12079ac817b2649f826b0e3a4862892cbd8cd18b27046db2e3ede2d4627d6623

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cd074557738c2307c332d5e4821cbcc_JaffaCakes118.html
Size

51KB
MD5

9cd074557738c2307c332d5e4821cbcc
SHA1

371f9094b1a30dc318a61116761b3525b9e50f0f
SHA256

12079ac817b2649f826b0e3a4862892cbd8cd18b27046db2e3ede2d4627d6623
SHA512

375f57689b23d57f1747e97f6fbcfa64024bde3ba7ae72dc11401d6f6c422895885e7b3e725a7c4b1b1fb66e7bdf03285ef8e1b4a830fd7abe8faf5b923d96e0
SSDEEP

768:SLYR49z3ZNh7YsxuaFvG/Es7nmu4eyTP9BzTJwLY6uwjg:SLl9bfisxu8kmu4eSPfiM6uwjg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b094a0a3acbbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a35aa3be3bc1b4a8a4540e859f0306c00000000020000000000106600000001000020000000af5bebbf5d46f1e529466a229f6bdbf438419c31b736668703146d753e67c62c000000000e80000000020000200000002c0ee427919f352c5d376184f864d54cdcc912e48b008e707fd3eb27cea554e790000000649361d6f30ee6adfa456825b0dd2a6056566bb08e4ca949fb32b2c515851d7c0ab7703e7e9d46f72811da7add37b3f1b19d20441698f549a02208e9f1c308a307e65f720a7e6adf5478b836e1a887454a177072831b5b98492dbdf24a09af05734cf34dc17780756ececb731f775c65b7cf2df726e297255500927e96840cb18bd814841de1601509d77cc7d8e636f7400000001c1b8b6d692abd28915d2255b819d31cb80ebcf7a4869d419776f0c64c282d63a7b9f0aa785c610e30c15cd7bcb1de0636bfac4b3cf3b8c658b42e6a1305c7dc	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a35aa3be3bc1b4a8a4540e859f0306c00000000020000000000106600000001000020000000fc2d97bb9de787eae2249d9581a37691f27d905fdf9f58d4857047830c006457000000000e800000000200002000000073dc9205e5de6073594ea53034fb09d0024587e929ad3b9f9e9b5b02c14465a520000000e2d661a06dfbe3d2642d407482dce2b9ddcb22d93466e6090165657d4fea42f3400000004564211abef5168fb97315021261c93f8c6f034dcc4e2e675807d37d6cf8b3f3dab8e869a08a34a05bbc47da102e2ea5b6f198b583b217334ddf7906fd258b96	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0A9C341-279F-11EF-B73D-E693E3B3207D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424237186"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1120	iexplore.exe
1120	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2976	1120	iexplore.exe	28
PID 1120 wrote to memory of 2976	1120	iexplore.exe	28
PID 1120 wrote to memory of 2976	1120	iexplore.exe	28
PID 1120 wrote to memory of 2976	1120	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9cd074557738c2307c332d5e4821cbcc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1120 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e47208e30cb4c8e4fd8d5550f7814ca0

SHA1
a34d0ceb7e58ff0a4eb17589bd2794a396f1a684

SHA256
853cccd1f11a426bd4c52b91c88fa2228b059695b0b153672b923296463796a7

SHA512
90ddda350e3083f1df582082f810684ea052ce3c9bddca92037c0adb9f9e001a1c5518feab0199aa9bbf51b527e358a30c02061f9788279da4b293c0fb9a3fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
43cb945bc9dc1e6aeab72a8cad2f5303

SHA1
265084839620a8254480e19c23742f0aeba27b7a

SHA256
979220641a6fccbb4981b4c0c805fd017cb21e6503b73886c1ae11d36306e974

SHA512
7bb8ee2d5f56139a93c1fd9be748dab7b7179dd9cc87831f91ea06ea133ff38a1f4f7806eb50119d1425833c646e2999e2981290bea2b1dfd10e78ddf8dd4c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e6eb915ee6c41e1d2e840a9660815a66

SHA1
bedcd9ee874da6f84b18fd926b214f39a472c721

SHA256
4b72c1d4fef791fba8e82330bbb702e0b9f3312e88eae909d7df9bf3e547375a

SHA512
a7f346308c80b2ea95df0559ac9e0752cc1f1146e29422179a0bb8a6bd31b1eb71a190b437e77d17cdcbc9cf1a2fee06de7dca4af6a11cc085358d9343f41c64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
865ba55b9f7c09f6d24b6583ef3c2460

SHA1
cecef7c02e4a8764d2a4e01d84f4484bb5b77bc8

SHA256
00112ff66ad92f174a9f50e6f46b8bad5b5067d24cdddd0027e9c6bbfca1ac3d

SHA512
7ac106485fefdd02b4797c57ec1b20a71fac49d3ba68e8356a9b6c8385508439c40041f7ae478536d93a8c094dcecaf80b078dd922c1de222458b62205bd3f75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e2e71fe3a7e2ed22869b1e3945ee7937

SHA1
cc7181ed5bed0a805ab4ac0d425d8e4a15eb6e88

SHA256
16db180abd3d88f3340afd626f613f3ee46ba737fd79f6cbba4afc411576566c

SHA512
a90f9faf15e57276322eff1b96eed240126d1094dffcf8f7b2079991e01291398ccdce5979c0f99bba4e0ef8313bd5cd7f60d4c12e24a2ac1eb7a0411a1c5966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d96ab803a984fb6d0af6a660b0cc5ff0

SHA1
264d4c28111128a6318aca8481600d5db050eade

SHA256
acee9c20284f1817b7651f41d027ea254a122a4d1db3d77307cd435499f086f5

SHA512
4955ca2b15befd8b8897ef4fc3af33ebb3df517a3cb0bb175b12066a369c5d6872a8d50421f7e1de6eddbf2c0d2a21f4bec16dfc313115fb30931f0d105bc326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7964f2471d90f880ff07b38acc6a6fd5

SHA1
ea2cfc54da79401cd525a25b6e1614afbd07d3ce

SHA256
d3dcf602ae64dc9fce6e10009bbe8e341a35c16f226e162f5eca5f764e7601a4

SHA512
3e2425652e05df80ab2842c627c69f8619cf65f3f9bc89418bdcd03bf47a7b66e3aee7d0f5c47789481b3cc6845dcc220b33b1da0455e70f6e33697811195a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
39735a3d07c70f07c8771895e421cd5f

SHA1
3539e3c51d8c5afe8c72c3df75e0ab05a9e8fe93

SHA256
0bc7663166c75c29c3f0f78f9ccf13d9e3f5ad71ecaa454289e0d882c89ca769

SHA512
c858ebf6a8634ab0ed8f7ca9473b79a738be7e2843345db6b4c0e78d59a487757aa0b493d74ab83f548d5e5ac3db55278621490a23e3a86aa7139e9f5258eb39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
216fd539d0d25483b67e3c3104a264e1

SHA1
109f988fee6775660581d950184f7ed22fa3e202

SHA256
d4058c204aade37fc63caba4d6f776f64ae870f5065586ed9a32378d2bf43636

SHA512
a7fff632f0962446acfb2d085a4abf33b1cdce40202e9a7175110c9bf456f5974155333444edbd49c2d658150644bec8b177c358cbfe57a43b452fda295c6801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c1fe90432fb03f4c7480487960a1b338

SHA1
ab12e671cddc3f414885a732423317d77ec211ca

SHA256
56435c4e4b094f1489909f5580662c4566ff132e1577740b9c66beecc6c03243

SHA512
50b1a490f2cf0273eba884bbc0dff1b61cd1d19eb51ce16f11fde211bb2f8dedd310fe1c8536c6d61cd5523b66502baa0b524b1d48c784643e9a773ae60bccdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
40bfe479a58345a52aac9aa49f7439b1

SHA1
ff96423651dc24e717a2aa16db8b19c3432ba0f7

SHA256
442c8f4a831186052f806182f4cfb1d8237b2740f7aedd663c5f474e2bf415c1

SHA512
a0f664b93a15ff991a5b78f04905c2fb3a8a46050d93769385888d563546556e794d41fb641d4417466b9381094f017ef3aa936fb69ffc10fc3b31733c715ae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
19e79ed4c71b3c3b47a5ae914cc0ae69

SHA1
7db68276d04db4174de75ce49d85902875a2613b

SHA256
f4aeb086adb28d889d6fc9e61ff83adc4ec00ce68033644c33192b4a899049bc

SHA512
1879eb195adde6e05da74bea44290bf33dfa3dca9cc3d641594b2d9f4831270e5086fee5d2a1829cb4ef01c27bc24a69bf03bb01d3cdcb4fbddf31573e2dc467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3e32174237bff73d4235c0776dedc324

SHA1
fff5a7190b3e8463cb786003de2f1a84ea8484be

SHA256
c18d518164e6764761de904fcae08764d066886f6dc084ab2f2710e004d08454

SHA512
1f8815d6f89aa8002a77328b3278625b227b6ee01106624ce58c3aa911652a279b27ac72c3dc85ae80a3c5500ffba698324ca035e6b3de7e6fd4ecb45fcebacc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eb8694dd4aa9e101c1926840c87f9b27

SHA1
633e4b374a67aab679da3a752acb3530e2db5873

SHA256
a7eb6a4dc8d7585da6493f0a533e6009c50b25d441d4e1fcbd89021de4187812

SHA512
cc1b4e8b17aa926200cd501b320f6fcca6f8f8d88961327965f8b1b28cbc36dc21e2f7126b47106bf49ab02c471f326b748cb32625066c61ff8aaf31b68137e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b54ae805c0dca1a7fdfa80037ab67807

SHA1
a031f3550fc917b9daa411a552b509bdcac7ab71

SHA256
43652603160cbd2d85b9cb18c21f96f550d4adcbe04ec9e98c7d87d4f4a15820

SHA512
b1e1e7cc6e24b1e9c50f92ea58e9bdf3973fd61756e62ae7637c3cc5204d4ac9e07ef81945c5586c55123b588120fdd57ad42537ea171a41b4ce6396ab9d8e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23D8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2518.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit