d5d6d7aa445b77951e1cd91ff605b36ded27eb7464f64680e768bc1d890bcca5

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2408dd89667b4961dde5bbf192d59921_JaffaCakes118.html
Size

39KB
MD5

2408dd89667b4961dde5bbf192d59921
SHA1

71648f4121943a869485cfc56f193a2867ce38d5
SHA256

d5d6d7aa445b77951e1cd91ff605b36ded27eb7464f64680e768bc1d890bcca5
SHA512

fb46426cb94bbcfca30fdf6917317d35e801202190e6ad35e2447e77feae28e6f81b708709ea1af82af94b85c1eb56878f14419ff23c34cf16cc77cb5e4b40ee
SSDEEP

384:DuKxH6q1d3095t1pr0sQuGkPYq1+1Y46k2S:SKxH6qzk95tRPYvN6vS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421319183"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4A29021-0D15-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2136	2844	iexplore.exe	28
PID 2844 wrote to memory of 2136	2844	iexplore.exe	28
PID 2844 wrote to memory of 2136	2844	iexplore.exe	28
PID 2844 wrote to memory of 2136	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2408dd89667b4961dde5bbf192d59921_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ef003632c2d4f239c8cfda8d20fac44e

SHA1
f126c5be8d7d28b5f4b64d01cef24538bb53da9f

SHA256
a0731aa95c575c2978d7cec2c969ee55677521301400e7b12a3aedb59a471b6e

SHA512
9dee158b9a27c13d2191ede8d25bc239090c1c147b16020e547a32027098445be23bc99eebdfad8e14143a71054334d9cdf2c6ee15c389fb9062a95ba3efac07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7e39dce6894e7d13cd98e9c487edc0a9

SHA1
2bb9e518c81ba332fb47276b18e8baf0fc6dd014

SHA256
44f69c7060da5557faf0cddcbe104cd0f9cab20dd543c489fd011b87303ed56d

SHA512
e8228ba3da3c104eb6170e58ed87124062d824d8a1092555fec790faf0ad8145a208ba772603811ac93468e4f624b2cac32e077c4f652aa264e59e8711de2d55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
255dba7990e9ab67205165594a14848a

SHA1
a3a46f0ff290059df4cf79ba858bedbc55daadec

SHA256
8683a71cbe809c08e268fbf6a2d7fc61b3d59782672331f5c2777cfe3ba365a7

SHA512
87f8a793aadda3cb092b5783f473c5ed9cdc6155e01cd05a3bbb58afae0333e8cdbfb1d525dd6c374df603181bcfe22a6c6550e87873544f3f984b90bee81fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
95b8c765cd1599a6c67ea4808473b0ef

SHA1
fa1ab9c057c121801622b77d20107479c1f2a8b3

SHA256
c613cbbd0f2b0eee4cc7431b2b4520cb29e62f1275655802d535363e3dab162f

SHA512
434959c3e3ac259350cc14b6679e49de7808190a365096a24b4dfa79afd56521e77cc4967ec1113707513dfa10cee1fa970ba8c3821abc23de52fc07bb8091bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c554d2dd89c7d84413495708e401e226

SHA1
a9d04574949f5215a035a5daff751c999b923acc

SHA256
6f4819f5116085a94d4cc4335fbb3170a4805d2e862d098f04d0ed08f7d12981

SHA512
dc366def1582695c615d295f6dfd3a365652308b71c9a1635fd1b508d0a824d4ba0e76b6320123f28e4fa7c16e0846676d981eebf9931eb4a14c064b4c61b205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ee5b76c4d86f8f7cb90cde8540354ec9

SHA1
0d4a71cbe2cd0fd678ebdfaa34a59f4dd612bbeb

SHA256
c0404d39f8353599093c4d21a0e33c49e59d6f0184b2ef7ca3dcbbcae1d7d476

SHA512
12747561b8af48134e0e4e87629532a22b953a6c2d37448c62b0d509a2f031bc512b6ffd654d1239a78414a6a155592133f53b6f2bce6393fdecccb0b3bb8c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ff26121b31045f2e113cb92d840eeb61

SHA1
023214de8a5db539124d0d15ab87f34dd5fe0cab

SHA256
5cfa047602b13177f7b60835ac1bb6438dc566b7575a704cfbf56bf3a0dc8003

SHA512
7f64938a5056fc98b79b16bd31b737e120a243b49ca91a32a8d1773016fd1d2cef6564fc0213eaa57e6079a9e5624de37b08cd591da5571734f6b6a54ba69c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
328f31688df5500a2d9df8df9dca6282

SHA1
cb0cde0c045b616c325a6c1e9d207527583fb1a1

SHA256
a0cdc24c2faee8eea2c4b3689bde83dad0242268d5b64b98b433eb2c2cf6706d

SHA512
d2c7195ed21932d2a9f02649d4f7ec00204d15a62217e44ea97632bc60f51220edda14f06460f74f94a1a53bff2e2efba3d0bf66ca9df6293eda8d88a1f33d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f3924799d35d55543a66e2f7df1d10f1

SHA1
8dc13f040c263d053e3d7c7e53c291f07c8f0639

SHA256
44fe3841c1ca9885335f4b1550bfab150e43285422e8a8771cc40134ff377046

SHA512
a52fd7290de6dcf4ad9882a681d5b86f3dd84f009e6fce0881cf3bb9843e6bd93f1b291ceafb5dde45b501df7e585c3cb2ef3a9646b1e0059e909d7f5253627e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c5fe03724e11a3c99784fd8b5ff7c94c

SHA1
396a5e1a99272e06d2ee41c535bf895c204c92cd

SHA256
99cd68dec6d56302bf6fafa187e04a8a743480e852f4b6c847fd82b4b9cf819e

SHA512
1f9e2caa945510d0d226e0ae07a50fd9bc8125bdfa22c561164873b02c61dfe3e32444c30526f30a48daaf5e0da510dac95f8843c476f4bff7749bf287b6c725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
05531f3c7307d4767708e8d002aed919

SHA1
da955745bdab2d0d8cb4d146edaa8eefef7aa01f

SHA256
4235ce32c677e2bb39b6c82ca17de378eb1854a9b583342b3f1bcefeead4b0e2

SHA512
93c92f23e8be18281ae8a677db67dfae5955c8af2fd660ecb1e632ab50fd36047029bf8088d595a1183ab18dcbd6063554a12739ccad9dbfffe9fe5ebc9003b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6e9b608793eb8eca20f24fc856894670

SHA1
74316d2d25be561812bb939e97ac1899fd1c57a3

SHA256
45159cc74416f0acded36afe05178921a0a5e78a704c290e4118c64854907522

SHA512
553d778ffe6af7c0ee10203bfe5f418a2e7300b99abdf4af5be41295949e8704071f6b419f595c00005e6d372a6989ece8f4cfa1d9a1c6010914e6df79b7b8d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d7e4114dded80e2e346df448a77fc837

SHA1
a8d0e89883188764d01364385cb57150aab1ff26

SHA256
086109c17f6f72f3c432e9517a2526767355b4fedc706458a611a9a516c247c5

SHA512
84b2033e8cc938ade4970a85e613c6e2ba7a09c9c2b929b52a47bfe5ab70188040b04fb467dca014ed447bcdd08fe7e09e2834d13707f5734f3e8ce0c9487b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c9a1ac940b8dc86e8fde04b47d548bd3

SHA1
d0ea53241d5cbca2f5be9a54b37c8125fec51a7b

SHA256
b7e1ae083003ccfdaf11e5df27e65d002a148eaa783eceaa220539d4e7372717

SHA512
5cdbde2034123d74a55ba7ba9349195b9cb5ac77ff376d7d68c99df99eb4edd09e4ed3be89f7c51875c634fa18970ffffc2a45b41cc10d30c1d1cd7423eddfd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1950b5dd2fd30d7aa965b0943330e242

SHA1
1f56d528d39d9381b1cbc565659147e99849eedc

SHA256
741c00f0ea86b161ffad706d87e34f01743a5c8cefd19809b5208da48595ec36

SHA512
416ececf2ac9d84ea315a37e37f0bc4d264ff45d348fc4f8c8e7e7a6040f653c5363cb4d3d3e10d246d71e57270fe2895ebe5f62df24384bbdd10b8d95f38bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0a8e4e0a5e74473a80103488c5612816

SHA1
5f145987ea3aacea3fd10737bdf5f582ae86eae4

SHA256
aee3bb6fb53174ce4be781ee624c6546fbe96e4cf5203878f8f10c16ba2e9c67

SHA512
9baf7d8d8232ca491cb54048329f8f2866893208bd14c9e721f68f13bcdd9a26c955da97b2be50b3c26aeb6527719cbf287873533749ab1edf322f430d05caae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
39c793cd0998b1eecd008f52859383f2

SHA1
539d089d575d3f89603327fe1a1c9c6867dec5c8

SHA256
4f1067a15b730675c8e3f4372718598940dfdfaa5b6c7d8a8d2017bc2b582103

SHA512
291dcc3cefeda32e572bfc5586bd14f0cf120884a80047ce7b4b830f4a8efda19c0a3ab6ee48ff498b36b6d221136e0516d92aa0c0a4534ac5794c1ff6aa1b45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bdb5d90b18b9c5bbd2f56ee7b9fa7841

SHA1
0ec58f397c203ab858140bb5f21ba7a03f2626a5

SHA256
5b3d97075f226d621fc1bee79e6cd16518c67dfb3f7e9eb39a33cf667e85c2f7

SHA512
e74329e7f8f2494d5eaa6bab3f9cf172cf74a6da12d209797b10fbeba709aa7a4b59ab0eacab8e39a92f3ef985b4a10cb35ff7fb796ffda98f82650a23966d47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
515505244c618ceabcf6bb557af34ef9

SHA1
a2d57482f820b78e2373e5a52fb557ee85a92f6a

SHA256
904dd2af0c2e4bb17611e14a2fcb7b0910caa59197233315032951f702b07029

SHA512
593162fc178f51a96ead35d2b851e6731e94bd05a90d1664bf1dfc6e3e2ce562786629ba4f9ff83365173b3444ebf722137b68b1470c364bfe566d01621d44a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
21b551814fb2a116766225367683b7e2

SHA1
78a0d7e0cf887b3818ce5da502c45d69db810b7a

SHA256
2e118a9f447c2eb0a412a959f52cebe33bb44fe9a4105c868f3842035dbd83de

SHA512
7c811bb426bf78b6735e094aeb63d6d06e35a5f7c3891ac48cdca81ea65439a3a2099c564d6525cf40df79fe9701719505ed7d386e17cbee23f54fe9ef7dbe96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F51.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit