df82f4bdcd2ebced27efeed5260f7a9935fa22d175c7824f51c238c3c926fd32

Analysis

max time kernel
132s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26cd15e4942da9de17a22b3b6ae67ed0_JaffaCakes118.html
Size

23KB
MD5

26cd15e4942da9de17a22b3b6ae67ed0
SHA1

c5a60d2c7123b5a3aa25b2f75201322a5b1fffff
SHA256

df82f4bdcd2ebced27efeed5260f7a9935fa22d175c7824f51c238c3c926fd32
SHA512

e4abb01856d804d48207688c664128dfd777b4175cad0bdce1126add69f29d372ab6d6df2aaca669e059b812a840cb1330f11d60a989576f529521157dfa2b5b
SSDEEP

192:uwPeb5nounQjxn5Q/vnQieuNnFnQOkEnt1NnQTbnRnQVGLnLnQtgqMBOqnYnQ7th:nQ/bGRoc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000bcdd0bb33aec316fd801c6ec179c5733b691aec5cb82865d3c38af541bc77379000000000e8000000002000020000000b6ebca4561f0573323a349d39c2b2695fd5c066ec69db81416c86362e15d8ba920000000ea61d53ebbbb174499d9415462aaa77c43ca0de9a80cfe84e99f9d88455ba40640000000abdef73676071925870056c8b65cd40c1424861a0219f49fa68994c1b689aa8b38576c89efe1f018239227cffc1768d0bc8d6c4a4181fef8dddb9593ba07fa6b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421365224"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000720d7da4b7cc45daadaba2a46016c9b775f01811b6629040fcceed343f01cf90000000000e800000000200002000000050f59207f11803ab249d54f56bd29a260f16ee18fe7fc65f68f018f031801aea900000008e2e5f0dca862f37303d8bda32aa08d0279573c071f53e60819b77110aab3be1b4116fd8418f3b76162f79d4abebf99b52467cdc476b64ef8b5614ecbe06b374783a51e5c9d2bb6de414675e5ab7c077edf365e99a4ff7c27f71b27cb0fa12599de106923643d3aaaf51badec0f390444a6b58c020999e6f8c2908b1df3d7a6df6de44d720710c21ad794f5029986b0e40000000753872ff126e06da04ef06034ee9dbc4a685b176398956ff07dcf75db519076db8283f5237170c2b2131c46465a76c79e5a562f713965f838f116159d77cc66b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17CB1471-0D81-11EF-B3A2-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904038f08da1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2576	iexplore.exe
2576	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2444	2576	iexplore.exe	28
PID 2576 wrote to memory of 2444	2576	iexplore.exe	28
PID 2576 wrote to memory of 2444	2576	iexplore.exe	28
PID 2576 wrote to memory of 2444	2576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26cd15e4942da9de17a22b3b6ae67ed0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba326c3109f0066177e4bdc3e04d289e

SHA1
aa2a2a9b3c9e32bb8ddfc4f4c9019e00300f52b9

SHA256
e2c2f568aabeef18296403d213d17cca61beda3642b64f6ef4e2b5bfeb8f642c

SHA512
4d60f3dccb093f9b8056cb979e3dfabef7ea33e75b7fde640cab67a40598b3b44165f1197f87d6fcfa65520ebf965568b0ffccd4b13bdcba0047fa5ecd9c46f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4a3ed99d17dd0e4633fbe2335b73b3e

SHA1
6858c06c6ab2db3d0b5f8c5270259fffeb8458e5

SHA256
495ca1f0bbcd3fc8010b61761afd7d157e1924e6df3111ff405ea505fc07f55a

SHA512
139b9777f36ecd514e6d097e6e59244d82e3b76594a829ba6595c14bc35d999d22ba5fc4b0d6a0460d359d83e75a574c532aa5ccb0bc51832d3501dcd01c389b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dff43b1d0664919e02f18a5d6fe19db

SHA1
d113fdb7c66d662c0653e13175b145ac79b90727

SHA256
58f8c50d1e0a640232e9e8e075567a4b52ab1353f418fac0f0d169149520fc12

SHA512
6e061f794f35928e5d24c905703884ece54d6e77b0f6a8dfa0bf899c06bec0febf0eea30a07f52bceb35c7c2673238ffcd9d4a69a5741bff3590e4b3ea91cfc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4a4ca419bc9742118d91aba6a8d008f

SHA1
7b5a518882174a3f29dd099bfd9d396e5b71215e

SHA256
028ec8a77824958de5860b50070c9b5d8783b08fd3dc7d9fcec8f195a3a1c00f

SHA512
e10082602cf6fe366051eeeb27f8a1bea46effee784948543592eb771b19c780372b94b9b8e4f4ac092ac5240cda75a20eefff2638715d0c2918e867ab216976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0ba27134b4feb8948d1bbee2f32d96f

SHA1
ed5c11b016c666ec781bb30ae81557890d55b082

SHA256
3b990042aeace78c10db486153ffa40f5d4a1c934d22f15d6fdf6d0ce0cd5f0f

SHA512
36f627c7e6df9f621e6d0ab85a313424866c8c0a1815fa14e1b2763be20a9fb96fcc88db321d4320318e386015e97bfe0e6b3cdc82de8d27bd9e2c32aaa4728e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eddba43c5bb705dc415729e0176b484

SHA1
acb6833a655a21acfe9c6b0aaa2e2ea0ba367c8b

SHA256
879659b5a9c5aa692723b71e9631a07cd9ccd86900b7aca0bd2f573851dab92e

SHA512
35b9c8ed98f267f5aaaf7df376bbc2714ec2f45ec7a99522e642c959c45455ec6d6ce4c4af342f3936558530040143f669da7b38a7a1de30a2d371a24960026e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c7e9a3adf8f356ad4d63ba508da28cb

SHA1
1d7234768484d82373de0540f736372bb24be14a

SHA256
eb3b8911f662cf948f0f29bd0d859471e1b2f82d945cc93254897dd42a5b6f67

SHA512
c74036fad26ecdf511638779b3052d9ce10fcf528851622cad951b71debdc24931526d32d1b11bec16a3a973ec21a3058a33a6c00c26ae90905c2fd0c4847bfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d2beb161cbd6c5e6aa9f8dd804da42e

SHA1
15da84ced206fc643d5c4b9f02dfe882bf5eff33

SHA256
55bdbab31eb313a8ed7cf28e67e6cde86296088b18204aa0a761c1c5210d4c0d

SHA512
e73a4d0b0656f5777f8f3ced6894f7bdc3bf29fb9d52fea5e446ae73505a60d1f947c0d8133e4c6048a86ba2223389f0695693154c3df1653189e5557c455cf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3046661310f5b02cdcd9d716f600f2e2

SHA1
81c7dc8333a1fae866ec05333fdba3808adc6ad3

SHA256
7792eaa8518cf28082163639b67228c1e837117e26519daa8d48fa0b85f5a560

SHA512
29354693ae2ce71906ee755c742c573fb27deb774692c1ea2be861ce47c689b9d91e50442e61eeff5522a3cc0e4fa2431c412b870b68e78f54ce0670cd50c8c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d8c52afb7847370b1fb22c107419a51

SHA1
920b9b19011eecd8efb84d4b979ad1f926985974

SHA256
58528e838cf1cd3cfb7daa5558561be8f8c3c7728e794405aaa8cbc2ada25bbf

SHA512
89d10098e16ebe66fec12400fadfb3ce0eca9d44d4b5f022555dc7edcbb1cb6c55a2b64f4e6bca09862933b3956c4c420ba2c7e8fc23ab3a8d1832d2463e8331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b39df7b5d34a84e63606c1b88bdac9e

SHA1
c0d75090c2a173a7c4a4cdf921560cd818822177

SHA256
0b6dbe12716cf7065c4c60a3299dd7ed2b13c75ac8e309732e0895b1e2aa7324

SHA512
7990107e892a1ec7d74c5ab5af219a14650fa56a2d12e1831c402dee57a28eed9b75ef8a0477d50823d68e58b333363a9056b7bab03008b16dcd837948b14f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c56f14193ce228c81d5104e5b6ee53a

SHA1
3123886b414ea674c4eb6c9007312b2a4a0d64f6

SHA256
fcd31461b0b6b8d97cae6a88367a28b79d22bc9065f6efbb4d91cf928715a054

SHA512
f3fb3a49ef20ea12e9e448762a059d23d4dffe87ce4192dc6be9254035ac936c40f1db0fa732c4abd0654a0255e7690bff67f79904a6b8aafcf32fcb4674910a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bae62b0c32d20650e015bcf0fbf801a

SHA1
2e87fd5cf47522588fa87a0f82d0d55ebd5c67af

SHA256
41b1743df09cfb7422a47e15e7e94c5fb9c80bcf6b0282476fb157a720d38ca6

SHA512
3bf3b2537f119266dcaf51b5953d1b666a74da3a55e7922c14888fd4b080ee3e137ae03c04bc33809c2feaea2a9b0cbd790cc7eb0bfd24c95d3e249f5fd5f81f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f1a06556116bf29eaafac7c5677f27f

SHA1
30b263ca3310213eb269b3252b8d62d7104a02e8

SHA256
d9b28808fcd7ee918906608398ebecb491931f5d9f460b342bb390124d4c995f

SHA512
1cc3dc10f17a5e4ad30c6f33ed98a594bd2ebcc5a05a8ff57e610cc4b6ad8403f06b46aeda190eeec88a3ea4cdb0d220fa1853b35d193fec93f5af299dac19c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AE6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CB0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit