1e2f560ededcfc9f1c886e253429dd1cefdbe757564cbc51cf650d5a254ee563

Analysis

max time kernel
137s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9505c39612c395bc3bf70beb8ec1d0d8_JaffaCakes118.html
Size

460KB
MD5

9505c39612c395bc3bf70beb8ec1d0d8
SHA1

e652dcb57350df544569bf16c92fbc05324f3acb
SHA256

1e2f560ededcfc9f1c886e253429dd1cefdbe757564cbc51cf650d5a254ee563
SHA512

31f6e5ce3c8b972c473268cac9754eddd190cfcd71a44a9bb3e8d07702d7f3721fa04b1110076920fdd7c20c31c747c605aa040878d69cc61d1a1f514b71862a
SSDEEP

6144:SisMYod+X3oI+YfQLsMYod+X3oI+YUsMYod+X3oI+YLsMYod+X3oI+YQ:l5d+X3e5d+X3Q5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423669799"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406250b083b6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000001a727eb99280341d2d1b729050a78100144241ae8a9eae39f15e2d6900f23e56000000000e8000000002000020000000d13cd9c6c4f3bab3dbb21817333492bc76a16af0c1b78cc982b27e6d6206e76e90000000516c5badd26d04e05d95400bb45789fdf2d29be187419601c5ec8b856f8a6814a8fea13828c6f18601df3422156269b10a83234653f8215ea01fd7b24b8cd4c705d9f61003a9f7ac85aaaa3b6be6eff687a10ac7e0bdee60fcd1d9a37b17d661cca88eb2c7dee2b31c265e2548cedb56fb94fa4d9fa902e892ef22b710f84344db73414921594b3615a49633d5557f64400000005e756f0af9ddf18c303d149a7ace0836a301192fe6ac300fae4c16c74c2f1e9cc42fa65730f29b115689f986458c402eff9681b6f18ed108a995c5e4f4d0d5ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D728D731-2276-11EF-965F-FA9381F5F0AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000818c074bad2e5626d44853eab63ab6c01675224f5fc04676596863d1f25e250d000000000e8000000002000020000000311146bcca32a41da73d44e1d923df7294de417305db568ad80ee14bf12d31dc2000000079d3a20077193a7a7eb16edab0f09275622627eb86b4c080cb0d4d864dcf600240000000a04d3716101e807f9c1116e92f68b5b4f16ad8b8eaf6528d3675ba5f29755e3b414644336bd6df33230485031095a5b12e0092c6c8d2ac987638a4c11e823c96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1264	iexplore.exe
1264	iexplore.exe
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1760	1264	iexplore.exe	28
PID 1264 wrote to memory of 1760	1264	iexplore.exe	28
PID 1264 wrote to memory of 1760	1264	iexplore.exe	28
PID 1264 wrote to memory of 1760	1264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9505c39612c395bc3bf70beb8ec1d0d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33ae17cd29fb83a58d0b9588a1b8861a

SHA1
b81beec6bc99f0dec5b071a8a5460da4f23edc35

SHA256
bbb3d0743d15215441e156882248256eaf1a8aedbd838fc23a76228712dd6a93

SHA512
751b7d2712d08ab8ed1a2c79c94b855e7ecc582b30810a4c28bf3fde3b366ff4c41f70479164aa4b1d1013ebfc795926d09a8edd5fca18959539f1ad34411868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
074a055cfa78bc9c313dba3f909738f4

SHA1
348943815fa2f6265c2e1f220b5097a956c220bf

SHA256
8fd6aac23ca665500392ca1bfbd2c417e66ce15a3b0fc6844dc9b7a2d5119656

SHA512
fbe03015da9a574982f98388fe2701f51dbf66128f28eb070b72eff803028881543d647bfe538ed38cb5df697198ddd8dad4df0bf51b79af029d118a68ff7ca9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d8ceb481aac5b878d4beafb38fb5453

SHA1
0b5a12258012f05a9c65a603076ff97f5072ab20

SHA256
dd3a988f26f2d4dd17d6e62751931eeb30e6d654df3daa69c1efb8101c9a9403

SHA512
bdfa0284a5cc92e8334fbee099fc38cf7b3284ec223109f8dde1eb119f0361b1752d23085e249bea6f99a8cb9b73391910bfbb5c3baaaf6f26e342b8c784488d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
948967dd3aea73cf0dd37042acdd44e4

SHA1
293ab976f21318402d64430f4b48717f452f6484

SHA256
276916667b98175be99d917ef80e32df540d541e41c94141d83e3480c9857d46

SHA512
5132f80ccf699d17e28fab817eac710f1bce51e8288e2df24c70f57efefd48611904ce35159ef3615897d3b3e093bddfe4a95c9a66b8b049dfcee1ab99712740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ab9b4c8992b3f7267b4d1dfc20eb2ac

SHA1
46d62be1f4eb99747bb0a95b254403f9324a1605

SHA256
a0212c4b84c112761df4f80524195e61b5b8bdaf21d600def25b573c293222b0

SHA512
f7ecc6f88173f64caea5d6f315516bcf1b65b028ca8a8ec3f619511b29e06757e471d1d7b9f13f5e597b55d1965aa4934cd973d3793d22d27c2f2bda07ce3f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f97ad07a39d60670a49547b843135c12

SHA1
816df9ec665360293304f2c25157016984527da9

SHA256
6de2278eb362c644b0f83911514658c4dfa3a4795ad385d482dcafbaf748eb9e

SHA512
3b36442023f35a3cb3e164214390bfe62b03562d91ead4c5e982ed8573a87e5dfeaa6ddb6e41762ef25923bad9cd4caef51acb5520ca2e8c0f4b6c3cb473223e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
860689d1ba9b2565ee70728ef1453475

SHA1
a2dd5523d96765fc3d7e0968125f037882e2ce8f

SHA256
b7f4dd313d18818821db7f75c27e48b33e26ec01e708c976626c1598120d03d9

SHA512
dff201c7621f3bb868a7b31fd352dccc1d6fb3718c51ebab20c3c00e374dee56d73d30616b23a7fd75d2123670afd2390dab75fcd50ad0e22dcc2bc9cb15f9c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0d1dd7e6f5fd179be7d649bd2202b66

SHA1
83a7509d84e5bffc0bc6c2d77896d4ef93b19959

SHA256
d667729b93515a461e6e06861392e006bbd4da0281b4ef766566780c25f19865

SHA512
92204fe988b14fb70d988667f1b356dd23ebb203998f129d9cff2fda982f31044e0ad5979196c97eb01233a75cbd6073149d56986310bd87f15f817b7eaa04ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afbd9db88f026b05d5cf49bc1c2039db

SHA1
b54e9562886829179086137979c69a77b0db016b

SHA256
4e8d1117f43426c280ceb15408fd89f1a23ff8c8d3a984a672763b08cad7dc72

SHA512
894a85e3b91f00d2390d029debb633ac91e89a52dfca55c7c882199d66473ab9faa733059839af42814d702158fe6f8fedec79d15326228902099fac44347852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7ce237a9dc2b82e203b9f097ac5e5ab

SHA1
58afed614b46eef13c285807908d702e07bbb42f

SHA256
6a55c278991a6d2c8fc445260e1299d94147e38f68085de4202bc8e2a950c1d9

SHA512
4bf59a8d361506affff2becf846c594562412dbc06ee565598af07e2b28f12aa92ef455880481f823036078c2e5884aba9652135e9ea4e48a471814223be4491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47ca7be08eb0123287dad4c2ddd38070

SHA1
06b5dd86a7b2af65628b4139a875b3da0e58109b

SHA256
d349c58426f7814dee4cfe0cda4bfc1a02c8ff4aa2e8609505ee2d16db68dd1d

SHA512
df21d50e7be95f8bc992b090f1d40b6cc68a3d26cacbdec3be6f1d126b809269ba23787323098878d40466ca904a2da23137ccaa552af685d91190aab0db4a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9405289d402a6600054203e42ff8fcf

SHA1
1c34079103d2dac9dfe2be7d2e80bec372d37c12

SHA256
cac6f15acf669d248ae446ff43029a7ec83344c0f6bfdd11203486f16221c038

SHA512
99c61d66eeb9f428bb213550ecf49b689f4ce684338b38000d3f0e2c60e633fc0ab04fcb8db60b4366ac7abd25bd113feb66cc7fe4930cbd1c8849953141c4fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e86fbc68ed166112b91ac89e50f65a0f

SHA1
c5c62ffc3b3438d532ed7b4a8c46afe7945f0a02

SHA256
21ed86067aed19d97ed2f1fd0b014dcdd9df6c42e1504ea001330f8ca5d24894

SHA512
fe32387f537e50041d00fb751ebc37791c2b2287437ef063b3dc3036816ae3e267b90d88d1bb62a9cdbb50c4749ea3244098dc8edd43577ff0c25631e76e1eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc989d1bccf70c95ef6202e01b7fee5d

SHA1
a5197ab5d991566c0c8c5f54e9ce520a329b867a

SHA256
eccced9aa5b5abfa8d2110e41ec7d505ede9f02eebe1c0885eb8dd38a22e3a8c

SHA512
fa2c324b76a819ebb437563268defc37ba469e7bd05df5e4bdf1308f7520dfb7944703234d148fb5cd8c275c207e69f9a9c8771857bdb909e03f7065b05bb5c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73f86e3b2d5af07914328e01d8a03d04

SHA1
e67510c990c1a79ad3e35a9315c21127dc549ad2

SHA256
1c5111d81c59eb965880d032a0a6dc0e093283d49a0a8dfbb3e6a29e3960a358

SHA512
32b46f4518a06ae6c82eaebd673791f24120f0a95f16c28011c9eefd2edb2517afa0166bdecf49e202e3e56e827f4dd1efff3505f06a9bc2f94613082e9a5bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab602C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab60F9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar611E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit