7095249465068853b4fcb2d9cfa030e0daf363d1c0b169d4a975271571af08d8

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html
Size

213KB
MD5

2452a414d2c1d7c35420c8c0d75ab104
SHA1

da5fa99d80ee7aecdf86e4b57b9cf26365ed6187
SHA256

7095249465068853b4fcb2d9cfa030e0daf363d1c0b169d4a975271571af08d8
SHA512

f58d43a5e8240287eddbcff8791a4dd5ae82250327dbe20a8a90e711759fc0185d9c4830cdf90aac8e40a3189bdf289914ec1557ab8dead6a763f4a1610aa313
SSDEEP

3072:SfuPuDHYIY8yfkMY+BES09JXAnyrZalI+YQ:SfXohsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89784851-0D21-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421324184"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2168	2356	iexplore.exe	28
PID 2356 wrote to memory of 2168	2356	iexplore.exe	28
PID 2356 wrote to memory of 2168	2356	iexplore.exe	28
PID 2356 wrote to memory of 2168	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4118a083ef3eecb7b2ba4c7c37a0e959

SHA1
8c54035c17ae6997ce6cb7f0ea26fb9aaab4094b

SHA256
30a0b812083142a8af97b6e3bf77ce95eff173cbb632403e87160e98f4d38ce3

SHA512
392fb4d83920cc164e97c1ed34f8a83243c20edb8c80b7ab0ee65180f17cf1501e1c47d8aa650b0138b8005d4931051a2de9bce0b8f000c5173184b0c72935e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fda50425b205a2a777356641c7fee6c

SHA1
c17ae4ce00b6767108bbf4b0a3a9e8c1236c6770

SHA256
c2a52c0645af7f1c8fee64d571b8d853fcb0711e93638192eadae6510d6ce5cc

SHA512
d8543df7cbefce9c04719fb9cbe5a8add078f42d0b33ab7f9ce72608d2b3361816da309837876f763b436d69ede1a66ddf963016bc39602b82894c4390303fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e0dd6b7c873772aae1e8b834ba88703

SHA1
fdae8386b736e67a12cfbab32b3a561c8dd926e5

SHA256
da4accdd0f83e481a2596fa1e29c7a831ab6281b5d0a8d3c4ebae9e4b81691fc

SHA512
7d2e71b3e76925990115a44620bd11710d18f12f8bdfde3596a0045df5ee32d5689ffc85a675cc36b2f3de558079d9f4fedc7c081316b28aa23f6c7b115f0576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8997f63716e57fbc6a17467ddf9173ea

SHA1
254a191af24d5de8f399702dad50fd4dce64128f

SHA256
800245acc00b4eff99c1d85ea9998f1e2213b55196dc4e862b325c4e8e891eea

SHA512
e2b280e6467e9085173be5f62d1d1dd2c4e1fbdf4274ea672f40795e50423bde6c4ec08ad24f51c2328dbe2f9d41dd12039555faece5a4f83687a0e8bb58503e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8447edcf11fa87649e8710f6c76dd1af

SHA1
9fb2326787255e0195e19d3b7a90bf3060325f24

SHA256
859876ec60fc610dea98ba0702c031ba7e06b42f749fa5b700aa2bd7b970b954

SHA512
c242af12c24cea004323243fa1f9882efcfe49a5ad38ee156c9ede30baccd602c32f385b79ffc37ed8f1533fd8d3bbc4f248d73c9ce290fd1e5b5b4285c6d5b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22d6e55a0bd507eef91746c8480fdb6d

SHA1
bbfcc765d067190176684a51dcd86c15dd2a1d9b

SHA256
a9046c5c661096e732a92fe60e68d4db8f5be94746b2d0425b96aa17e061e69b

SHA512
c18c643665c452de25215b354c2e0c27b786b411aac74264c5376c98775ae4aab5f1c4ccb42405c2f9e9e90f5e3af14231f6805a55f342b573ae5700d6a9e4c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e43749b77e1beba90d7b99c7a60d37c3

SHA1
cb1ced2eea0ec46e38f9cf90a657e032eaa396c3

SHA256
1f19e2e8cf012eced01fff4f4a0aea484b942514ea08018b72024d4397eaa05a

SHA512
5657ff1300b3b88624c598bcc5a2fbd4d01526737f1fbec1134b0ad693e85175a2ae1d343f43c67d2a9321bf3ba7c2bfb409c457b429a00bb7c05f447484b33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f55556193b1007b59d790b4bbf2cb03

SHA1
d1212a459c572ce0b3299046347c3c2a9e6cca2c

SHA256
1490d7b0183f0448bdaff86390997d94ee6459f6e86364d78e8afc6216cbc08f

SHA512
adc4c0abb895d79398bea61a17c849531356e908188dc79cd845fa13a57e02a1970fba95fa02877a9b9dcacd3478ac2afbd690547cbfdfda698c2cb3a363b0c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8149b685b73b13bc44a991eb2e88da11

SHA1
b3a775b3eb2abe1a4607d2303cd276c697db1b7d

SHA256
b89c3be51dc546ea2bf1f40fd543e8d829a95fefdf123d7b1f3cb67f5ded4a5e

SHA512
5a83f3e0ff89262eed44963c3cb059ad9164578d8dd5386003614d34518258e0633e5bad9bf14d880f1e0d590b5bcd503b8ebcb96331397da5ee69ab18a8b735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
088bf825c5b32f838f0cb428e4bf5a8c

SHA1
a147f078e9d747a9b8bee0a7a13693980a6b5508

SHA256
0a20b435ad4c3b873cb6f93ef88db65325440ee5b84ba85bc97badd7766c4aed

SHA512
c7280cda86943d913f917350f032a44f8784f36bd9aab07b52d86a4469d7376b8c1696cff965acf4f7e1659fd0bddcc8c6e1df48a3d9de27fc83b5473428ca35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f2932f034538fb343f5a85dee7801e8

SHA1
aa6fa52738ab0a52b3795d0aad7793e545896884

SHA256
856134868c7e11ccba7ed1ac5edac92206889aa86ca2e4449c2b1f0adf8c2686

SHA512
d58863f596538db57d6deeed5872a9c635f311dd3ec406bd58da58b7bc747703cda50cc82c6af013c550e3c393af9c5c3d21f9805b23902891de939ef767a5bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05aaf4ba1935152f5e335e196d201227

SHA1
313d3556a99f131a945e323605d4b4268fde9711

SHA256
3bc5eaf30468642deabd0ba13443d97105a033efa4a6d99dda131c36c8adc801

SHA512
448ecffcf3564b406c0a8eef2c37beff540efb0643697007443bd4eea757cd84f8fe7205183c53bacc0a5c506c00b32fcd7e4cc5151afe42c7facc09e1c74f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
493c450456d81dd098c23609c4819dd7

SHA1
b0ffde357bec9ab80bbcb7699b31aba95d7ae5a7

SHA256
411bd435d8b1da27f73b78f1563162b29ada10df9b7dfb13515aba86512fb0c9

SHA512
b005680a7caca7cfae57afd0c19f9c64e8c1b963e9975c16b02b70929e013a4b90b8427e8e227b7cdea7efea84b6fd2dd7819f9e75e3ef387b86e4932d4f8a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5900cc9e1ad39003c4259dede7fe604

SHA1
c6a4f27f87b6cc21ba2d9c9c9a00b661417d19a2

SHA256
2917d982f25d70eba0717afca0210e27f4e9176eb9302689c49dc37f32a5ae16

SHA512
59698644cb7b060e9d90337da554afcd63e1a2a585a968fa88bc10b326537f6e08adbfd778ac86efe1cbbeec43f9c433fc766c1d826b518be604cc87153fc1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
786a32dba49dd02169b09a53b0cf2910

SHA1
24ff671f446a593b01d89b52d731429ccd68923b

SHA256
5f9422c3393e122ab0f575e988d375980c366c4885f778abf73438852240d792

SHA512
eef8226b66b7f992f8104259aeab39171af2fad5173889690dbc2ee37213a00b613821e413e6a1d39c29be792c44d37b0e0e70811922024d5305b58d9a335e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d43a14e6f3b08ad05516849debcf28fb

SHA1
33c78e95829898531eb7d165e788da3b3b4aa719

SHA256
4413be64890cd21fd2c04eac1aab7ff2db1508d2495b6d2b03e86dd04531864a

SHA512
2268d064b5b20420c44cc806d4610d43febdaa83a7314faadf31acf30b72d261735b74d78a945cd8a7577a362b2b036ac1e0889493548932066a7ce81f3078bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45c9d13925d4f76dbe9b00a6c3472f78

SHA1
ce608e47f8b8a95984057fd965107c676b72115f

SHA256
e400aafdba11a63fbace42c5fdf21438421c087d814c3166a0e481149a242ce5

SHA512
d4861fffad65e7c16931bd9e0655c24d023297e40c6a6e77c66cfe464c54b6614ade1d22a3ac1fd5e6ad3d5aa4584d43e72b3f025ed89d2aeabbdbfc03c48439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd501e8063562183100571807a63f834

SHA1
ba111bdb8cdf8876f3adae1b69f7d7965d1b4399

SHA256
70a29c9185c53a8252975d084ba613e6e6cf9a097ed4718ef0e900c7f9f09d33

SHA512
078771da3a55a64dbbda083af140b7a224f61e0891ba31c645e74104aa7a3e31bf624442fd8c644ea0654a3a2aeaae31a126698c0c6fb8d9b47de440b25c86b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E9A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F67.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F8B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit