2a5ba02604c320bf250f1dcafa5051885bdd893625560d8c689fcddcb016efd6

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2244c6b69490d663898d97caa8fab7f6_JaffaCakes118.html
Size

20KB
MD5

2244c6b69490d663898d97caa8fab7f6
SHA1

b595e9d52c580f05b9cba44351106c440e21792b
SHA256

2a5ba02604c320bf250f1dcafa5051885bdd893625560d8c689fcddcb016efd6
SHA512

b01f2f628cdb6b03d7544f1aa57e18d4eaca4947cdf2653431f2893bfec011e1d7e65c7ad39e1b29cb75ef1cb41ce6c09843a90cd21c674bc0a62759e7b277c9
SSDEEP

384:J5vJO1ONQLlCw6kfk8oKGbAgOaN5C4f6604ThyLBdi6BjIich9y:J5HQLlCw+i60SUup4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74B8EA01-0CCC-11EF-A0EE-F2EF6E19F123} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000a31a4aa177a79bdef2b7f5c283b30a3deb2921b0a4da97b38106de23ba8b8871000000000e8000000002000020000000ede4da456ede990899af1ad226c673b0f4426e1a03fcc4d76dcb839e24e03f5e200000004120f32854fa5340616c244ee8392519e8c34b4c0e43f92a6f6821464e0316a040000000a550b1c5e828e058c87b9f188a513bbb609b2f0759092e13ecc73d606d8a85d170fb4bfd39b9b5e52bacb06757160d6b40affdc6d3af47e3a6d95e20e2bd91e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000006e1cdd4a3ebcdb026b71a84d4e7fb2a8199d4a28c832ba05d8d663ca57d0e0fa000000000e80000000020000200000005981ba366666146c987e0268bc609d053edf74514f8842087e2c22adc506f90c900000000ff85982176f5c6043dfad85e23da4c273eddf9814ac1b0fba7abcea248ad83edda91399dfb66e57ede87fc2bfcb160768d942a9049eb67a0e5eac556a9ebe2225d33ceb7dd2af0e0182d7b856098c678f00482ac4cfebe41d5cb78b8bfc73c3f631980fe859de3d6f0279f7add290cfc9092b9f1361e3f3bbe5e69f4918d811099caa44859740b7af44e3af035362664000000066b2e51ad8892889305313fa9876c6571443256eb13ff9cffa3664b0d934a29fe2aaaa190c8fa285e00ef16226089df31394e5f96afc1e242f250bfc46c2193c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421287644"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d13149d9a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2904	1680	iexplore.exe	28
PID 1680 wrote to memory of 2904	1680	iexplore.exe	28
PID 1680 wrote to memory of 2904	1680	iexplore.exe	28
PID 1680 wrote to memory of 2904	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2244c6b69490d663898d97caa8fab7f6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d38ee6b4cb8b9736b70ad1f75adf12f1

SHA1
e87dee80b5835d70142da4d7c13401a577e6d171

SHA256
c9c54d740b4388ebc6aa2837aaf5f4ff4059e1b1f4331603950649137b12bdb8

SHA512
1272069bce48f136df535205379140f8f8f166d970ebdbc5e8b289045c96d2a957cb47658f635e3e4455a4b9f61113dae0e4974170af86380c84402449fde309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f874ba69e3683a527ceff3d984d4dea5

SHA1
6f5dd65f23099efc6cf299d5f7ad8ea5281fec48

SHA256
8aeba3e2a79cdac7a478c89d9967c55f16342d70b9811f0364ef960562b3ef71

SHA512
007db5f218378dd23a98fabb6a65fcc5cf86f7d3787e2cc92dfd49880774a4876f242334daf467560df366ce4fee47f28068e9e7c6ba38733c44461299fd6dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eb17a56407f86d50d54310ca3505860

SHA1
a2f1caaeb9e7a4104853d3fc348134a092613ac4

SHA256
cf2dc1c3ea640803af7da6fb2dd8032a2d1a00a2292621d2206781a2c3f95707

SHA512
0bb0ccbea8aa5c83646dfb29d34627ce5ba4ca4da5d5e31b59b896a3392c4cac3c5457a1f607379161cc1eaf2c6bc223cf49ad62ab30d94027c832adc4aa7357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3db49d149e5a622a9c09754445d54f8b

SHA1
1e927934eb16ce9c56eeb58ed364eb9522d1b1c3

SHA256
235d1999bda29bfdd0296cb9b3ccbdca5fff5ff9739c1fc6d51b141004e6c793

SHA512
4d5f0c95b3471fd0501149403ef709312941765ed32990eac279f48856ae5202600d3cc3460190f30dfc36d92eab9c11fce4e9fca47d97ea6115af8a6cc6fbaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9455c0f6ac888e694cbb6e483c9dcc7

SHA1
1c2486fea801fe5f75f5e39be709e67b58a80208

SHA256
c00eed180ae09d906e9dba12484b39aeb95ead3fb352f80db48e247c7d3795d0

SHA512
9f06980f775847870006edfd294d1cf2436539afef236f515adf79cab2e75554d890468bd7e54ee5edaa179b0f4cd6ccbfa6490a68e90e777f88cb863acfb026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f9d98255bd6ce3d9bc66e73919feb11

SHA1
e37efecda41a0ba0fc461fed5c50b8f010a2d7bd

SHA256
9da8473ee46d5c7d311780e50f79b7363ceff8eb41fbf2e2f83f0e851cf7486a

SHA512
c61c4e4369f88c95a43db162644fbfd7cef457971f74d9e8de5ed430d17068e4f044d8d3c3d53e04d1d04ecb484fb55523a492d66fb6de6881d34f4af38afca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92cbab95915f7ed37e569d30edeedc30

SHA1
347f5db404c4cc91e05a6b947f2c9c91c98f3a31

SHA256
77462c6cce8aeab7640bbf1498d39a609f8315ca06d40794339d82d3448622d2

SHA512
ab89c8fb3199fd84b7e65f602058981fc72f31c0b7218f83341e84de5a7c2d9115b9d88960332c25621811f18594cf176831f4176087ed70cdb6c5001cb5aaab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
522236f091db93edd32834567a77cbb9

SHA1
b55b3c360b28dbcea8864a23d94398d0dc321df5

SHA256
c5e60d18f37830208fef04350d9a9a50b47e5852a6c85729904c0a86eb1edf02

SHA512
36b962c7eda019806090f90907f395ee9f79be43b4c9ff81f1dc1d754183af0bab3bd6c0499fc0765b927e8d97070d2cde8dac8527fdddda74aefe41dee9a98a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9aaef3c33ecfdb3104f4b7083bd2522

SHA1
19a07fa3c87cb65d4b101b70108613d71e39fbc6

SHA256
3fe14c7e7bf899e2427b72388725d16c13e127ba9c47581eb297486ad486d1da

SHA512
ce43227eebb646d2369367d59267692a9b90553565e650ddd7822d713c0c1110e3ddc489f6956482cad9afa9c3a692e2928f90bcc35782cee9f2ee005823f08c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff2575f7dc344b3ca93aeba0239f9261

SHA1
4aa8e7c0024c66d83c94912460ac5d96bc15765c

SHA256
35c199d0a2d7441e85941e202016e3b9f0e573a1968552683891b0d316e04b1a

SHA512
6a996111f9f4e32dd074710899fb0383a35e6f4f3c1f885a6caffd5ff3a7bc8b065d1ff579bd6e84f0142376c80bd92c49ef94a39197822c676392d89bb52d94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a56b23ec0b9654d15e329b147a17af9

SHA1
c19cce858b9c4fec5c62387b06154779208e931e

SHA256
573fd1d66851574172f15ed4633873aba0d96e36b8fa6f4b7ef9b51a9e51658c

SHA512
5bf2526de023ed577f23e2248736eea54db33d3bbcbf51ba3d980092c542736743261281bba1b89b92750609375383a1172668c026a93f674bf2d8529a978f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f4eeafe21007b83312a9a25c3a52e5

SHA1
413b8ce8bbc665a0efb8ee1e21bb1470f889c00b

SHA256
a7587332563f35543e5557ce0cf071ef2bc84b9b8690e5922c7468c49c3bff58

SHA512
ec4a867f813e4e09ac9fdc03a02040e9609436da45752c432d3453274949fb4bb63b49d6e55a39d29f97fab8204a98c46f1f386dbc1b768ea11c694b5b8e3851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
629f7729c88250758891bbcc71d0fd6e

SHA1
be38657f93743754c0e9ec7a9f1cc669d55c8171

SHA256
a9eef8b793a22c7388e2c4ee44da12c73a70109a7fd10394a7a9b834b33559d6

SHA512
c369fe74806c96f5d6d4ce5d3cd3ed500a0f27a0081e83705a4c7dd89c37a6e8014b0ffd24b541eb216250f35b59c141b547b69cc76ca00d7f36e30955196a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe76bfc060520f4cc3b8f98f9fe3a7c2

SHA1
e3931db0de4d5197705fc78e9558b78046dc7a21

SHA256
4a82b085c5c2a3d4c6438564e92d54bc5df934fd3a12dbaeac8ecaa01d4784fa

SHA512
65bd8f24dfcb6e3f21cff176142a7983606d8d53cdf82267286f3aff877ad5a4a95963ef5edacb6d0c987b72813f03c4f08ea7f46f68f7e1a6d5e72d31ca1a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab140E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14D2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit