81d528d58c62423ff96dfc0a43ccc087d561ae33b8fffb3ccb776c626ca7415d

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26a6a9f9090a1cffba8e9454742ce067_JaffaCakes118.html
Size

7KB
MD5

26a6a9f9090a1cffba8e9454742ce067
SHA1

87c4e4ee268c6b2a5607e5f9c9e9fabd51e340de
SHA256

81d528d58c62423ff96dfc0a43ccc087d561ae33b8fffb3ccb776c626ca7415d
SHA512

1a866d3b1a762f875e65f6900a9d16360a9e4b1fe6c9a222c7c31874d305f77126690737d36ff3057863cb8e1a70acaeb27a06b0000eb3120644ee8178343764
SSDEEP

192:9B9fo8tgbW2ZWEMJNj8wqoXUOnjqJUXs0:9B9fnr2ZajnXa0s0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000bcfebaf737dedc6c0a1a051e6d906c11a10d2fac41f8456ec44155a368b29eb2000000000e800000000200002000000061e3ff42d5bf8145f19f1e6725f8fdb30e2e86fbb91a50b85f0acc43c450523d200000008127b49aa62f03382fac8bc972f2a55033c307aa57eb7136e345fca3ff7cf4df40000000315a9debd3a4c45285d5c9e2105821580c71f7927b3188dbe5bb514fbd2780d3550b8b00fba8080f8a9f4edf1e89ab5cfa1c91e2f7dd2773bc1338ae30ddd8a8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6097f38188a1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421362903"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000d12456d33779c93557c946420adb0a950c44d6bd3a54ce5a37a034e71a3adc48000000000e8000000002000020000000506ff3bb7577a42d6ee24c64a147bf126fa1cf65c854994ddbfa537c01a7ec3390000000008d629a39522fc7042f9c48d7af12b384a72c1ff8e9adebffd5bb69f19c8ef67f110d8a040b8baea3332973e6cfbfbec67261e0d6f99b9da36664575b6a47f3905538287d0911a04a68476a2b4e2453b9e8721f5f930f3197e83cd3b805125714b90264e9862224a44522b6c3b94c696e65e379ac6098ca7a75f458ea7a1d641484ce67215703c216400d4de80d444c40000000ac4792f505f38dfc65fc2787039e45155b9c0bc45de81b360b1208f5f55cc0c95cd00dcbb29689460a5b4530f28a98a31237b8371bb8fc3320d5b6a371b9ca67	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD656A91-0D7B-11EF-9034-729E5AF85804} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 3052	2032	iexplore.exe	28
PID 2032 wrote to memory of 3052	2032	iexplore.exe	28
PID 2032 wrote to memory of 3052	2032	iexplore.exe	28
PID 2032 wrote to memory of 3052	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26a6a9f9090a1cffba8e9454742ce067_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beea73b3d7a4b93d5392cb0b884a8516

SHA1
4476c7d15637045aedcbe0739239a9c077278960

SHA256
7b4e26746537f71f8d1f17c6a4f15a9fadf0d13f01c837314410bf44c412036a

SHA512
b4fcb3eeeecdb49559f02e706b047ef9166f10200af513e172f5e937b1186dc2b41d75b666054d8589771894decc1c532e40070f085c1bfb95d26356aab75169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32a3b9a39c603e3249cb7c0cadf736bf

SHA1
402f25dfea074d2878fa5e27e3f5ad0732c21fdc

SHA256
f9d492899d19a2b7c42f664650ebe9dd885dd5f652e2295e89f98adb1f2631be

SHA512
7553330c2dfb9174f0701cb407546d2c3abf35be785c317e1f252fcb9ba612d3f81f0f6dfb6913472fc10db2d036a0660bb2cac7c9b1d503f48552d36194d154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17814064f42df1fab1d7b13a3dfe427c

SHA1
53a2861efa553065f574f8db57f7ee3719862dd3

SHA256
39cbc67f67064ccf608e92bc80433da666f99242946c11ec9f2a16c73b20fa6b

SHA512
a12b3c0d650c1f2747708a75626a93b538abccb1ad4a7b13f5031dfd45c16024eb1cc8148bf3baaf9cad9128150f7b31a969901d46ba4dc808d5ca2c088e2dcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b01af688cc044ba4d7853ee606b262b9

SHA1
8d880deea9250be85dd96c21ae618043b01b38e0

SHA256
a831f2d3a732da9af26cf1cddf4209c7ccecf6076c748f7fc26fe8445b80491e

SHA512
555699d8d2dc5d700c65aef4d8e2158363c1fc7ec860ad4432f896421ccfe264cf21bb5386fd0127ae1bd9e9693c74db525380c0a9e9ac2ab8a593e0b3b7839b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6d71c10b6bf11dd608ba47117eed089

SHA1
d602599135324e29bbe24a6f4aaf8921795638d9

SHA256
0a2616730929584e0c577995c0447bd7921c15ea9fab18f16103ea1b1ced33d2

SHA512
81b88d5938bff99128dd1b3b72a70458268950e151c20044c12fd04b3b970ab630c6849c0b941ae88540753af697240856f348860a66a2f20649d724c4d1f347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
349813b9cdb1b9e7b6b02e3776d08dc2

SHA1
eed91f632d436527e18f4b51f2700d251d144f75

SHA256
1b8ac9d8751500fb4cb1efa0f26baa09007d686308ffc48295d615dd1264dc67

SHA512
e14b8297431daacee644406ca71e4b3fcf6a8851aa15192056015414e7f7301f7715e645865fb6a229f347ca9ae90af5a4d42549223c01b4d565cdf36e37a930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad18b3b25450efc4baf2b83e26b08e52

SHA1
402dd33c572eb8bc4fc6dd558a1e0653ee4ba143

SHA256
a1f5cee33bc71798eb232bb428f3e08f9d16cc5313d46b645ced0645b45345a5

SHA512
d22b6c595d243f4c2197fe259d964fce9293203d0a10bd578daa305191eb46c0c44ab32e5e49a011b6b68bb6488686deb574d821e7cf5c5808af2285edf47714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e84adf3ce5dce974d47361b272fcc1b

SHA1
efca52094e8c21a3b13348bb3c1e3d48ed83e371

SHA256
582d9e4e91f876ac5be1d35d189e28f9dd38483e4168a5f40e2c1c9a1532dc61

SHA512
e676a63025caca45e367bf32283bd2ee3dddf8b468d64f606bae7f371d83632cbe6735a41b411a67ccdc9c0496acb49fd72299c311a6c506c982c57eff61b1ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68478208be5dca412e49442b42e6e8cb

SHA1
a4acbf3a705c00693f8f2d50579989cb384b380e

SHA256
6455d0076d48518bd5ba44bc02441f5d5c9986deecffa8229d3e11f28e8a0193

SHA512
a4ffe2b0184d4e31300b7741714c153493fa82925b8d7a1621da36934d5478e730b2c1874870ddf2e2b64d1a4e54c6dc49b7342da49a406427734c44c99bf798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54924c64b77f6dc35a28d5c41b683756

SHA1
5d4ae6b5533043993fd5d7e0843e236fbc8da2d6

SHA256
134b2c3d215e1229657e1b2a18068829a2e38c5535420d8681746aa077c5f095

SHA512
a4bd08b28f91d515735447a977d026dd4313b2ab8783f762c13669bfadc6de093b3e7ca02964ebb7e6cb2bea6cdbd11eae56fa0cd668ed697d77d042ab528405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82b72b46fcf2a7bed1261fef8ec200e4

SHA1
ae24aa9e0ab3a9594d9fc8cfec0fa3e0d3070d9d

SHA256
9d2f1f0a0a09cc204d326f1483cd1eb39509277151299990e690518c010d53eb

SHA512
800d7e38982c83d869560150343f6f65e481305084d04c61153ac07dae002fdc1b00ee2042d80308e61a9e3bde1fb9e19fcdabe3c3838b94d63c55ab19239538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b762b6ebb4f88f4751917967a263db1f

SHA1
2fb0096b1fe27215cf68210dcc7385c75b8f6b5f

SHA256
96a7fc3b9638743611c521247fb279c20c59218f251f7f587332cb2b6c860277

SHA512
5f2489b7637fa5842cbd1e448d8a19cf29192822faa73b2f89aee4fdabf23a4bd6f8fa9546154313ac1009780c32c17736ae817a67d44f2a99de90a0c16a5586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30f26aa3fb32b655dc09dcad73fc1385

SHA1
16a5e83817833b75d343b4486aa9ab00a92ba6c6

SHA256
c86d7c13d8f897eb329fef32f3f720a5eb4ee3d9d0ffefd6f41a27aff74df375

SHA512
0bdcebd34291d9c9b847fb15625d03b8ca937111861e04f3696d3e5ef630315728b9704b6849313a4b1ee85485422b464497f2da6fa671d05795fb4dabdbf4e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3668276a05d03867ef6af680865adcc

SHA1
6aa385895dc3f701fdc90c22903c1d0ebd2158a0

SHA256
cef443d7ad8d9d4e28fe6c13d6e2530544e1da1d04a3ff38c7dedf894a648990

SHA512
b84a216ddc219bca4f7269f7aadc724bb262f89b2478855eaf1fd6c129d9a17d58d6a5bd090241e37c8a69be533972930d2e45a7a3d4261437054f6d8cf70afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a023ff5939aa5278eca8a1bf60e8fb

SHA1
4ab73a41a5819270fed1a8c471245012aa57bb4a

SHA256
82b02a7b0ac5bb114575e40671630357712b3c8d1b62a5089d64d825aac9c205

SHA512
40773a0fad1c4a9c0212e5d38dddb0fd453f099806dc2db6253b0f6b46159506deac71f3ad9358e59117c2dbe652e4ef7b5a22ca73e1e1e2b6001449e588459d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A8C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BAC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit