4ea0a5678794ea6fcd22053409946d75c02a39b4d876cc36d4af94aa5090ba61

Analysis

max time kernel
137s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1c16c019a440f238ba32b91ddd42ba9c_JaffaCakes118.html
Size

25KB
MD5

1c16c019a440f238ba32b91ddd42ba9c
SHA1

f67353fad87d0d9bc956ae1c3b25685f2d49997d
SHA256

4ea0a5678794ea6fcd22053409946d75c02a39b4d876cc36d4af94aa5090ba61
SHA512

da330c4522eda8d6013b713c062aed6e776c5eadd0761203043cdb3a5f3f6c33927d20864262059b9d8a3bfa37fb8bc49c39ed2c8da8e8af2908a76008bd3f24
SSDEEP

384:FzQVRBxNRuHYPSEUe+SVAMcQe7rEUe+SVAMcQe7+:IyYuezireziS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007810c3a7e051bb0894974a8624ed196f3d8e423ad2ea193e0316d1400a214dc6000000000e80000000020000200000004be52d6845dc211a49c21f7edaad79ab214e6881d36dc9a86a9a697f6f183af3900000004173ec89909b4ab6317dbdd0a79f20a102be0013911856051dfa2a6df54a732315240cda4a7d7a9dc7ab934dfee0d90182b94f6a4f12c0fae453935a3b8d86ffa2b5346f16013dd159c27c6ec542d8800d2f8185dba0b9237662ab73e8a4faf9049eaf28f5ed5971d1ae8e91015b23f58305b4ea8bc34f67b16fc5eebcfaae0d7bb469e059bd44792272b6441e1526eb4000000039f0dd261070c2d1cefc9a8c430564f61db3810bf26a0be11a436ee17da63db3a28260ff7f91ccec5f9b996a718504ff0237380d2e3da12b9a88d80d77141c71	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80E27B61-37D9-11EF-B489-E681C831DA43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c71931ba754aaf8cfa2006a6fa193c09d2995da8fc552a59cb503f2d8cb6aa71000000000e80000000020000200000001aacd3da0a5e3ba6839c352f26a89f5ff183bd6377285a3650bf87470eff1773200000007c69c07de73bbcab3fba8619126f8cc8b6cfc80a783b3b406a82081ac5abdd21400000006eadbd80ee42916cbd8a1959ea46ba9ccc8a4ef8138b63baca13304f32a98f87fd1e30922abb2067b2c28230b4546de4fa68f242773eaadc86deaed96cbd5aea	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304ac158e6cbda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426021147"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 3040	2264	iexplore.exe	28
PID 2264 wrote to memory of 3040	2264	iexplore.exe	28
PID 2264 wrote to memory of 3040	2264	iexplore.exe	28
PID 2264 wrote to memory of 3040	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c16c019a440f238ba32b91ddd42ba9c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
621e12e828639d239f6609d926296ee2

SHA1
8822d1941a88fb81179178ca216719a7ea9ad971

SHA256
215789031f21a8381da7cbc50d3ed934623f67d14971c61823d477444228e935

SHA512
987738b34019d81ee5b898f6a18135d02a75739fea33d75e29308826274fade94c88e588437e2dd9b90edd858d7352bc4db2d2b2a94b80026410ddae8306cd22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4a1cc5d8cf9f812d7713f02e8f9669e

SHA1
6b665751f76b1db02f7502a27631268b77119cf0

SHA256
394fc5cd7a7c8f21fd84be2167a112b6feb3bb0ebb12dd479fe915b26248d51a

SHA512
a4397d95a68c435cfa7581e5efc8aa7982e8e1b79ce81c48e119449405d15ff2a718c21b5ebe60d53f4652ab7067b72285a9f77819b0b0851cba3d48afb89abc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3800dbf8ae5d487ee20c3e9e7911a5b0

SHA1
2b1427729a15e980b0db63abe346c5d1bf0f7899

SHA256
1fd784d8bb87fa1af8cdef4a92646d2f1f1f34b139afa6ad82f413c1c01da821

SHA512
2f0986cb4cfe6b7085083604a7f3195342cd07444d003bfba6f8615a1481a41eb458eb3fbe8d14e3b61061f4503e2fb294b47b0ed1b6f79f32fdbb7d42064a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c403a27980bbbfdbcde3f4e4f90d9511

SHA1
0c73b963c6a55c431cdaa43cf035c74470280a6b

SHA256
54c630da7b243d6e1f101859923ff8fe753100652a601f18c43fe7b5ac63d81c

SHA512
a36d94c24cfcfed2679b0ad5841932bb16945a1cda1cf6f92ccc32549c707c234960e89b55f0b4649e045f34f3f847eb753afbdd255f59f954b2dc5991c5699d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56177e7744094712f890d73b02f53f68

SHA1
c4c0ab004e1724da41e10ea3421192ef3cd8299c

SHA256
b91525dfa67bcbaa1c7d59eb4e8898cc7f655abd5d4b0f3a20a36c8d734916f0

SHA512
bbc4113f2795e2cb9f23b6bc521b0655c74ced9e2fa0b9f2a2272a3113cda83a81367945f071628a20b1a3c5cde639616a144d446b0cdd9563ceda1ae1a6d935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3561f0038ab24ac79b0529a0a28a15cc

SHA1
fabe0340e6229ec0c4e211531b935f399df27586

SHA256
900a1059c1c1d48a5485ce321e7887578f028d8ca7b02ddfff90bf39ad6f7288

SHA512
c655d43a4af5f19ff143fda3f2d159bdc06da7bff6106a884333af6aa2951d4c45eb5945f54baa7d1923847e60b9836853b11aa9d4244027d5575ed24d067177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fbfc79d745ef653d6f098ba647ef393

SHA1
8d7fbdbae7b55514c2f477d7288042797edbdfab

SHA256
dd80cab0be6ef424be4e6783c849be05d1bc315d7439995572cec33279e0ab3c

SHA512
cbfd3681abd647f278c911301af1fb244f5de7de3def0e55e0d9c524661eefc8d20a03d9233a96c654b8b464763380110d337672f7888c04464c945817d4a3df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a803fa32882b327f483ea8f4bf6ccf6

SHA1
c8723ca45b800c5afa4ace7e56890344421f0b35

SHA256
1d4e2e6d1d3ff5818fee491f734ed39a36c2b75d9c82fb3a604674d23df61eaa

SHA512
2b3c934a8927a3d88ce046ce48171ed358f3b7623622b5b9af34b2443ec8e8d667a2993b5f98acf06d0dd9ee617596cd8042fa6829942f22f5c236be9f98ef94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70f6f5caedb57fa636935af660be171a

SHA1
fd6adf2fd336938b5876f307712510733295fd93

SHA256
30405ef5adcd66d8657e1eb1e5212e9964f375c37ce75696d59390950121faf0

SHA512
f848eefaf659fd5e2326d9230792f4bee0da439638347cf8457ae166114d1d17e8e9dcdc93ee0151099ee6334773a2f2fe3d16522b244fde53b9b3a4515d3322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21b50dbdd3e60d277a76752cb1e18b63

SHA1
f127f4194d41a95e1a4c86e421c87bf7f9027947

SHA256
47c49ded39cfba7ea0cc5a6280a3c18d5ac77ee83e88369fcebd551dfd7db3b8

SHA512
774eb04e297eef64b40b9e3e28d105605e3b3bf13cfd01a993d5b47633937b9b68f0100deb50d82f0e37f90a2f4f93137fa068116c8e80d52889e761ce3ab277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b31902b197fad2635048f4f46424923

SHA1
26bdf13c6f660f0479c60326b17daa748d0de686

SHA256
0025b5662ccd960bbc51522056aa58fe139eb9eeb1ca15374377b41e5ab46bc6

SHA512
7545af712a19c5e2f5aeaf280ca1349c565fb54ebb2710f84b6b10414d18050be23413938e2cd996b769ca3ab96c78af47591497975992b60d589c40841aae0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dd492f2d501496944d1aa0088c8f639

SHA1
c0064ae307c3de675d2b63482f08132171bcaa19

SHA256
c35dc3442ea7d667b4b2502f7a796955259afcf40c3a5c26e51f620ca4aefea3

SHA512
b346248ef3ab50a61650d3e7e80709dbded249c4dc94851ac7c774999e626c715c5e9131e7dc71bac00216c2e279b4b1bf3dbd088bdc2b360eb58080787b6dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecdb8e791809e5fadc68ab021cb0c476

SHA1
271da6c79b90c85669c074f524775f39e6d127ab

SHA256
6130bc186cbd13bd2f25cfd7411eb397617eb0874961d14059601354b00c11a3

SHA512
87ee7ad62a4f3437bb8205a00a54d392cf163503fb3e3595792f2ea2aa2ae4b0a58dc373c52bc681837cbfcabb2a8a05e771eb141c292bb9ab477a6a6370dc5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
246c78e237fb3ed6aa15e7d27bf126ff

SHA1
ba30dcc8e3253dc80f4fb71666d977eba7e7fd5e

SHA256
5bed3f2984a6b4cd4f978dc88f9476272c8f5ad9197703068adf9fa7c56f3b29

SHA512
dc7b662ed5a65685cf190bacf243e94bf410d5b65d6ef13e13378e49e772b252258e1032f31d2a15feca5e7f25c7c73f1bbf07fef8ffb89ed4e93e61ee3b22c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e68575963ab9dfb1f6ad3b730925c9a

SHA1
9e86983b29e4aa4ec009fcdd233c82ea12cf60fe

SHA256
baccc81d55d388344e18a6ab7c4ae910239d1015e523a7ac78f2a27284e7d311

SHA512
82ab787adb05cb56f51479ce3549f9f0c1055966399a90b44a0e381d1fd20d11ddf7c8aa52e06a06a4fc7f656c5cc33a8a828b57e96bd95a29bcfdf7f7343f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E05.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA319.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit