2cfec7d5339aed4fcfe625aa7a2d186f3521f3a5d630f8894a7629caf2269c6f

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2668afbbde9f808ca8763cc17fdfeced_JaffaCakes118.html
Size

35KB
MD5

2668afbbde9f808ca8763cc17fdfeced
SHA1

cd883b2a685335596ff2b8f9ea6ed96a2ac48c5e
SHA256

2cfec7d5339aed4fcfe625aa7a2d186f3521f3a5d630f8894a7629caf2269c6f
SHA512

7bdd64cb004a6ca989c2bda6d1b15fb09ca58f78ea56886be954bdfafe0358e635942e6b7e64afe8503230c6e8be9c0f2c68436779eb3a00c6dbb4b7f52faf07
SSDEEP

768:UoPY5kJa0Jw8taj3MOulQBY+a92F99vB9f0xg9Lgc4uPl7mWt+PL6X:UoPY5kJa0Jw8taj3MOIQE9cxB6g54uPp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000256fce5824f06f065bde9590c18331241e17304b98e77f27459dd8f1e1769c05000000000e800000000200002000000067dabb8c73a55b0396f6222aae8feadf987b63d2496c4ffb48dbc9ec14ec5e9a2000000031902670fa22b678891840a70043ac072f541f410adb9aa4ab053b48e23e5bb2400000001c73801f364ed123d13cd7688b7689fe6aa5c406b3e1cb7be91e4d97c0c29f09cd94abef371a69e6088deaf5123b65e44593cdf7ea83b34ef3129a44d3f55d86	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421359158"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2D503F1-0D72-11EF-8962-7678A7DAE141} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b706db7fa1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d56f1b85e0ff6e6d9e465c8e43678ff1e5914bab2a341d9005c452058447adda000000000e800000000200002000000012732fa1686a1aaf700035afd2fbef0afe0c0e8c85bdbf0a38a42ccbe35f328090000000382621a7b950cb7d3deae4791ac95d75d42e1cb8e20cf163bef35d83e70ff2fd78e47636921317a76630b7a2a5b5a7623be6af89f35ad7e7ff3075ee68981a4b95427075af267cfa607da43a7bdc0afb45f38e730e6ed968ee0b06bd77f846c13a3db8fe61bd53cb085aab5390fef32bcf82c0cd6c752b1083c0e5f3772a24719683fe8b5cf83e42a838b9e9884217c640000000cfea4369904d7d149d50cd73cc60b57caba1566aa6ec45e01f82b95c70cf36b401b4bce06716bcc8bc82020a387a01bb18e991a67e95acf3ef52fb6dd1df9de3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2616	2556	iexplore.exe	28
PID 2556 wrote to memory of 2616	2556	iexplore.exe	28
PID 2556 wrote to memory of 2616	2556	iexplore.exe	28
PID 2556 wrote to memory of 2616	2556	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2668afbbde9f808ca8763cc17fdfeced_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
638e52a875f3265f5a665e2e9c67b75c

SHA1
0a9f5273b683e75719aaa91aaefc025074a74b6d

SHA256
6f2d9f5a816eb76c94df55e44014457ba27d8bdac320938dff9e3fa191550855

SHA512
a369380ce4077d497f09b1c5ac73b3f3bd4e86e46647237ade2210dfdffda72f7996973b6d72ddc78986fd868be39b8cea3ee45cfaf2ab038af5e6ba060a9d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
003b7db6c1dabc854a26c9093c621fea

SHA1
ffefdd27ba71e309e6e47973c89313e5ea4185ff

SHA256
0748d2ea93287df29ae2b9f3b1a075e022fbba2faa4e59e4c967649973a52a9a

SHA512
f6df7f1adb5da716742bf869e0b287acbc1bc6fdb22fea4c42668a6c0cb2c5a169a95ff9423f864ab85d3c1997c370a7e38412fb9a12256879d03a0080750d1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16344caee5dea851b52347385f30a609

SHA1
65dd4ffc43d8b062f66efd402a9d014dc4711a4f

SHA256
69ab866db797b6b07bc9110f84feaf0bf0347d879113a83b7cf5190f59fb4cbc

SHA512
025e203973eff62584385eef4454708f70ffeab75f503b178e963bc23efab72ceb851c4ecf6e57508a61f535dd927f0905645edd815ebf5f730dd2c7cc5f8e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57fb33253631ce0a1acf3ab11bc3a937

SHA1
756d94bd9e2f4bd8c669726af6b27c8fed1d04dd

SHA256
0ed6d169c8f99156da77c98b467b06279c07f138cc59eca44ade83a62e9caad0

SHA512
2bb84a3b7b4bb789e46c12d46c497d67bf3b49cedf66e8b4dbde0357bbf3b2e80df6cd945e7dc3dd2c74e4de9e7a9a04d4ef830ff12de246f48478c1f8047cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6746849335fc8a220006e6428e8333d2

SHA1
9d94dbf6b26d42122e082db37f6c41cebf86faf3

SHA256
c124e9021a5871a05f92e641d46956243bcafb041d8cf185ac58f4bd38488920

SHA512
f13bf5e73516cd66c23f226896f68da7ba74198daf110097e4b4d6f85166de14ec3742c6d184928dce71f786de4541960c9c6a97d6b11feebbb960ac4198a9c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
903fad2dbd55fe09002685b6aed662b0

SHA1
d46945b989fa27bf2460dec878742b898e9f641b

SHA256
64a3553c4f43408b93835db8afec1c572a7d33deff1094179d357eea58343aec

SHA512
c38cbce86c5a83b4d05931c1499f02ceaf270a4cf731a2df34658853d12a2381cde9b14f6ddb537dd9fa0df92e70c169b1db9a439228ad50631bdfcb6669e292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36557a454af6a215b20cda8e2658bc83

SHA1
b47abc8fde9c74e83cf9214a8f3174c558434950

SHA256
cc2bf7373db4ce9f833062e72bb7dfb0ca12f1b3ebfaf7ff877e62c030bd49ca

SHA512
fe9e7dfe2a2811c9e2d73a6a4e76aee3d65f988bd0c37fcbf1305b6da89d6516be8fb380f7b1d9ee936de80846e68ae981d368fd48ae32cd1d2dc6d393b6f826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a06eb688c0c84339c8da93c28136f7e

SHA1
965eefb237e949b84d49e11ab3195660fe8891a0

SHA256
55423d3f73e10c271ad2d0eba349bed2845f9ad9aa12ae97113d5692ab48a815

SHA512
82cce1d7d73202fa6b4c40d6b651307c903b402f7dc99407b65c12fb572db3dff1f8813c7244becee80924895bdb0b032a56dfc9f145af797f9e1012e8ea8229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
224f667397d3b4eefb3352cfa9e0ed78

SHA1
2587d1bc6edf23db83a96136d1871aa6731177ad

SHA256
294aaab377b27e7f07e4ae86d60fba4f36c25461badd34a52c50e47c4d24eb2b

SHA512
0eabf92f0ed89efd27f2e829732515b9ab496838fa3a4786c212402f32f5a6927b09f8f18de951c41e5a5cf97b4257e089fb7791420f5571bf0d5896344ea7d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83ee1be4dd4c8b416727e86031880139

SHA1
149dac72a857ce5d367fa76ea8d0762792693a77

SHA256
208110c26e5d2e32c3fbe08363adb76f4fe41c0b99592f11ccad858422cc530b

SHA512
bd868af0a9a74162bed98d38d8a74a227b2d95fe7a5522bd062f268c68bd4d95c4b87a7c022929e312797cf27525aa0069a591b24d29a4c37acc3b58f7222b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7a434a2fa67381c5ac0fd4129ded6ed

SHA1
8ca44e887427ee440936fc7ffd23ee509f994161

SHA256
634226a83ca03407b1ca215e3cb86398f656d90bb8a297055b3ae33718f5ad9a

SHA512
452bb9c35abd824baa670aa12c215b8a76f657c71a1342d009a295ed973365393b481faec2d4647ab1714e29bfb29e82a40d23d3586aa18748b945f318b44491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4658e5f9e654635fa4ee64767906a1ab

SHA1
2c183f4eaf77cf1150cc3fd4a52e63581ab49412

SHA256
34e0ef3fe4e91ad0f9536439b95f095f1c579a0183e1f3efb5bb89854fb67dd3

SHA512
e292389d614b875b53d9ebc1482963370619f9cac51aa20b3ada58e6c87c7f30fbaff9697fd9b127c3bff085a15cb0d75c01e9ea1eb8943daa06f301e47c0e2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86a4b914a62351518f1df7b9705c883e

SHA1
7efdf06beb91b1274e44ab1f4bcc23b24d91d807

SHA256
242b5227f86f18236efc67e08ca91644775b2bd253d7abe2f1cea5d94e065802

SHA512
e75c6be00ab75a49ba38da5b93818427cca19aeac240d4dca4ccf3dd7bf8741bd5c1f0458597bdefa6f6b3a9393eea4db2edba94d59b49fdfcb4664c0fab9dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bac0284241bb8b4fe6044c16af48b944

SHA1
93dbb6b4a16afcad2e0defbcf5c9f1a6ac56ad35

SHA256
a1ff7fa291ff3a7852f54ba36650fdb0908f8d455067bd155ae1036e1eebe354

SHA512
97c551d076307d051b8217d140f7816617ef748d4bfbaf43d7c90943f02acc0b15e8f9fbb5878d53f951f6225908bb932f7ec43008010d3af9c2244e1a494e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4f23a49279d0bf8b26c17321737ed64

SHA1
09ef60efde90dc0c4a0d2e1b01c90deb1880abab

SHA256
41de2920dc5d10b115159eef7445fe3cd2a61c5d8ee078b93ba6a7cd655b9dfa

SHA512
6ce428f55135485d4ba8ff2067c296f046d2a73c30061aa0d29affec5dd8103b0050b1706e6c52cbf9a76ca1b29f5eda6180f8c2c98863a8544eacf0b9e45e52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6a70ff05a8793874764ce56e16eef77

SHA1
5881ea42590511ca0460b5b7188aed818e6a5b2c

SHA256
839c955d2581e712d71c76e4fbf3bb1cbd37e7ed9067ced027021dfba5f61755

SHA512
54aa9a04319e07321ccb73fd4daffdb90e174757158892ef768ec7ea4d6eb3f501374d9ecead1aa92415971a514d3ef921fb823d986c748563b88a4c0c9a711c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\js[1].js

Filesize
46B

MD5
ac946a4835a75bc54fcfe718c372176e

SHA1
6d1ac65e9393d5b8652d22dd72ae1d2752a4abf8

SHA256
d731edc8bfb413bb22baf7f0f1bc42ccc2990b7b15b148b5a6bc8b45d29d34e5

SHA512
58820c7f223036cd1e8a6837f1b2b4fb9330944730e5127ea0035fc8bb554240bd3e7835c0509fdd0f8c6cf84373f4fe8a36f242953a42dec9a81105d2133d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE9F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBEB1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit