a82894ab4b2f8df21591e9689bf9531a10202c75455b8fe217a1b3d06bb793c0

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f97b7472eee33b5a41b84bd81fb28e8_JaffaCakes118.html
Size

120KB
MD5

9f97b7472eee33b5a41b84bd81fb28e8
SHA1

11af3c110d31e74039791315059d4b0993c9093a
SHA256

a82894ab4b2f8df21591e9689bf9531a10202c75455b8fe217a1b3d06bb793c0
SHA512

3192e94e37a9a1f7e131b6344e3b1bfe6a7a7a302a306218165104ea391aa13b73b028c9859ff34059bd2f4e05d30a34847e46f44b918faf12794ed0d2d35a46
SSDEEP

3072:SP1mwXffQY4j47yfkMY+BES09JXAnyrZalI+YQ:SPgsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000093275342f9cd1f4ca85ffaa806c05b0100000000020000000000106600000001000020000000be27fbd3cfd515ac6ac86f7c603c44118fa71608e48a616ff9b8530117c28121000000000e800000000200002000000069a87fa52258366343ab9926884fd5c6facf2984b5bff2487fb3f9a72776b23620000000ee5c9f77ddc22c300145b41c9328f8523565929ef279da666b275c25bb801b1c40000000bd0a36e930bee68730558812397069ba1539cc52baa7cb8ebe721175487bdc3e1441e6f3a22fe353ecc35e38657b1bdf851a50d27266bd482472b9e1afd27a33	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF0B6C71-2839-11EF-8A73-D2C28B9FE739} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424303295"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40bd90e246bcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000093275342f9cd1f4ca85ffaa806c05b01000000000200000000001066000000010000200000003d7ff940900a5c8a2b504ff08d25c4db67892e41c1f9aee60154d97358b2eef4000000000e80000000020000200000000c79adb21dc817fa7ba2c825ac2fdd30cf720da55fed98d27dfa2c8d5d059e6190000000923292e53a55179da5df5ee88611de2c18b812d5eff0cc1b4a37e118c395d7bc44ab6c0b05a52ba724e50cc87f93fd5d7fe604d3b20ab1c98b0f3172934a9c9df27e90b87451fb9da80430e00491728fd7aefbac377cdaf7372912dd8983c0d9cf1a82fc6bf631bf1c8a0d047fe8e2efbc5ba066a9803583824f900b98a01b42693e402c9ddf7c454bd9435da5fd6d3740000000d66225f77c4762598102831f6dc3e74a056dd239f9975ad67e1f3f35ed7b7f28ef76a84b475aeeb944d46455644ebc583ba0ad49def5c9934fae06acae18404f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2032	2848	iexplore.exe	28
PID 2848 wrote to memory of 2032	2848	iexplore.exe	28
PID 2848 wrote to memory of 2032	2848	iexplore.exe	28
PID 2848 wrote to memory of 2032	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f97b7472eee33b5a41b84bd81fb28e8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
cd9037c37db34a5ea0975a895820c795

SHA1
988c9a0be72e378ee9c03975ac895ee69a6c4b4c

SHA256
ee052c54d5fc5380210add1ac1fe634ffa30547a0e0397ed69ddad0a9c1d8d4e

SHA512
816a2b9377fa9948c2b3ccdead7ab594c126935425fcf2c4dc9e8ff69b60af7521167d77b6e76891999951251ed84760902145e6e1e061c812ad107b9c2c95c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
172f6a83f6a6cd856bb3f63855574f2e

SHA1
ec6dbca9e9316fa372b7061b315470398639a1f8

SHA256
e405ed4690e6f7a368aa8ae0dabd20c5826a69150c0d06df749e3b24dbbf744f

SHA512
234374698d635fa8c53f2b6720c7668baf0171bf999d903baf13c1c843d538c50e8eb4ded0af25ecf042e25c92c71665489a7cba565d6fd5e3a54d4c3a0f3941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0da49c3ef61af9d765fef1dd88c84a9

SHA1
ba8d72deac99e8d17236104f8374af8ffdc3703b

SHA256
5dff67cc0c2a2153375e4d808d0da0a9af942e6e68de8d2a22a02c1687e65076

SHA512
6b8669c3c0f45e82b2f5ae539ccc02885b3ad57081ec4d6a0cafdee1c5ccef186e65c2e1b419ab5c2f67573c3551ef85786fbb68ade1770962207114db76f9a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6df6fb811afc5720208bc7b3e5f05fa5

SHA1
4ffb97e69ef61f3049301fc4c9055231d6558771

SHA256
09a7026871a2b4d98711f8682da6e74d1ae3eec46725fcc36f2520f62501070a

SHA512
89967a6885e06c35f322b38e0c67a5f92e71fc4844b40ce97a58562682094ab67564db8a26c14317385353bbd2118704a446b282ed9dbfb2835f20ea033bc22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5f528754362daa1846e185c81f302e7

SHA1
854b94ab766a4f048187154197c5f437fc263311

SHA256
5c7c47c436730fc6f7085a329b7fd77844d52abf151cd9edf437d6492109dd0f

SHA512
698a63b3465b4f1963b593c41e5d9f5dfbe58fd6c706ed2e7dc8998c88256a452ec9aba75c708698f1351e9b73bf0ce58e79cac877c109d9b389f428857b97b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa8400de08a1a0cf55b030a154091976

SHA1
254f2aeeac7402b3c8953fb3d72c85647539c2df

SHA256
988c3eb0c7cdf5d95693e9e139032378b8bc6687e59690daddec99c00a56eb3a

SHA512
c7374d2e8aefe39fb1bd50334313d3ac0cd7b2c6622747682e0c35fb0297dfd4107fe9654583c16298fe98f9f98e2f7499b1f0f3d33cd1963a66b7e1f57b957a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
438888cd19c19c52068863b398bfdda5

SHA1
b6352c002fb9ea018508a790c13731362b0b5d58

SHA256
1a3cf06bc3422d6604c44fd55383987c58aecce7347ee947b5d58e1a8918d199

SHA512
2004ab9a42b2f4da5e4f76a748857fded22f4d73fd606649b65de974006933df05a1137eb11c358879a25b3b66b0bbc0161f503cd82c51ec4a16cbfe8a94a1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08f56a32773e074a1b4ef5261951d049

SHA1
1e143f03abaed4ef5d20fcef538f247a31b75b0b

SHA256
d177ab9537457ea29e762c618eab610d51f61eca4144da06e05c943874f51bd6

SHA512
b1d6dd07de5cf15776c6f9dfb7c8423c759b4cf399adf7ef9b22ba0405f70372d36587931d2890db5b6b72bee98a2f056c4258d9665367e6f9162632600741bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d16f6747ee980f7da3f9097e55255d9

SHA1
65690e498ee5652fb6913867ec7432981d0d7cc1

SHA256
f10f32eff874373f932947793edb7eba82ce0e6abd6b8cf4baf70403bd060c6f

SHA512
ba52c1b09f0322236575d0924364e11a74e59404ee264e21506cb7b5b7a52deac365b17f2df839000080afb744f1af4c9bb2b4f547c10b21c5491a4f4f58e847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
227cb298cf666f82acab06d11b60560e

SHA1
f5c6fec10800207595469ec8f6850fa27d57f972

SHA256
95b96df7612b0c4a8c9ce3b60c516d1580c4e78ad6ad6b11a9f9c2775a4acbba

SHA512
392d08d7ca92c873361d0b5f717ba3c86f8016739767c4e74e96863e7e2886d9e4169e627e8af3e7edf1ee848869eb7471a6dce3c0b764290fd4a24d2821a4a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e0b0bd2e3188ba58968563442487793

SHA1
ff47483a685442f7a5a3c19eca9bccdd8b73d5f6

SHA256
71451d647f35f88e2b4c1bab90d467767d00ede969940cd62efcb8f53d1b405f

SHA512
b1110914093c5d53d92bf00f747035a794b335ff9e8823b12cfc8a2f15dd166222b5be199afd78e5d1c7556fef19ed3d5d0c1932e95490ab6423bb40f9f62f4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68d4a0385648078bbfd364a49c8b013b

SHA1
9b9ec74b1371361f49eddb9b6c60a59980defc36

SHA256
e223e37da824a0de88d3aec6567562f97aa76a894975c5185c22b8ab61627260

SHA512
0e6bbc400dddf548514d1248ebcc9698a29ff39600127537d0be21741054965b4e7c0c64afc12ce820be67cb70046a18eb1838f8fe3c42cd12da84afaace1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ef89222e65066c9e45954aaf78bca159

SHA1
e0c1f0a0c7f742926ae4a61de7211d017926ce2c

SHA256
f4bb2b880c76d96337817f7db3b1e161b63c09566d8b4d044ee6c51e2b6a70cf

SHA512
461c5acc2aa9f5a7b37fe610d2273d3924436db9d4132316bea8ffe86b600f790b7656b790122940417b8bc6c6a4b94176e772e8b37bb681dc2878e2621bb253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar127D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit