ff6313ea864f8b56cc066a4481a6e24c53cbb76dab93b058aa4df509b58a0121

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c1db3f7b0883d6f5cb75443b3859c30_JaffaCakes118.html
Size

39KB
MD5

2c1db3f7b0883d6f5cb75443b3859c30
SHA1

7f3a89930acba958a1fecd5dda316a9395533b46
SHA256

ff6313ea864f8b56cc066a4481a6e24c53cbb76dab93b058aa4df509b58a0121
SHA512

83fe16caff6f6ec88149610a77a02a0d2d3ae7e11a98276535fe1cf4412d0b7ac73f3335cb1203ea5c0424ffaa49eff630fdd9055ed861789bedf233746d493b
SSDEEP

192:uwnJb5nEunQjxn5Q/InQierNnynQOkEntgunQTbn5nQmSlxWz9huEh26PFB7Pf+m:IQ/NKxMnuzyJleQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A2854C1-0E57-11EF-A296-4A24C526E2E4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421457195"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d074e70e64a2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000093c57e206537e8795d8ef774ac38ee7ccaec4331f44b3d1afd5b47a4721602a2000000000e8000000002000020000000ebcf0073c66ecd4db98cca1bffda9248d57fdd287469d9ba7514e9b4d2adaaee9000000057a053599cb932947ee3c06f6ad10899d94d740eb71c96ebb6956871aa6a2229f548b7160a20ca0f121fd5487e1fe0ff47188788e97fba8dc14b866460f1a4e823832fb1dbe25d5fb5aa0139f5af804f215a9ba23d1d2e69cae41bfe6045482bfe3ace8a2e46f75325fd9f997e75f46d8a39cac0a8b47498c0feb226f5b7995207a4c5163a2a7f5f9be064d1728cd1da4000000060ff7d4693f1f723f5be476eceed4fd3a51fd2cb18b366b3e3cdfb9e2c85be8681188f82411f86b59ecc3be4c06bdd4c18360c595b15eb029aa8efeb6df63915	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000123a597a767eb8f4fbabeca0aaaac7540cd829a58c839b0bdbb448ed367b7d4e000000000e80000000020000200000008c09951d22353a0133a3c4be2654fd7d7c59ede075f80bf016634dd428cd5ece200000002f8bde2bb80c5f8f02d940f2a8efff3eb8b69c70512921dd157fc0ed22357dd140000000894ea766960e19b90862c014a78d54527d19435c70c63fe68212e033e202cda5a9f220a4b16d1c612277610836b844eeafc5d0cc8ecece15bf0904ea5330fd06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1984	2268	iexplore.exe	28
PID 2268 wrote to memory of 1984	2268	iexplore.exe	28
PID 2268 wrote to memory of 1984	2268	iexplore.exe	28
PID 2268 wrote to memory of 1984	2268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c1db3f7b0883d6f5cb75443b3859c30_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0125a3039489bb18b0d8bce6f5ed0613

SHA1
1c101dbbb673998de915e4d1da46845dc7c75a39

SHA256
f454cd1bd7aa04656b2a5ca20c275ea2a76b04ef2d57a5fa2943c2232c39e3be

SHA512
8d3f43f97c7d7847624c8dfef4027ae861509fbb3d0dd6ce460b130147343014f6d617ffb61a6231b98c1fd8d19a5a45150ee60018fd71e3a305034f87027a98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a0dd65d912fc03302f20aa3ecf733e3

SHA1
7869945a6e9883a6a2b48c2319b7d1d6aea8d131

SHA256
58afff119c8545ea64e35dc4579d241dcda29455775121ab447cabb48d570b43

SHA512
2011c770ccdfe7934bff3d1e91dc126ac310b5dc09c5e3e4dcdaef0572f48e5c51cdb31895597072f1ffe032cb9544f2165b3a01eb135af41e42e5094a066934

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9a89eece4d03032aefd0d23e03d07e2

SHA1
114300f94970cb2e9bfabea797a173d41e9e52a9

SHA256
ac8b10eab18c6e45e3ad622ffd53f092bc291dbf1b488343322862efde23c760

SHA512
5c97f3db9a76816528a7a112ad7637d8d3a8144d253831fb1e9cf607ebc7463106236e9041298eadea038b44171a4760f1f3c197cdb96630ff6553462e7d03b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
544dfc326244e827dafc6b7211b5ec5a

SHA1
7e53e031bafd0c8867587a3746d3bfbb1227efdd

SHA256
4ae1a0431c521f5ae7b5e72dd16db68ea39d4259f6acfb66dbef164802f9ccc5

SHA512
11e0ddfd6e08c70ad7811472a3d57e753606a0203281036a2f5eb7a4fc0862e5791c8bf58237efedad02e2e14039a8f4bce17c0bd96407fb5c707aa48a7242ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8949d13416226814406f91fb9d34f10b

SHA1
b7dfba21bfb7de5ea7b92bee3409f3864e6dd27a

SHA256
c09578c7e7f0fb2c075e24b5b2d8fbf0bb1453c9f4ec8c239801f22812443d93

SHA512
8665f2fa3ec5a0e49152f6c67ebbc1cf4df682747071b954aff26491bf3125118a61833946b7011f19d547617750e7a42e7543830211ac58210b64a05fd5a812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e2a2b374ba12a937b045fba762e841f

SHA1
3b2afa503a04ec8ae3f07c0526bff02435c34803

SHA256
5b75a750da166b882aa7f312feeb66e81fbb3a4356dcb762fc43b66886e16a49

SHA512
d9b72499c2ac0d862172470c83bb20b4e8abf1fe6192cce7b06eb56e7f29f7cd95d940f1152b23cd3f21bdf36cfe137785327ea3f1ec1a8d74d8b1501d7ea512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6f3ac62f2f54b77106658d125232db7

SHA1
c213631a6232f03a31b36f5a64eaa4dfdeb81505

SHA256
ea20ec436874f575e89ae3b27f0561607c50fa574c5ebdce97fdf76fdc6f1f3b

SHA512
b9e21370e950f746982d37b1af3290dec77070e290ccc33fde9a645ad35f88aabf3ebc31e9a33a01e4c40c86337a8c8e3378499ac07076d91b994ca92bac1a96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d490532ac77a8d3b1a6c93fe28fd8b93

SHA1
9243d401534186381efb3ea042735ec70835521d

SHA256
ad6477d3435e81d7bba51a4a9170543c1fed1244a806af23897c9a7886e1227c

SHA512
2f3423653fda387152e07f8d3b074ef8597cc965f593adfa65539006b087d363126288c1763b88619864870580f4c1df0459fe797a4cfe5dbed4f3a00d37943a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56b07dea39543f1394779a25cd5c58f4

SHA1
afc792ce4c9a5fc404341301334128c23bc7d7c1

SHA256
abd906f9662c4ebf0a61fcdc7dff56270619203f6a612261023994f282312592

SHA512
4e36b930a0bc3f5bcfa2cdc7411ed760b65440dee782540904f3429f05dc1d79206ba32cfd70e2f6eb69b286c485efa3686b6219e7e67b8ec9804a447812adb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b6cc4aac05e903c2ad79e53399c2c67

SHA1
4f347620603a77188b5d0207205b6f8653bf829d

SHA256
3582d6bda8bd318b4d805ce7605e201ed017e2c6180cd17ac359e4dcbf12b8bf

SHA512
cdcb4b5b1bf01a80282f8c9b2487d92c9987c46f88bcc9503494f5021e89bb0e5e00124c42b5846aed70714b5cc314633aff1e23559e34b91ee191419441b620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f0965a9a704ee70c25aa4c097407dc6

SHA1
3473a9a64485eae0f8a85a4ff01f9f86a4d0b5b4

SHA256
6a9aa694f3cecf7b7d0502d67d4a72c26549b676b5a8c07ad2fef8a6066e8130

SHA512
fe2c32192bfecaf45d86d3a8d5f13a8b31a58d1204028c5d538ed7e2ec936305d6116d67dfef72a07edd0f9b775ef9acfa8c318672eef6bb225968ef9c270894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8adbe9da7dfaca101208bc076ff34b08

SHA1
17c7ffbe02ff885db180a52c3b960cbc7dde3edd

SHA256
80de43cc2f5ce19cef7688bf9ffbf00dbda58773a3ab01ab9cc06e7373663cc0

SHA512
74c0468f026392fb54e7c3b17aaccfc5ad4d127c0cd9362cd8227e522f820aef04b30c48d05876b6bf6eeca5aebc894288a472e2b2922142f7ec9aa616d0594f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E81.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F64.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit