1ffcd5b7518e1175847ce46f1b0128024c20d24b95446bf0a3887a6085c10c20

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

210d0a1cb4f0f226be1789f91a0ef601_JaffaCakes118.html
Size

23KB
MD5

210d0a1cb4f0f226be1789f91a0ef601
SHA1

e2742ac5b902fabadb409f7a9edd61f121fb6a3e
SHA256

1ffcd5b7518e1175847ce46f1b0128024c20d24b95446bf0a3887a6085c10c20
SHA512

ca91a92fe08d42b58ee858901c1803e182f46cef459430c4b829c8ea42bf94c5b63287962964cc418ac65eaa29f5ca7bc163c2a256f2d729eda82d193dbf71a4
SSDEEP

192:uWD4b5nd+nQjxn5Q/gnQierNnenQOkEnts2nQTbnBnQlCnQt7wMBLqnYnQ7tnIYA:IQ/2t7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000009bcdb4aeadc5167e02b92ec989e64c7957a6f37cde5949ca6f8f9a5885121e0000000000e800000000200002000000077f0b16a0340bdb4dbd7b22a95caeb99a2742ef05efb494756440e61bf19c78a20000000bb05c63b2ae7bd62c88eaec26eb50691f8f8440e7c5936bd3d771b6028a5221f40000000ebdfab6fbc9c6803f6c8605de3c6cf3a5e7b5f4dcb6163ffe99350074f0bf58390516909ee45dcc87ab98634c0e97d6a18dd0fe8e34ddf1dbe1f5164ad2e3451	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e092859e9ba0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004d4ec8c523120016cd8ccb78987e2de5913a803f3fe1da6a1d2d55b358cbe6b7000000000e800000000200002000000033fc9da7d63e3206d5ea34260cd78694f4c07f1720b512428201f83582a75574900000003bf071a5d8833dab5b6cb081217e168af451da576be91875307c6cf2048706ac469054ca4d1eb485404c2eb9f171de737f678ce35279439b13a38fe7ceb5ff058d5e163f90289a282073a9e9a572c9847a844cedd08376a3eaf21ba9af317dc33fca035660150de1c01fbf44502207bfdedefff4c5813e4b01c564515ec09a4abcc55fb5bbc51cfebec63c653fc78fe040000000220c9ca68373a239f8cfe42f446e1b764239f0224dce49af2fd1e60d345a87c2d1bc0e476f6a8aa9226ced02bfd3cf26d20b5604b7edb39c1bfe413ff8061896	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421261157"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9DABE21-0C8E-11EF-ACEB-F6A72C301AFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2252	2028	iexplore.exe	28
PID 2028 wrote to memory of 2252	2028	iexplore.exe	28
PID 2028 wrote to memory of 2252	2028	iexplore.exe	28
PID 2028 wrote to memory of 2252	2028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\210d0a1cb4f0f226be1789f91a0ef601_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5d0bc0d9173a3ec62618dd706bc5760

SHA1
b747b51fbaa85652c9a8f03703c7faba8602c5e5

SHA256
27de969d64abf831b4908d298fc3a4939ced59027923de5e60473f4d82238614

SHA512
4c62a2ae7c82e19557af6e447dcf664af8a1ef5f45763f8f473c828d135bcc8cc57b72ccb4f7f0a3b10716ec746eb005c00a79c89fddaf276dfc038628addb8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e19b286bd43f89c44d984f76d15714c5

SHA1
b29c1745c95279cc76567299a7c1e2602148c01a

SHA256
63e8ab09dbb8a85b6ca14887a94cceb7c45bab8f77428317576b991c81c01fb4

SHA512
257675768970569c41ce68c5c0095325c3deebf1e991d9678c165fa63dbe83d06265cf968ed9c015550d7173822daec9dc3d6b2e133bb77c18cb581e0572de06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e64b757288db9b97d97411543a7fa740

SHA1
90a122902680f1d82355bfb538b2ea7f6da59f45

SHA256
96e2d5b8beeef68779ddd023a79a142f18f9fecd81c5bfc8cc9b9dc3c730828b

SHA512
1c5c51aaa74252d5cbf4463a6d19aa69be5e02b6b4c157e264afa0486f228f71b2013df6c1b6cd3ba153020c7b50571ce5f340dbf177338395629da90d2c2233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cea264b4289e365adb9b0a5e1759b02

SHA1
cf1a7bbc2f25817d2a47db95943b2e85a98e5564

SHA256
fd067630c56970b5df406d365d913024d9b60c52a9f60d738dcf2cb9d4b592de

SHA512
2f699245926fa432c0102c3b4842f949137006bc9d178d865f5a344a59793e160ad60dcd40cf10704ff56c6163240abdd49bea3f7fd24e8fad84531d17f2b33d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11e82ce1fff5e0e9ec6dbe869bda502e

SHA1
a9d0abe4f97de3e22b492449493158d44bbcae09

SHA256
ce0fc53eab5d914de69dc6233555e995ca8f23b8729fab4bcffceb8e01d7b7e3

SHA512
3eea0213545829a57c2c1bcaf6ba6ed9b5459e9ef20c43c5a923906caa21f6b22125e5d5fbbb1a63d00419526e097bdca05faeb7172c898c444f2ddf43b73f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d199f6a55eacc00834ed65d158c5cf4

SHA1
206da292ec9b217e8263a0ba34bde8b88c6a3181

SHA256
b55dc4848e81c7fb62af8f868d23504c1c97dd7671375464675cd8bd879761dd

SHA512
87b5c1f2b140f57cc2387eb4563a9cca24fe1bb577c4fab9a2db72d8d6eab3f31ba60423dddc63db83124330da963cefcab20f73da1fa4199d2ebe5720b6d098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10f1466a71638ecb320a2dd6d097496b

SHA1
32996cdc8ad3a90a2cdafa5b71c770a49087dc3a

SHA256
bedeb4e82ca65da8a31c2efe5b97ec600a381f258f0da5393ca3ae199e13b798

SHA512
dd6f7964da6aafb8742668c9648a46187d2ce4507fc87debddf62bcbf34257f59ba08316c80ce2148c421cfd744a1b858947e5c20512ad333250ee4513673ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e50ef2ed34b7f0a7fa3cb62f5f878d43

SHA1
898e7296e41f543f6779f4ae44470c1cf2eb3ddb

SHA256
f889d68ad0024f22954e8d9aac52bbf12c342fd51bbe932b1f90121f0659105d

SHA512
b174b84bfaa641808985b6299310d2dee7dfe6db89ef6e7d8e3e989a75d5d72dcad3bb07575f3755c37dbc9a509a7a54bacb0988cf8c0a35ec3903038d7b93f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da1bd753e57776b2d9e6b29f8f2c8ae3

SHA1
e798cfb097e2daaa8eb3e6be40cc19b2d037d897

SHA256
8d34b3e3dd0ce5634e6f8ed18336415afa558907b9c5c023eb9a37b1df4fe40f

SHA512
8eaa475cbf8ac87b5cd7086faca69d12bcefc073a87dd9e8dd54dc12e46d22ea990f8c8df31fd5e0b6dcdcf26858c1aaa0951d80255f078388a5f8b4e80798fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a6863b5065863c779493fc0e3a34e2c

SHA1
2843753c8cd7aa740f5687b01ee8277f0246ef9d

SHA256
66ded0dac9549d59b63574192c4210efa9c60159ffd84979ea9f1dbf8321647b

SHA512
71a5ddc56e3c9e0dd7c7e3e9f519caef2a770bf11156f9845200955e6820afe3dd74380943cbd97ea676d895fc7ea5e0239ab4ff1855e0209fa9832b29ea5186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4515eeab21ffa1dfdc83adb1ce6cd04b

SHA1
0181cd53d6d98615636a02d54cc692dc360e8d80

SHA256
dbfe82f23920ebb82d7a8b98030b392f732a3f0054546a4e70a46eb9c965b988

SHA512
a7f1377f4d0ae3ae2475088474f7b257b5534e8a0b5a84ccc416fa02f60837f66e934927957f4ac989a1388d5f0b6c26f87022cfe73be98ac044e06d4ca07232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcda97e8a00b715e89d47ba499b05276

SHA1
f702fcb46625bb756f15cd6eebf8fc04d9fa2eb7

SHA256
ed9fff2f283b70af844de1faa0888a6bc9086893f56dff6fdbcfd834c535ef40

SHA512
da3740c48871b58b9accb437188cb554cd9e150d721747d6ea1fca057b8eef62de7b6d8dcc3c1d322d3919c42ab83fb4c7286819cce6d1475feae23c5efeb604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
555424fa7f8e4eaabda82a9d2cfb7897

SHA1
5205ccf1482866a1ed3441861152fa9d15ae6451

SHA256
19929b11dea9779c4dce7ebba578eaa2dd8e681425062dfff3de73c495b1e176

SHA512
133706f3732efa31b7e23a1c94db1807889a7498f307a2982392dafc52c60a32f605a53f852e14112bffb27fc24ec597ad6cc03a5ae119f604aea197df2a0b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23D8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2650.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit