2f3226cb4b8ba2fde5595449524dae0d6f1471be250f389b5142b0f683b68496

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 09:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2429143dca45a47937deb40071c61647_JaffaCakes118.html
Size

116KB
MD5

2429143dca45a47937deb40071c61647
SHA1

b5b06c3e867835eed129e8677d2967cf32c729d1
SHA256

2f3226cb4b8ba2fde5595449524dae0d6f1471be250f389b5142b0f683b68496
SHA512

cd481758cf701998290a7600de90026b79a4daabf1281497d2919ecf2defa4928dda853675cc33a6f213ffaaa52788bd91d77e4fbc12cfb0cb73b7198eeef81f
SSDEEP

1536:MONryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:MQyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000509a5bef002c1a72e3090e81c7414fc7e8362fdd32c1cbde5bc11d95b027193c000000000e8000000002000020000000f628c3546008d7860c40464acb9930089802a0204dac54d082e6fb505c9e9f602000000059ac4479903e57b63f8b16e55ae19139abe8f3155091064323ec86ec9f55007b4000000094732f9f5aeed710ea2bfc33a18700f299cdd289677402b9f6dc7671baf6ce8714ec8a5a4e2a4b136a693e750334109c74f626b82076bd8cbea0bac4112979ac	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000029f7d9fcd1356c402606eb53acdcd56d204c4b441b91f95efec50944e85ad311000000000e8000000002000020000000ffce0852de2a25d19e1d36b84121434c54a3e9b331461058a779c69afd3e516a90000000282388151ba896d2ef64ec93964c6092e16d0673cf96ef00000c40695580478c4b110eec4bd3d7d94a6660e24e0eda3145d1b815b32a8cfa9937b91dea96a178c3710b38c1522d0afd4f0470c86854fb8d30302ac307e2a776eece0bbcee87f0521c864e2321bcd1b3a8d671d1cbe4f9d073a0642d48d22d3cf872f10a8543cf56412762dff1f64d6c34eb96291e3df440000000590b6d58b282fe3e7b0f04499dbffed6f4ee00144ced25391dd3f8ded67d74a7f2f0a765cd23103cbf64d8d1d5f070049c3286b4de3f09bd50580a41825f75fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0140de427a1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421321389"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06E2C651-0D1B-11EF-8E7B-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2429143dca45a47937deb40071c61647_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76ca286b317054b5ce159109f20e874f

SHA1
2ef050e774420419e9bdf8a5f2208136e77cc480

SHA256
c186577f8ababbc6226c1dcb7b3431354b0f24198deea698fc44385c72060939

SHA512
ec48017378864e0a9d687e6a9d1065497fb29c4d98ba4bd4084d2ecf967758a78fecbb66bf43f226c3fe5f5a8bf8061a2de319dab3fc6da1f612b3aea921ab8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3668a449cf907cc3255c56c462bf9cda

SHA1
f0b4f9ec84442d40a4bbda5cc2b36efddbe2e2ca

SHA256
eacc0c61c34d33f3c06d3dd8b8343d1c4d74c0adac6d329fd90a131309352065

SHA512
172896da270cab26885ac85c70077e419a276363e51b1198c3410d5ffe926ed4e845c35fe8da2299db2b57276423779b95444731170c29686ae27b85c74cddbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecb306b777bb375cafee9236850f13da

SHA1
f7781f4b44d193c3411ded8a0a29a2d8ae3eb1ca

SHA256
6b07874a6586e2df3336db053698691f38f19e612e99cf1635b8f8772d3a3493

SHA512
739acfcda4c65cafa4bc4c88d278790ed60f3cbb17622acc9b4285823d317d98eb25837b991b99c0ffd509535eff5b26be15cf1379249d005d98ce33c2955475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c28491d4f5e8f31ba0d95e53d94b6201

SHA1
9a6faabab19147f3abe953c4f694bb39e027472f

SHA256
3de512e41fb9ae60b52214757567adb64aa7fc6ff6dddb7bd6938e49d3fb2347

SHA512
6a4d9643476dc30e1612bc647b4adb44f0cfa6a96d53b2622d832df5829b1fe9cc6f7761fc7c49fb31361d242f6c058e5e784f43fda981a1d1ee7aa9545fb9b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0495e5ae97c0091fccdac06dca19b3bb

SHA1
5ebf97b053286e11ae53a8b1f3bebf2c651820b0

SHA256
3461e33b8363ba2c0b475431f3c9e0887dbde12fff0dcd18ff665a35079e7e90

SHA512
e351922d81d1514cc3e7add7c98ca1301aff4ada04b5126a5713f62239843d0d7a31ab41a58c524d21feba5a9a3ed3ef9724838e17a7bae3baaba5a40e57ca6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95443502368738b0ec2b1316808fa8ce

SHA1
efe24d3771ea9ec88104aca3f6123e72f6766cfc

SHA256
2d3bdf5101d744aeaa454b82bff36eb23834e02c908df099ae797c1660fef4bc

SHA512
ce06e4281f6c7b674fa83d7c07e4f9ffd2ca296f3b869be2353f6570b6731a82e867b712734c7d2771ba2ede6127182033ae39a366ed2ff7c7077d8423bafc6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f44981f124d7e8a92e20e408575e4ca

SHA1
526f29f84f0f7a76bcbabe8b4916cd46d3d36f40

SHA256
1c5a0f8808e290be57f16593e76d04efe97e00b43a8ff172c87bf08e9e701040

SHA512
5487d1fd60767d900c06cfbd1dab75cc8b3e863ff0d937f7cf0af0a5734c46ec73c3b005a3653f51b9f54cfabde46155d7bb8a406e9d8154b8cd0bd886ddaed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d8bd463eaa75c641bce45e199a6fc1f

SHA1
935de1aeeeb8e385d96aa6f61c53620c9ef563c2

SHA256
f7368824e6328b71e3c50626d425b56363f939fbd8b51dbbb58cdb3664f6b087

SHA512
6484ad71a11302d15d4a259e50bec6ad37aac4f98df94a20ba46f5b0180e13f2812939322864d43d45f9e275a68155614d73a48f39579ea8652070a8845b6931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10da251fb6623e3009ad3269dac6f8a8

SHA1
8ff9b0234918046da9f6d5366c19eab4bbc0651c

SHA256
98f6716208c80372e1802f20a5bfa474ea8ac83c08e5dd5fdcdb31bde0268495

SHA512
2e93abea741a59530fd8ae3ba5ac89443d3424b32c2b68337a4905e9f75c0cee06c8179b7ef384fca18941a3f77c1da3e62631a90f3b808c2b8d4ce0e592b916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b12897f41f4fb781e4ce9b3b80c529ab

SHA1
c066652ce09e4f94cad6583734fd42edf9443cdf

SHA256
e9ea6bddb5a46ba8bce7601ddacb59e696ce6896deb7f9d2349d4c11329c27fc

SHA512
79c0f7303310f3d12ef7119117a48322d021beb0331870af8f04b497589b26d87a64eac21ede089fc077eec5d3b89df46cc31e3090aa0666a61d2bd5e593fbd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16994634964923e503589e0021472cf2

SHA1
2b6782729f13b255f1ea51f8de5b5ef52d6fe382

SHA256
7d5e372c4821274be3f045515536d6f58a69afe68f8793b8dfd77b02af21944b

SHA512
be57d0a3ce96a5b3a43ef3c95b534e908370fd2d0968cb83def3c3255a55d1a133a72b8a7f61ec7cfbb9a1e3b9d15266d7b6430b101eb47fb21f98f925573cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18d6adcf84b22c874be01e536b372d9b

SHA1
6bb003c51da63a9e686e7c76682ddce1ae0ee7a3

SHA256
6d37c7f54c8a123519e7128601d7be3dab6793019e99bea0ed87180131ca13af

SHA512
55457bc3ea1b0c0dc8ccebe87b6fd40e2585b999b3460ced76ff10720e1806fb6e3ae1290a9463e3495fa58e99ef34ec34e2c8d62fbdfa45fd36d704642fc455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1324f2c5d8a485892fb9846dd6cca85

SHA1
b6a5d41e4c41d028eb9bdfefbad6d3288213ff1d

SHA256
e19c072e65fc47d26d5459e1439ca695fa6896a4cf69dcf51ebf691267f8c80c

SHA512
b5429e02491b320359e65d8917607112f9edf47474f58b54611a52aa0369a11dcf69be61fa9983ba8431e9174508351edcefdad8493e61d1f2a7f3db51201ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef2c79148c1453cd2e23108cb0ffb001

SHA1
fdbecf3e8206df925812045808ef70a038d1db31

SHA256
ecc0c3ace226d867eb55ff871597022af4875b60f9481da56b44a1dc8d3c24f3

SHA512
b6d7c1a517faec47008449990d442d26961a66b5e6bf9b3d3feeda0f8f30211562be27c00107f3214cb8a6d008391aa55b84f56b2ccddb037f9a998dff71cbd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab652C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab65F9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar660D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit