250a6034102

SHA512
03697846d83f73a4f899e2fbf54ea589c6730636e0801e744922797ce8b17565fd88e7edaff46c7c65f4dc5c018cde3ca1a8ff6a580f44b0ea9f4bf1dabee8d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
080e8b5bd6aa608cb880abdb2b4cfade

SHA1
344e5b4ff25b695c59e75dc827918ae9fe0eb009

SHA256
adfca18ec5bacebe9e9e66ac0042b4c844493545f60d2272b71462f5f7f9440f

SHA512
66987ebd489ecd050b729ddc3f23a113643eaf15c8b526110ede75f78db3c07fa1ce658406a56ae86c60cd6451b4b6a81bd65783f0308d8e5b5da94f700a7e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
818d1423d266c11daafb2b2ec686959f

SHA1
7f41438781712cc000f50522d2c90d6bb86df531

SHA256
693caa193fa9c4c13d9759b04dd7c19cbf8517dbe9ccd8bba8b037c23fa91213

SHA512
3a049a4580c5fe69d69a156a159b6ca1581c87449fc90b9642d1e9948b4cd9777d8bd83d6d18b67364cf116541e271451cb5118b915d2f9c00b6a5ec9f9e29f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e19aa7e50004354c00b3e756c0b99d3

SHA1
6b4c7bc71069294b16e12018c4d469556b29bd50

SHA256
30dffc516e5c1a2e9dd3b6486ef13bcbf28c0b2e6fb64d1ee26a2fc96118de33

SHA512
e10bee780215633319787c11d065042621b0218fbdb2d8e5192a0a3795078b7c1465644f3b9dc917924f014014a4ff4b27c72ef8980f0e8bd539514beb7f436b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff605750b256777924c7a62a2d3fdc76

SHA1
56b8e1955cd838dc9f3052283ec94979807462aa

SHA256
baacc4723b4083bfec920000ae6791bde2addfa766e51566fc4928439800a2c7

SHA512
05e0c05dec644ab298b733eb425c13b30450b12bc1f9c69c9d3a0b0eb1ba4111af73c2c640d32c7e727120d728bd961ae54483016fe7d28263e91350a895d6fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5e046f58f2ff0d8b7cfcb0d5455439e

SHA1
fcc580ff12ba567fa81add5c4dba080fc0960f74

SHA256
88b7f2cfcbe312d8166011d5a90e58670107d03f97ab14eb0808a81c7f350e44

SHA512
075c41df4c9dd48f4dd332d0bb58827697e308ec3c46497eeb3a0d76bab56351de2bec1c94e5b8316638664ea1d2ae38366937cb354ed1de210c03e0329b0460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\c[1].js

Filesize
46KB

MD5
c88d219b745a0a50d0059022638b027d

SHA1
2dcebc14d9c4d81049d3de5269688846cceb3c44

SHA256
1f8480f8def1083ed6ece9ae35b61015e265363797e21687571f88287124a7c0

SHA512
ccf6a3cc8a2bdd6d8b9fe4e4dc325fbe5fd46f10508630f125b3bd679b19f71c460ae51ff8336e84700743dc832ce6e521d17d4c0c6db58b7da42bea74f0f9e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab120C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12DE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit