14ccf5e2a328a93be873770aab077c387ad525e31793e7fcdfac697e69aae9dc

Analysis

max time kernel
79s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

396fb4892e3dd311f4bdf4223ddb2c1a_JaffaCakes118.html
Size

9KB
MD5

396fb4892e3dd311f4bdf4223ddb2c1a
SHA1

058a2f54b1e2690246f0b1375f1e155d8bcf6859
SHA256

14ccf5e2a328a93be873770aab077c387ad525e31793e7fcdfac697e69aae9dc
SHA512

2149ddf061e528d9759329fa0d16f8f69bf4f48e2f6aebd012fb83ad8de0a60610030f1d524b93485a5187475c183fe9d95cd1c8ea32381ee7d44a599a0a9ca9
SSDEEP

96:uzVs+ux7oOLLY1k9o84d12ef7CSTUxGT/kPs1pUlVHcEZ7ru7f:csz7oOAYS/AUUPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000057c9a30c9e4000a05f92fda2341bed45efd37cedf31c7ec9f771f0ab00d25c72000000000e800000000200002000000099ff30cd21b57fa0efa33eae9b9bc66ac9fcd0764b6fba987e3625762f68a62c20000000de47255cfac9ae84f577f72945b50ec54bf17bdada2435e95fa6b3c1ed47e62d40000000d2ae5c9cc837521435cc8ab24c18eed6d4afb0d92da50534ef5b7f801a8536ea6e17a5943321a28eae4bea0047c25e386cc143569d30332ad8dde380e0d4db2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ddf7679bd3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000009d3ee0ca3b236cdc86e08595525cbad9d8d083b60e65778560ebd6c89159b580000000000e8000000002000020000000db74468f06c04f1a40d146e4863b842e9731a6f423c3eb3c29c556cad6ebc65790000000799a394db7700d6e71a9108f06156401be289dd06de69bf928bc338e9e2d3c1303d766b2d3fc9e0a9e50dcb86badae16be71752db1e314da0dcbf806c0d174d35d07cee5fbc9113a84862bd7dd6b9ec041e78df4c78e7cbaae4b80a3f00935d5672d6515c410bd7c6018c13c4f3dd1f1b05d9117f0e5f7633a5da20666e344ee53c8bcd793ab301553dec822c515ecaa400000007cdc2c537c5d68af34cb0577686977a8d01985ff6fbfe28479f826a2f03d2e8e25b27f403ec41620237e84f75d77e32458c552ef099a01d93712b1d635095fad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426868584"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{925F6531-3F8E-11EF-BB68-FA57F1690589} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1304	2172	iexplore.exe	29
PID 2172 wrote to memory of 1304	2172	iexplore.exe	29
PID 2172 wrote to memory of 1304	2172	iexplore.exe	29
PID 2172 wrote to memory of 1304	2172	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\396fb4892e3dd311f4bdf4223ddb2c1a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c39f1694cb2c4c382708162d726b1c1

SHA1
87bf69a5c6951e3b6606fe30e3dd91dd0febff5c

SHA256
ad4d56dd53db19a2613798e5a80d34f0367529ae11fd10a6b1ae9ea4d73d3402

SHA512
d54187fb1c360b0a618d42a463af49366e2d4b8e6297b8508e2ca1cdaf433afa20830371b08645097ffbc1aa29a146f34b10701c6002d77bd1c39e6dd1262eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e433ff0d55ddc446f51471207e809b78

SHA1
2289bbf93780ba8ef90cbabafa68aab56671a17c

SHA256
cd80d4ada826b80fc1a625790641a7b50bb9d9f92630e4d79932c43935674a27

SHA512
c4a23cec24ec161249b282b23fd46bbbdf5980c8b8be98149ce48c9f9da27ab2fe42bfa2476bc074dfaaa0c3f5b78534b43aab3474b9f538b7f91eddcc869eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45959806e7b67c2e3542ac0121b30095

SHA1
ac091c73bbff365fbac64135cb4b26d8ad501e24

SHA256
5f182dec9cad8b54143b01a216fc1146a8af01b9f7c26fafab41e6cfb431f3e6

SHA512
14031c966145a11683b5e37959293f47d76341aecd8ac8314e19bff1488d3c94e52f076b7d83f3e356f2cbe70317f7345a60e769cfaf10091170e5c47a61a11f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e13c6d0cce19386579a3d28a250eba8b

SHA1
97a2162fddfbb760c5cebb7008e001195027cd61

SHA256
f323f3df35be056d5eb4c2c65f26a75182ef316b023d5bb187eba0a9f251c6e6

SHA512
e5562052e978ef5787f9cc4eef2b98bb1903bddb53d21d6154a98a69ca17774251ffc5e9657006392fa1f08796f62a3c59506ef2f05164515b77f239e64d7072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c545fd4e2367deeecc1ae5519cece556

SHA1
3b582e0cbc48480ff43fc777e1a7e712014e4dd2

SHA256
e2b4c75c171c0ce4cad4c21d05d6379b8e0a6cc64731fe7de21a09f43994ca2f

SHA512
7bf157fd6dfcc2c2f82c1011515be15aa0ac3baeb2cad10c840cb651aa7726f4cd513acc66af6cf177a054905860c5cf0a1aa11faa2cf55a40171502a0422cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
362c62ac3c0d996a67053d2cdce7e475

SHA1
16fea39402d5950b81379bfa38174755afd9cc52

SHA256
9485c6bf1a3848413cee5fd8c856d1ae2406e100ccc4b262e0fea0ae7a8753c8

SHA512
d56a6d070b17ef438fad5cfe5b075f70fc99f52b35bd47b820463a15b8860916111266db9468e6c33083a7d3c98f373d0a8f99fcbc7e539b2e65971fdcf84a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6a7f4ce2e2b940a65c5367cfa597277

SHA1
a2983b6294c64a708df8292b490b10165514ff1f

SHA256
17ee8357ca456ebda3e8c578ea7a0ea42c3a28a524ecdae2bd1c083ff3ac4e36

SHA512
8b7d1052fdac9b2b7c8c563b548c62bffa551be1bccb30f073d6f2e26fd61d86fd58d4c0d2746672f44a772d57db9f408eb4650eb47892d95aa5efa7c8d91451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9205a74fc00be8fcb76437e32abb2a83

SHA1
b7ee31d283ed64f7c37c327cdf84fb91f8706233

SHA256
4b8fb92b1f40536bdae48ff07fc1a8917ab051fc4afeb82211a8d0e51ec5571a

SHA512
b1488d98f8733d888a9759acaf8eade3817a49b7d7f7d270c82e204c36f51b5353fa104c4766c23221416b599f4964f80b136bea2a6be63436373cce2ff34c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1528cc58bacdd053046cd5452b49d66d

SHA1
7e49704ecbfb934aa38a1deb928a64f1c526e165

SHA256
f7726d56f49989aea717f50728646cbc89711aa7374493930281d5d7f8821370

SHA512
a46905f5e39bbd573a92c1f7be343299d459c2ae468d500938277f649808fa6c974681795398f77a072af3ea1682b8b3e971c6f9539999bd99a669d9bcc7fdc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7680edb094e0ecdf829a77b203e09282

SHA1
418ed2fa9a5bac3757a074966d725f594e5a29ab

SHA256
aeb456f994a81c1eb511af817be361fe0a39adcfd2cb56b8a50fd056cd638f3a

SHA512
1996fe65214bff4415aa75688ec9c8799e5c173d1d14534b40da422edeb80c066d5718bfe330f1e382f8aa2b6b0f302010a0a2190af9ed77bdafd9b3fea67778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6065f387d0cd6ab4645319cec8308958

SHA1
867a3504d5ae4e3949a9fe1fa8ef3f9c1ceb1560

SHA256
a376de81a87360acfa85b05fe3b928ce17b5d12b1295c6077163d7271832b5d2

SHA512
9a63dae62d71b65a26d60a28b65160b4105153ffc113f0f4f8d6693ef8f958ce936d97ce9597a655aaf36eecbe41204f35241f7a75a13f97d94a3b7657800270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dae1001983e1165d1fd66d44dba55fb1

SHA1
50624bf6c3283e59c93758f5539197192731509e

SHA256
515e8fb2966af18f0219489d2881700c47837b0e225a45e8691d66b817386b36

SHA512
7c7762a6053badbb62b2426590a33d7fa3093990683d5f7bfc0b373cf73f4c3b99903a85d2f8eb42c6c8e7aa92fdfdf8853415e99caaed8ce4f6ea9d326c3f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8bee0f8887b5aab056a104a9c416b57

SHA1
4ac9652bae3f6d603b35813e3a1c21e2a09c515d

SHA256
77f32f1e53e6ec41bcbc0b05f12144ba69ac121d68c21b67d2b6966fae1f83bf

SHA512
9e1b60840f0b5b8aec900aa15a42383c46f65fd60298c61de2cd1b29192673114b77891128f5c25bb6bcdf8416e59ca691e20eada5fa882e7d20962510e1636a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1ae822dc358d009a972eecea640fa25

SHA1
68b51954abdb57e3138682f26a4a73493fc35064

SHA256
44625fa630a18136b632b4b6951f1e7fb4c95df1e093b82b93971f4d7c5561dc

SHA512
5dcdad4e9928e2bb16c235024bb6901484cffdd1f572ac1283f92f4625d07cdc8a13e942d17398a9fd1c2c2070008ab89ef238e4b577db3de60c0d7755b4a747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87ae2e08af1417a82a756dbed0932c56

SHA1
647cd9e16bfc94a5a2101ec09b5370f96aae65d5

SHA256
1732c67d4867952d63c7e50262c3bc069e3e69b3a1a81159ef21b8d7ea9ed62d

SHA512
7ed8f629f41fe5fc3c38698518ccad418b1cd9d9dfb4b2a9d70893de13be5a09dd9f5df260a3f806590b47b088fd04701d0cc4379f8bd0957dfc520c5b05615b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
041f7173d6ea5b4f5e25fa324ca9a249

SHA1
242c8ce3ec59e9bd1f2069f7a973c25cbbfa8caa

SHA256
4381ec78956b9ab581a218686329115b7a9ab43597b6423c5fe6fac238f2ba91

SHA512
8eb63153e483c59bf3f729d5fa0b740e2a398758dd54101837b4999be27c128e32f5d6225848e0bb117be0ee0b5fc3483d35388844a81e888ba165f438f582a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63D3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64A3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit