1ead16a39bab9d5e30b16d553379e6a66f867ac0aa0a8abf1b8d1810d85e9e18

Analysis

max time kernel
136s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2150b1e227b9ce7bf4bb0824ee1264d9_JaffaCakes118.html
Size

214KB
MD5

2150b1e227b9ce7bf4bb0824ee1264d9
SHA1

f908eff8555a7719c8735f63a490628b058235e6
SHA256

1ead16a39bab9d5e30b16d553379e6a66f867ac0aa0a8abf1b8d1810d85e9e18
SHA512

96d4162760d01adab7d3089b29c1ae09f91fc66315816808a0385ad51ee35e5c77bbc7caa9bb1c01210ea2339715569ab59b8b68a2021b98bef15c6bb09272f7
SSDEEP

3072:xrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJV:lz9VxLY7iAVLTBQJlV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000267e39fc6688158d1e053edb9d5203c2c851add53f565ec5e28ebe328106e04a000000000e8000000002000020000000f9679c42d2945182ce645e1f34b273ca5ccaeda2fabd10521066019662ad441720000000cf600038c362f2788586e72ca38a91a1ea4fae3f0fe11a0df8f877444b63e73640000000e792cfbbffa43c753149f033ff4628f3a77a6e79cb07058915a1a02c5a3307a49d39997944f480b9619c60b1dcf822fcb268e30839ca9c207eab127fccc49a8a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 800f3df0b1a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421270643"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000001ad4b12ade2690b44ad6de11b7b79b61a5fba152d70a4a43295d32b63d98940c000000000e8000000002000020000000122fece4e819c7b296f4398da11e473d4a95a84fe07270107c85b877c97b6f8890000000e01e16bcd5c322c90fd6bfb3cc71d0ad527012a97fd02b1be6bda87412a9453d1f6b7e9c1a422e5872bfec955f3e038fcdb4cc6bae59dd90a28a177a680a4001ceb03f44d6eb069714d76e6302e3b30d6d128ba5ed6d04ca69ca44e44f52e761d8f1e3fe696e11564e7b3dc273cf5acaa9a914f701f6cbd09eeaaea442bbf9ef98887468bdd22f53e6e2b9bbc4eea9aa40000000f0fae98ac9f183d345da98a02fcd25b7e45217c65b28889e3762507e5e390c305f99602343910b55e247d8c6756cebdd7931799aaaff83a2949a22e4ae8b18a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCF15CB1-0CA4-11EF-85B9-4A8427BA3DB8} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2150b1e227b9ce7bf4bb0824ee1264d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82cd2bc9b0aef157e83392096400b8c8

SHA1
d617df991d2dac20962f59bad50842ecc16df5ed

SHA256
bfbb34f02cda18c862d2229d20005312949b6986d020d57292698a6f95035881

SHA512
eee7cde98763cbc5bc596273b66b445e4925e821574c5adacbd8ff8124f5a6af18b9ca3d926a2e59d681fa14544977b45888fd503257743012f57e2d657b827b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddad20d1ba04b3b5cb32e404921df9e1

SHA1
4812fe5600af924489ac4abce1fcca6470e09ea0

SHA256
660e1fc0a66f6ea45a880ccd9a166e805f34c128ed70448a2598ae6c3422b0e8

SHA512
6aa4f6d129c9039af5c94cbd15e0e4f01635b95e24457cf69890d7270526e12bb8fad4a785ee8a310688e61ffc60cb56cf03e7ec4616efaedde0dcb20c759f6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a8fb08021f2438a6e8d82f4a0bc10d5

SHA1
e6b1d4d30d84b257cf9dd6c294044cda58af2bc9

SHA256
4151776cedc27a8180d1b355df833a37d111dda8e559a4c0b8c4f1f21a6363e2

SHA512
b9b802afd1bafc0abefa8084318b4f10cc315e67d9c2cb670d11c7095fac6d05faddf9df1660a0fa2db386e5d4623cab7dd1559c5401392ad1252d845d34233d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b2535f29a5463527ef949a3b03e2459

SHA1
690c0296c6764b936b966a4f5f34818e092f47eb

SHA256
7a7a94aa80430e81cff58d8da69335d45a09dea9d37fe12e9c6dd4ad92b3adec

SHA512
fac5d5e843a6bf6327f72736d5a4364b37c8053c15a557d84e3dcc2961e423387c42d2dc62ffac4bc1eb95cce4ed2c0bcc39bc14b8bf2b10b69db1158ff781c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
503492c775858e87fc4206176b2bb34b

SHA1
26a24c2d4317a3bc3ffd1a1504565d52fc5b6a23

SHA256
5ac4c2331d90988393ea59d55b2d3b67989e08e442d3ebe87ba8b3848138538e

SHA512
f18c75867c561f606427a9fce580ec92170b0e97daa644a6e6d329177584b025a56b2659397772706c32a035968a837ac153f715969766234874b27aa8688d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6170cc73e6d5b57f24f4dc02bbcf04a6

SHA1
4490bfdc6460f0a13cca03337961642c92a0ebf3

SHA256
9b589a4ab0391a3c4ac39c7a491b5d88be470ab2b221dd6c24ba24a7536d2402

SHA512
32e9e49629b1378583250061496915cfb100b36c4955b29b60657e98d3ef9c4888dc557a289f65d32280579bfadf9b19172133bff1d2234a5fa4a948d6a3d44f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a69c9b1f04f832b351f2284eb38581cb

SHA1
4e851308618458eea1fbf048af625019c3995c48

SHA256
7f3ff86c4f3c97675e7e5935f6d0cacdbd69bb8e03bff87a23d2b8f2eab1a0c5

SHA512
ceca4b5b72ee14cd330eaad4cb1bc62c207565f3900e9d55eeb39308f8f0a4c7b5bf3350d26031486623df0a308ac0d1d67a5a5bae2c684e4e762452a28d827d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5841937c5751406f65544040c32c0bb2

SHA1
85a410cceab2e85bb66b1ecfed6d12ceca4c9254

SHA256
568c8b41e9b656684d158ecaf73c2091c93c1c84ca58a37e8545d087ea91196c

SHA512
eca7f5c8cad296230820cca948635292b94c5ab6587f32839ecef7e7e808fb970e3d24ed7457c27595cf873c4568580ddfcf096fd2e30f21470d1af66865a732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e598ee42b5de553f9a91cfbdbb2210f

SHA1
489e063a6f7114a37e7b49d8c4bd82c233c9a3f8

SHA256
c5e2f643b72279c775f5df17e5166f88f799dec95a6a36dd38d8fa05ab91e68f

SHA512
35201dd55e80e1d5d9f4049f02a455f022b33412323593d57536425ce33c27f083f5c5dd106d0b80bce3e41336e598b97e588f5bc14430824441f20a90b9ff03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d1f1e164d6a273e71d81223710e3f3f

SHA1
9798cad360e598c8eb953bcb405024b255e61971

SHA256
5945b8a6393cef89163b6fa81172133ba907a2d3d331ca5097b79e03f6dcfa81

SHA512
d5ac90aef37d3ab25e76624336f36a1d229b39d112cbb7ab6411619ef3766aff6de495182c24cf6748ccf7704185da83799cb27b6b492356d8fdfc6c8652c0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a622f435420022dee5ed29aa7176815

SHA1
6256dd28d6b68110ee968e7f0e4bd597e834f818

SHA256
353d6ab12c8add7f29084e9183b2f3c1f2b426529d84d84da0b00b2cd2c19f3a

SHA512
53b8d7d5ae72597ba660fd30433911adecd9ced03ca31b3316fb18cec1f1c6d73b1017c1991a590067705c6ccc71232b1d8434e1868701f6b2ac2f0991113e05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d350805b69f73285852246f553b0e5d2

SHA1
e0a9f0c076a7901eb7be1fc9ecc1867a1583f582

SHA256
3417fd8447f7141a1893399cc97e2b0e3226e613939f858be4078dc2a63e7fec

SHA512
35e08a637421bd8cc4729ff68dd5e4c65f093f0100cd08576c7fbaf5e31e8beef1b1114a882d309b19e2e970e8e02ae7af19230ccf9ba17e3a187c2d51871c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74f600e3fac51e226ae2c65abce22244

SHA1
2b72fae1dac11a89c7b39f44232c3545a4ed2412

SHA256
4536e9a85e781778ff8955c46f6f5bde7d0fb58d900cc0ea9a56bc38c1866d00

SHA512
c4a278530783866e528815e160bdbbf46750bd2d995d4172fd0ec549e6c45bfaaa9b670aa77a0e7b6a214b9ec9b34891450ea010317fd9912f4fc45540944a7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar108D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit