0ce29e024701bb29e782bcd62d8bc827112ec22a4baa71ccec6e13a2a514cbc0

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c97f9bf1c94bdbf1f128704293e9400_JaffaCakes118.html
Size

139KB
MD5

9c97f9bf1c94bdbf1f128704293e9400
SHA1

814c8ab93bfbbcf9b528e647999044e4ed662df3
SHA256

0ce29e024701bb29e782bcd62d8bc827112ec22a4baa71ccec6e13a2a514cbc0
SHA512

d54d7f57affe49f560fd3d178183abe85db5b97d7ad995bf32adcc3c5accc7e996d18fc6f7fbc6f321cb5cbbe2188d087f95750c26ae251e770457639c4af83d
SSDEEP

1536:SIBaOvEl0HyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SIzZyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCB9EEC1-2792-11EF-9371-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002af2aafa689e4c499c6c89bebb83894c0000000002000000000010660000000100002000000025f1e799ffdef112e5432dfb417f4ee4b286d6acee87a24a0c007e719260c6b1000000000e80000000020000200000002548b5196b53b849512a8b34ec2b1593c6622ff8dd913263e7620ed2a9c13c269000000090d2a16fee35da4602074085ab879d24cc293e7b8f9c0c675c7ab2ef1fa0951f656aec52f481e74f1b808d81920ed9ecf18bf76b42128660262046cd73b58fe3b1f8cf10b969d9dc3254cc9e0c87ddb8d1e32a445d8bc21aa37f7df10f3e03801b4a67fe3b38c504a93dc606fe718498366a5675eaa17fac3c3497d214080bff88c6c3373c48d5c8258f5a42bb88b451400000000d4e070937bedf58c0c6c0a486cf42b9cd86c5fee93246ad874276f1b73756653b88e66fdd3d104d38e31b384b878dfb31683a17eafef72babd6421f07593389	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c5a3f09fbbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424231613"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002af2aafa689e4c499c6c89bebb83894c0000000002000000000010660000000100002000000050cfcd9dcbc4578ebc6f23c7a8e7058b12db7ce23b54f2ee8f9aad3be9eed8dc000000000e80000000020000200000009aa1730994c8590e4ad701a6e1a16a3837b5302f6aeaf9f93df9790e754744df200000006ab1f54a973a72db837ddc2f56097d37dbad4a93c58fa590815b773832c4c49140000000eff655d42d0d5962a5dd3f4e57c448b8fc5742c1654bfbc8af4dcc7145d16927ebbd6558eba76cdaf9d0ec4970d7ef69bb6d49d1a263e2702e26340efd769396	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3008	2088	iexplore.exe	28
PID 2088 wrote to memory of 3008	2088	iexplore.exe	28
PID 2088 wrote to memory of 3008	2088	iexplore.exe	28
PID 2088 wrote to memory of 3008	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c97f9bf1c94bdbf1f128704293e9400_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bc6419a433a5aaa56b457c8fe8578fa

SHA1
c3da5655f93e7a5d0edbeae651fc69cf0a9e9f5b

SHA256
45d7a82fc27076b38b98ab6b42addd35a1f7ea11e512c42ec6f31bed9e1c4099

SHA512
5e5f5f8f00b0b368255fe41dc3c5aa805c875d79fa919526b048dc2b34415c237df86265ef1f37f812ee9996fee5f5cd0fb9db8e276c1f944afcdecb1ad267ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfe07d69f2c4acf8851af0fde344d4fd

SHA1
9e0e779e33266850b08e3127fd24864981a34e50

SHA256
f0cb24a8cf51ceb143dd38737690b5f9efd92fdfe8aab2b8640fb33b307b4924

SHA512
c36b63010bb5d18d66044a51a31126d68f7a6257c6c906adf957c92e01e34d8d02d1b5b316dc4ed156c24d33ecc88626d098d7fc30d382320900df0f025d0b7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f184567bee882e0cb7209efc29a1443f

SHA1
523aecd1bd8441df675a8fb37ddfb38224560955

SHA256
d376ac870b2ff5016868dabe6e8f7c8bbc72ad75113c91d923d09e65cceb9bb7

SHA512
3ed3ba31c46d5204f81e8553fb26c570dc6e80e235f4c3a5d0a1fc6ad16e9e675bde6c9e2c36ed27665711ab5224cc56256c168ee232396ccb7538322139b2ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a22cc60e4208112d59b4445cf6fd7a6e

SHA1
de96291ab154575704e79327bb85a57de9fc8d38

SHA256
8f41bb4ba90c42521928b12749528686cd984d8cf717fa2fc00f255c6b223d6a

SHA512
56a568f369eb0fd708d95427cd69177df2a3e4de0498c6b2a862ebb860f4d1f0d231b8677039bd4b961f39c9f07c0c345499f447bf14d1c5d2978b7c732df20b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10954c552870eb4026d29778368fe8de

SHA1
741f4614563e89bdb26f795d7bff96963b0f82e1

SHA256
e4de7a07634115da08127a35a62ba8b5841ac065a60e2fb57a5e39307ecd9f42

SHA512
2e82f10b8762f7647a91c4144208a6804c91ad8e01caf8302d81762aa829e9031debfdc119532d865fba2bc694cac76d1c672281b012f422deae28bb3d88bef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8459288588c13a93affd410a914fc47f

SHA1
bedefe5be8ab515120d2020f0540ee818d831e7d

SHA256
c89f00dfdfc20895165a80913a3624561b03cb9952bb167aa5df5dc9b0be63e0

SHA512
81d86c84e22e94066f81df21f3c6696a26d798c736dcadd35b5927eca24431b38046122a1e8eba1beddf20d7ac7db6ef6ad4169bbe7fed24f449ad6d3e5d41fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee53f554b60cb51a70c3bff565313452

SHA1
286c07ae26c7044c09959a8b8a346fbd775d88ad

SHA256
6c29ee8b39d2aee31dd0312afbebe5cbc9fbd62dafd1b3fddf3711590012ea76

SHA512
dca0ad617b713fd81850aa497df446b9eb0277e81ad6186e850aaf0dc93976eac56dca301d45a71ba225d5e3af69b5bf7c20a07f27df2a8995b82e7c9a2852e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2529a5c272b841487424a0518e24e4e

SHA1
a756c3264d7a8aa1d262fc1e869c169a4221fb38

SHA256
e5964f77636dd7c489cdb59e3baa770fe42a4194ff72995e683c86651200fdcf

SHA512
d2473b873730c7ba9c57400d4985f23b7bf13f3d08a82f5af6029a7f5dc24c81ed61546ca176b5ffceffed5797077014c5d6b42f448b2fbdc6e7e00a14408a70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b08354866bcd259746891879658144c3

SHA1
1345f75ce0e445ad35c8543955641a57adf758f3

SHA256
64badbff2637d9d69d15c899866e4b4bd637ae6d731e761ed360bb0e532cc56c

SHA512
4c94d51108cb49ad2c818cfab238b8714bf3b0bb367f0d91f40df27216230e86804b8220e5b8ce94eee4dbb5a62627add9160c6abbae5c9849061767b0e0e888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
451571738bc75a425bd624ed045aa439

SHA1
d929db09c9335fc7d166e5b14f05a2903df54c10

SHA256
922e0366c417f969e841fbd3ba324b1275d40046016ab22b89a2534f2103f955

SHA512
4f235b37270a4624941368070c9588d92347a6d6585a9383145c484f9866c176774dac7a31a804852e2732ffacf45e22f9c0e3935927f980132fe9ac4278d60e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F07.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2555.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit