5fd9040c31d95c5c25a17c6eed46c74452db13bc4b81c752143377c5418e7e81

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9afd1ab6883bbef7dce67d1d337db76_JaffaCakes118.html
Size

2.7MB
MD5

a9afd1ab6883bbef7dce67d1d337db76
SHA1

41b7cbccbf8bfa4383db3ded4c1c78de32db0ffb
SHA256

5fd9040c31d95c5c25a17c6eed46c74452db13bc4b81c752143377c5418e7e81
SHA512

2a3b11f480db38068392b4bc129b080783fa627783a9363449420d7503c7f3a980455a83a12318aa732c95ddf4cff9da4d1c86f21a4b8cbcd740793a17e93652
SSDEEP

24576:a+aDHsb+aDHsM+aDHsh+aDHs9+aDHsb+aDHs1:X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424530187"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16CAA321-2A4A-11EF-AC4C-424EC277AA72} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ea38bbf620f59df82f90dcfc13bc9dd8b066fba70209973e0f75f631f2803209000000000e80000000020000200000007e4fceb543263b1da0f28fa1107457c0381936a3294d8bb4227a1756d7594a2b900000002d79d4f7f7b899252374960064c9f26fa4e3c1facde1643c9bc445f91f2e97bd11604b6d1674157b5f6d9582bbb4e8a236cb55051c1da78a9c17cf0b41a89021f8feb89421f8003ac22b4b404238b904a425309497500c8496f1cc34d45bf9f27f5b2edc6caa2097d56c4fd724547a11b50c7d03e858c8a212680c6dd4b4a112e2729c964d3ce83e9db3294e7669db4540000000c2520daa3b0cdf0f2aa330f79ec1c9faf0964558b77cbf27d920fda68e6e5bc027f49aad6bba7e1cf747cb16ad5290a44c8af5d94199578a9fbaca0a0289cd73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d7160057beda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000083c2b7002f28a09347a7947be81c061441b15ae3f9ba4873f77401d9cf31e673000000000e800000000200002000000028813fb22caa8146313ed580a564fd2de7e2c071a338192f103a3f99a1a2155620000000a293164cc344410997ddf4d9cf3505d3bd8925ca1808751792a36cd9dc94018140000000bc13c4b6f4a9cff589cde2451c6f3fa1a2e4765a5d66ab3eb88d15e0caaff4c99659fcc685e6ddcfd7465d0ab7ae7723c6700fa8015fb76479d65844dea00f92	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3056	2140	iexplore.exe	28
PID 2140 wrote to memory of 3056	2140	iexplore.exe	28
PID 2140 wrote to memory of 3056	2140	iexplore.exe	28
PID 2140 wrote to memory of 3056	2140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9afd1ab6883bbef7dce67d1d337db76_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c115711bcd579ad0fbe70bfa79fa4131

SHA1
b5839788fc4a22d2dd492a0529cb7c559f934475

SHA256
2cc8410d9346031135390f61c3768976e1619eb6820b0b5c0c17261165c7b3d7

SHA512
ff516b8a93becca2876a7da254f2b813c158fdadcc4cbc6927cb0be32644cc7a37368448daeed4679a20cfaa9d918f4f60a3d059325f6f09af9d0042a1bc348e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4842e9980a47fcd63c5dfd9b7f684346

SHA1
64fbb0accd1607e0588a56b271c193f575abd138

SHA256
b26dbb94b1b7cc238e4242d7b184dcaafcc81b03453f0c3a72609ddac591a106

SHA512
27b8c4f6e9b184b84a5806137ff6f1059cd307082d576128e5c740360d985a87e737d34bb9656359e44a5bd9331737b48174a620b8ce55fa6bc6f634bdde8a51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dea8f68095d89808fe67cbed6ab6576a

SHA1
c1ad5f7111051d3265b9b98f92661f34576d9f97

SHA256
87be62876abd24532abe4a5d77c6074284aeaf9a616b363fe8caf13fa409f9ed

SHA512
2fea22614e7d557515d37ad8df2d333626b1dde48f867eb3af7d4254045b0d44d714a46aff5df645754757a571f0fa810a13f80ee0ddacd456f9458c440b56f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
990031f7b53761be7e8006e691d7a644

SHA1
cbb8fa190da1e1d80cf5061bb9c0de516d66e858

SHA256
5abad6cc00b7f5a2c60a1ec77b922753936d57ddd055563f25f74b05bbf31a21

SHA512
17d4e5b086feee5aff6467b6d66d873a9b0ac9f1b7b7c5fd98e11a42e0a9eae2a6b09d6d04a9640148e27c043ef41614d439b9b9c6b44ae78797886595ea2b02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
007e746eae64e15ff52c1668eb69dbcc

SHA1
b65629f2f335b1192493608a9fc62232cc0d62b8

SHA256
84b94ff10f07fd1ee3365aa13b8c00a1eb8e50d8b6a0da3e5cae2edabdf03401

SHA512
7a62b3aa1265ace83bd1fd27cafb337dc1a31fd9de6d38eecf4c1f2a9445a078121bab81aead1ecf9ed62f6d7ea708168b223b2263f49f249705ba6d0b9c5b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bed60cc3b8c332be6048d91e8bfb6076

SHA1
2856425091208f8c471c67e0f5a5f1e838b682c0

SHA256
9b3c1f5ac05590fe9507dfcc919b84dd47dbcdf7b03f3082df1b7358937317ff

SHA512
ed95629114afdfbf175aabcbba0b1a6e87314003549798914a3a4a9bb523bde8053f637c60fa232e59019cd7c46f50be9a62ea99c6f8fc76dcf8bfb526408734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4847f99b6bcfeb988610dba0aa4dc5b

SHA1
e70b16661d17ba12ecbdd088f292771576666e14

SHA256
a54723c60be8961297ba53e2a38da8bea647a8f18a8b4348bbc8eea69575fa6d

SHA512
049d40bbca96fe0b080176699f7550ae4fcae8f0d8b8edd4cb0bcc1f431f8d9f28031e5caacff13fe747b2ca11c88c5f146fdca6136092b5ed201376acd5b506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
420bf07ebbc8d6946bad46f4d59adb0d

SHA1
e12253fc2414131a8216f2f6e9bf31513179ecc4

SHA256
de7de7903cdca07d38066b9d75dfc747193762c4924bb368e57cd7a139f76a27

SHA512
ced5a002fee2d64fa8a3a5fa9c0cead5167769930dac0b17c9eacbe826c13ca56950223612d3ae52f1e80ccc616b0531a8806cb256ccd1dd93ebc4ba31892de4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e446557b48d98595f27e36d73c19714

SHA1
2bcd20ae10e36112267e90d5db9527dc3a93c973

SHA256
d9734d05f00dbda5f91a54a573dfc26ff4dfe963f6adc77671a9194ca3728f68

SHA512
8b21e70f3cd393511f4625c409304c234a0f43929590f2a92939c51d43448bdcad2573938a7b24b754aad5c147bbc3a82bf6fab89ac572034cf35046a0e25433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
450f38cab7063fbee8e97a58128e0544

SHA1
d2ed5a68f6ae34b9496d6eaf8a884b4d035c9507

SHA256
3ddf366467024abc9df61f2f7443caf5b3bae9f73ef87b18eb47828248f1b69d

SHA512
c958b011b8f85c08edf0da72cfd59574ae7f47342c17c17b59c4ab22158c3eb9bf20d236114465096082c2398366f3fcff796f1962c87ef26669b99113c53ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
225095e4712fbe3ddaf6d43ebe3586cc

SHA1
50612dfb5c65489651769f891b47c227bf588773

SHA256
7453d1d22b95b7ab70c28aa6ccef49954a51d44e47ecb7ac5b26997512e55f6a

SHA512
a8a0b6aa0490523967db30c8ec3e8f30208e6bbfa600895fd768da4c9789a9f65b50bc1d693e8e9aa3cb0374a1591f63b7f8c46830e48820f38bb4e7adcb7733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27cab018fa5a5d79b7beacb6ee435e94

SHA1
b9408bcdae0196a9e658a68b358f71bfd97ae564

SHA256
c14f63cdfaa2522420372449e91195ed16b10d69aab3ac80dcf3e6109f7710d6

SHA512
74022b096254f7ae8fcddd863940e3418e62043ef2d27de3ea59eac273698bff3b3933392d155008251543f7e511463bb4e7b6cd74773524d43e21ae247ce73c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8fcb9b0b3d2faaab9a5f498af99b3c5

SHA1
f6102ee5ca66633c620b1470c693761a8ee8e099

SHA256
b13bf84cfabfaacd7a65e7a8edd31b6ae99a671b3817d544400a9b36110f5be3

SHA512
51bea3b5122294590b3bc9cc1fc21d324148ac743566c9a28312d9f5f67e1bc531c8b5022dd8003aad785c585a5ff5cc076d3f37785fe3dcc06aa8b8843c841a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbcdbd180fd17fdcfa1a1479a060509d

SHA1
fd640f5aba9482fb42bff2e585fcc16bdf5e6c3e

SHA256
5f99d5ef5f68048b2e44101942e87ac74d3a660fa132c9547f44c76ec69aad97

SHA512
508f6c008b6bdb4817f346413e36f9b4bfebf9f1f2cb4666dd200ca94fae48ea9afc4458b3dbf0a661d3ac2808e11636a611761248b75c52dafd0f48ded49fe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
239e2eb089b9f2b2869987abe8b4a106

SHA1
021dfec17bd89b8ed5afd3e2cf3766650a9757a9

SHA256
79963dd54c642835f57bd3d2619c853014f83de75357f7698a549817e77a34fc

SHA512
323ad3daaba4442f100e9426821cab4e9cefbbfb60a649f8f528dd3c1e4185a4710687a0a5e16907255deddbcd87913e1797bb843a94bfaf114f13f9fdf1eb53

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC7B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD49.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit