cd5f0156294834ef312ea223eb31be3ec51e9aad1047f32731a812fbb7e394cf

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2857b4b3ea0e933762c3c6d68017f8bc_JaffaCakes118.html
Size

213KB
MD5

2857b4b3ea0e933762c3c6d68017f8bc
SHA1

0ab42622e236f6913aa283dde50fd4e7d24e97b1
SHA256

cd5f0156294834ef312ea223eb31be3ec51e9aad1047f32731a812fbb7e394cf
SHA512

4694f0a3c0bad8911897c8984746419703bb826cfc927e6702a17f6be293f5482b81a4365011e58f3bf70d4444dd86a72a6bc38ff4362f068ffec69f8f73dfda
SSDEEP

3072:SNqkTqHfU+2yfkMY+BES09JXAnyrZalI+YQ:SNiFzsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E081C8E1-0DBE-11EF-B837-5AD7C7D11D06} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421391760"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2857b4b3ea0e933762c3c6d68017f8bc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5935d2a886d75cfedf07d32ec9e1b8ce

SHA1
a100e11ee011167ce373dac20c1510b8291173a9

SHA256
0597e0609b130018ad5b201c0bd4d83b4a80a0c9e0d4978b71ebbf1966d856d3

SHA512
d8cdb5b3e32cdf41962dd31b9eacfe1ea143a8cb284924ce837c05550bab240f5cbba49b3455a47463279ce6f08575fd8bd0ac6d124a76270e5404f4297f026c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae571695fc6e5a11455582006bdfe266

SHA1
bf27ef53c21baef3c23dde4807b61c21a5d22ad1

SHA256
236a9bc1bd98c3df5268d0afaae1d26f6539f33c716768a27750601c86141299

SHA512
582172f06207807163b8ca660ca978bebad6e259583138b61aee7c90c43652cb1c6e8d3728acad0c73e4798bafb9772895642fdca55bd3a45de6be2a47aac8ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73fa85a56a891eab6349347fb62a14be

SHA1
0cefb778ecb9dc0944c61a09567f14f36a24626c

SHA256
861f2992a7117c4facb733e79efdd532a01b62d2bd5905bad74af751e90ba3da

SHA512
c8d3e89c7cce25741b70cb144cc18a91d95717f74878a91f3e4e071f71b5e3fc1e822bc746abc5d33a972da0181316d22892f660ac7b5aa8cb90b64f8b114c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd9b22a9e9961fdacef8f32a653d3c05

SHA1
ec1222306516a3619caf3af705e03ccb66112dd4

SHA256
f74e9aa764a156f49d9ae5ddc5bf39f3cabf6c61eb21a5aa98867fe88b53aacc

SHA512
cf7710a890fe4be7509dd1bd05705ff2f07d4105221e95faa54bebd5eb9c4da9691ac84c78bf27c785af447184c865b5d62f1e25e675706463bf3033d02c7133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d8a5573e17cc7cf1e6985459df36ba5

SHA1
e85c3d32b6aeaf8f4aad18fc59d18be16db5e11b

SHA256
914442ec4b3eb4e943f0a15f3582272ac9721de17c70d7a129eb3f46aad5f29d

SHA512
7cdeeca07beecd68ac0f407649df14e94668fa8af36d38360c7bc5eebd964ad505b1239df718a7de4fb1c47d54d9135259f54667291da71de55ad406d04eabee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be97bea7d86418c1768e56d81217afe2

SHA1
9c5f88fd0a044a301200803ec93067dc43d0364e

SHA256
2b21e90b6954d67ea72ed8411aaa8484de0b82459a991475f9c67af4b4ef3a28

SHA512
e1b01fa1b9d0e3895848b3cde8184196a1d1288c9d6b2c7ecd6f7c42609120e2f917d035a8fb1308c76f3852a8d898e87fc22fc945971148058a147553aae484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1c74e0dfe2a40faa0a37f2efc86688

SHA1
9eab66306f705e6aa2034468004b60aa5f213257

SHA256
6f358ebedbb88a06f9666ae18e2facf1c3b39f93856bf3398155d019a2c55310

SHA512
46014be08294f5a447edb977e7076e54d58b78fb3b56350b0e67629003783ef178df089a419f7cc6b9fbae098d93e191f29ebdf03f84075e62d80e49fbffe050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4ec66b3eba43c0c898c22225323313c

SHA1
a1864cdd722b9a2699965ebcdb0e27d5e03510c3

SHA256
2c42acd4fc8978d14f38bdbcc473ed00f8ae43855985d75136db782890d5fee4

SHA512
c18b59b4d8334804efbb137958af37c8e77c9e666605e27d6ee7bc772ed37ab748a6ee86e7932a1629850c51061efd556c6eacfd6f61948228bfb37532452bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
824d4aa95cdf9924b59a2799190b6029

SHA1
7c4f4a6bab3b3b9f2f5d3074d6455ed0473ee3db

SHA256
05eb6ed57319e783bcf057431cb37f6aa6dc7d644a3b267e98a77057c4fb6481

SHA512
793ce35f7391500fcc040622fd012ccf9ada15d3563a81f2d29c14a5c121fcff09651e432488527b619be6f2b47d9c3174ebd942b12684441ea9548b331de0ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b1ebf587a1e48cf8cefacd9b3b9b7af

SHA1
e0e113c32634d8d54940be71a7fe751360908e2e

SHA256
11c9af4394fb17c89d9a5106238a9e976fff2a35595fcda68c52d1fd4f648385

SHA512
fd5b3dcaf175ae39e2e60bf610dd8200bac4026156d62ae4a1bc30e3eec6c96918b7758144ff74c565ec6719a784e079db88e42f9be0a16bebb969ab2b2def81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e0d510b99915eade20cab3ab932ea4c

SHA1
423a47d14956907880291e858487166101b486a0

SHA256
de3aeb43939a86411a2773df2a2e0ddfe2dcc8554266b3b35bc8aa829e1e85e4

SHA512
bc37d59d154efe4278217b9705c1f244934092c97c63444ed0309cdac71e4bb026a61ac57c659afa98dc300d85f0b581297b458a4c31bf24c9e1245cd18f4cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
514ac282c240d34d8cc8cdc95549d053

SHA1
1a6be1d3815359af3975431adc07e5af624b7269

SHA256
25f9b3fd0398f864e4286097164ee51cd64b5574c648ce5129f928121d4c7b3e

SHA512
83bc564f69841b1e273074886ac6677d3df5a89e3412f04e50119da2c136c4f72b6e03c50f67fdecdc38a0cd39b4815e7637d70f4472b6bc7f6cb429424711be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad294e5c5baad4faf868cd44296a35c5

SHA1
573c7ef2a3b4621d8422c6eaf50a1b0a9ecf0441

SHA256
65758be058fdb0112acef8e1ff5d0ba222c9ce57b529609e12e7a3f2a36156b9

SHA512
70175a0fcfe752db5f9d9229403f12d4b4c45249c628abb6a87d1131feff88fe6e67128998171be6a09009c22eb5cfdeadd078098468bfb1a812c21c82501a73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7e6ebb87b749ec1bd58e8505c6fbecc

SHA1
fa120b39d13f80873b4a01f65aa0a9b991d27020

SHA256
1ce7751231dbda04da8b7f301d29b92756d798bf91371ebee208306c8f3c67fa

SHA512
8f402ebed2260ad5c0146b1b1891abd692d438030970d3735a319c3c591ae7d3c1ab940083b60a57ced74465d9c36804071e083074d6771e78e377646505cc0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eacf4d924afe74a8e369bf3e1ee2189

SHA1
51fd9c1cdb78999c198afd68f033bd2f0ac9b7c1

SHA256
280544a01f1dcff96563f52c65b58fae0bda74960333daae0a1f969081215ced

SHA512
790c6f9674398e4704621ab7c8f4d8d7514e18f24b06f9677f09e880b4e707d93f3511308f72d064ea14c31099ce9da2ea25725bfa5e30b22b677b6f65cb275b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0daec06d0b57da9648de2665c144a323

SHA1
1f7ab84bc5f3fd866c0c2f4cfb6b856c9aa2392d

SHA256
df5d6d649d1c4d91b0b01bc90220ffdeb4c4adb8b7d30927d96e5706b6760aaf

SHA512
b9f063c31850a8d85ab3dcd5b0b09058192df5e14219dd7be89377d3ff45b4a53f543332748c997e56029ba051a7587ebb1792b3eff8e8d76f5ba9d78e5b8a9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8ccf3fc325da0a5ccc7a61813e03f4d

SHA1
f6c2a1e448262d7c001c0ddf34356e01291f232a

SHA256
3e1e70f00efc3be06949de7487412060af2c2317e3f894eab9cae02f3cc7bfb4

SHA512
9c715c3ca0d1138e40d9f722098dc1cbc7e8af43c3f380750040399058fa059506ff5b0488d1fa347838e1045011e7a4fd6655871cb145f1420335ec25ef34dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
195cec77ed820d320fb2794122cca01a

SHA1
f325eaf1651481e11985d35a379cec7591668726

SHA256
cffb24be04daab9d1cdf7234628951dc8ef6c6fcde28ed8a9034d6e18217cb69

SHA512
7382a60ba00793a4f7da7f6bb977a84706436ef03ef5ef7ba15fdb8d30b9e1d10472be0aae2f49325be90016c73370162c27777ffd5b98e0d98af5f5d339ea64

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC33.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC84.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit