2d9b37d920eca34c69ed25ca6288e1812eb0d427dd2e860dc836f8090a92af7f

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

291bd2a49a67590f3cfacd8a293be0eb_JaffaCakes118.html
Size

213KB
MD5

291bd2a49a67590f3cfacd8a293be0eb
SHA1

8c668d64120dc19bb94ece0ad01e49699f3da990
SHA256

2d9b37d920eca34c69ed25ca6288e1812eb0d427dd2e860dc836f8090a92af7f
SHA512

e3bbebcb4173f2d5092968dd8bc43092bf7a64f45f2d970f208a1ce65576050f96c9b93a525553c107f1509cb7a9a04b949d38b02e7b0edd939a59945d83ca46
SSDEEP

3072:SoujU5WDm75yfkMY+BES09JXAnyrZalI+YQ:SoTBcsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421405051"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1FE05D1-0DDD-11EF-A40F-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2156	2988	iexplore.exe	28
PID 2988 wrote to memory of 2156	2988	iexplore.exe	28
PID 2988 wrote to memory of 2156	2988	iexplore.exe	28
PID 2988 wrote to memory of 2156	2988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\291bd2a49a67590f3cfacd8a293be0eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
137b54f8ddd9018a0ecf09f8713d9223

SHA1
a04f035f2f8a9ce18cf5712a6501cab036552ae9

SHA256
f67dca2b02115f1dc1d113e9f2f18d7411eaba70928482f31f9177677929a5c3

SHA512
d4f7116ac56d3bf8eb22ac9a2655b93c89bec2801e232ca516fd089a3fd34bf9b8a157b9254ca637a369a8970e47deb3053a034d268adb9395a89ef303cee3d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
247c197f38db894011600ae01b58d815

SHA1
5669f47407769d1f3dae4d97dbe18bcadc95ef55

SHA256
8f889bc944251bc0195c2e3c0ccc4d79029b672347a1b63a556cb01e516e4906

SHA512
6b74b8010a232ddd56e3b3650ff417bb84eaedffca6db4d392f9f04b796d69904fa7532e98f3ae60fbdab548df9a2b41b624dda2757adda6380820ef7b0483f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f987992e94e5063afd4a253fceebd9e

SHA1
e3d6444fc207bab9b7bc7d875cd89370ffd23ebe

SHA256
3fdc3afac26115e138310cf86c41d27eda2d8ceecf75179de2a7fba92ab45d4a

SHA512
6bd221e36173584017496f87a68e504bf1a91d5126d8086fe35b78bd7fa2d4a1bbe8ba8659b4dca6940bbfd51d82b449109bad863f7346b407591ef09165d978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d2841b80ee643b93aa2ccad27760651

SHA1
4b9ba09e5d8d4881aee59fe377d5d764df85aafc

SHA256
f94cbf99606170c5cb257c255dddf3bc30d6f171a56229f886b937f1945d37f7

SHA512
70d0f6ee339b96292d9a2b08b3a6265674c32498a3c38eb049f015195a5feb2fd6e0eab96f6670397abe96ae308b1695d20681f3ff117c63390da27e5a8cd360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785003c9f5b78ff23fe57c5c51a788c2

SHA1
a5ca96b658049fe3dbcdc95f9f364407e459e6b9

SHA256
5f46323de53ed6bdc20a2a858bc8e72edc606e9dfa709fcae89093e59bbbdad6

SHA512
2f38fdb299cbdd44605d846eaed2aa1e76203be7b351ff7de7e71e3ceee1b736ddeb8370581fb65f6d7449c4e6a663b745c715bbd5fa85975e5b601352580e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
229728c2daf9dc8d7931d1a0d5c32612

SHA1
1bce66a8241107e81efb8c005446f44c1438b8fb

SHA256
5c46d0519bec65c2ae015ae6e3273d0cf688415246e4570a73b04eb00539b6f3

SHA512
35ac9bcb7bc38b77559f9b44b6db2a880fb5005e26b913ba91182378f8a3780c504a4295db484991f62dcfaa01eb15b00ba77c7c7fb35cf678ff3a811afba92f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
292525798676387e35bad09151fe7d0d

SHA1
59a29a321fff4af70214f42db7819a932c935261

SHA256
a3d00823df8da7e9d91ba2f8a10d498dda3c7e6ba42f3ffd1be0a36ec4a56058

SHA512
c82b8ff71ed75be7dd3ddc4145078dc0cabe3439da5502f3855eef6d80955f8e8a899b733f7afab34778e81c3cebf4c46291dfde06098a800a1731a11eda06fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22d0673be2b61b26cc2a36956a03224e

SHA1
bc5d185bb02fc21357fb8afe2ce3302259959862

SHA256
30f2ab958a0bd28287e9c8a53ee315c22194de17c08db4396152cf36d2d0186f

SHA512
946dc644d8627ae3e7f97139e3995b241c9e7d75f728762331fae7a430db5b7c739bc3958a65026d6ba06b8a03f7a5fe275d5fee0412fcf5bdb8c61bb5f4d8f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0728f3c999290dedf2d70b7d492b1bb

SHA1
7478416d43bae55d760232f6834de1adb640c573

SHA256
ac321dcfb3b918da83f0589804f42927e47bf9254c244f1eb647a86e6ba2a279

SHA512
a0ee0c09d5f97bf689ea114ff9058ce3c211f379f19a393d8ad9d984943732a3563f93e18db0b74c7a32a0bad46a7fed7185fa3d322abce6dca7598184b604fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18ab546eda81f6337a9709f762c2c8e1

SHA1
2856db6b985ec919aef590a84f03c74bd985301d

SHA256
7129b2428355475b4b4a4d91c1f496876c18eefc98c94a2d31294dd7fc3e23ad

SHA512
19e7d10b280abf737aee05acb01644167539182566a9d978c9418858531c1c6b9603370b8630e839e66dc1eb35e8ea96d120c79dc28d16f9b7d3e5cbb4cee610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e799dcf254410eb669809ecaca667106

SHA1
8b5377a95eab0bca0688ce4e25772050e266d28a

SHA256
750a81bce2ecfb06de7276c56d28f93ed18b3986da7dd22b99e672ae3360e8e5

SHA512
62b31000e69278b1e6bb1b4334437d25e6ebe05b7be44f7e6558335ccb2d119ffbd4cf011fa054bb9e64b52832c46adad982fc4cdfb949626c1850d26ccdd931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20163347f7b12759fe0b7fb428964997

SHA1
1819b92fb1029be700fa109cdd59b1feea9b5296

SHA256
e3d1652c3696cf388f6da45c3b64a27c5fa7b69707fe2c1d57a17bc864794981

SHA512
3bfc94030076070924bdc60290d179e107966d7ece60ceff03b4261b5b332ad1322fe46999fad56449dc5ad8617df1e65b2c95bbea484672c75a76d29c63301c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
760f9bb0c6a0d9b25d40d0bc22e3d49d

SHA1
ed37e7edcdea38f408a57ed94c39336acf58bdb7

SHA256
cd580d8134ff59da9bb6873fbab4129927c730965181a75377e25cf5ef59a696

SHA512
30c8b71383920a2e9f13acc68f4aea29401c10166b263099dd7a3eb03451ca8d4cdb680a99cf2f59ae761dc5815b926e1ddbb2aefc4c4b104c4e239c9f11c953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d226d430aec61fa915602225574f81ed

SHA1
38860437955b237ffce566a3fa2015ab3f0f9c50

SHA256
a1325b1567f2f2aca086e6d5b8cde49e6bdd710a98cce408d26fe73e8344c590

SHA512
78a375aca4d20f528bc87302f946626a0237901e2441a84d1df9959f4273b2344aa5ff7321151362117234e6db4d2f5de20858cf2e431d6f3af92c950326947b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3775e096f533d2fab9fd6bbc4b302095

SHA1
818a7935ae0e17c08f1cc2d9c778e48eaa064591

SHA256
6cc4716ff5b2832bb312d40bc05744451ca4bf379a5fc98ac0afee8878cc422a

SHA512
1c98065072cbf4ede5217feb5dbdd3e237dba7d09948dbabb949c9d977ac9b484644530b987a33576fe8abdca596bc71d6e10eb57c6909f4b9c5e6b646669eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a2336a0026278c654c8996c31a2af00

SHA1
fa8e11d3c04048c295f089e69e9d7d7f65cf571d

SHA256
9efa2c32e5dc47d39692f7717453c8e175efae893b307ee3cc012b00f23f0e95

SHA512
9b6f9dbf8c1599359e48c4fc3695b273389f8f2fe390a3e371b5407a68e25ddeda071b6af26326354e197ac62bfab78f2aba180f467eb6fb51f231546e09d01d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92dab60576c8b32ded9dc67528296ea0

SHA1
9c6467e9defc1ee124bed60248b0ee75519cc07c

SHA256
1100412a766ffa8156fd6a9f2088e5b3ee7816085651712683b106a8cbb1d4a9

SHA512
5aadd71d24b395616ee20eee482a10d47ced7b80531ce1aba009c6ba3646a6e73f595f7314751165cf0a4dee12765d7eb478fea34f98438eca6328331e924fb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b2b041719cbc036e1bb219e2f2dd6fa

SHA1
08f654d2d4c815440b39650c1217399aa2bfa314

SHA256
3a50fe9aa25763986bfdd47adbb353a52cf0077f6d29294e8bd5d80422d9d1e8

SHA512
b1f815c4435d0683271b86ae6c3c578df67e924df31abd750831d007972670c1263c6ef549a21d7f7c699540d7f8d45795a2c2c3232fe07dcbee055b82c8c422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
090a11eca22757fce3af898869181f5b

SHA1
414e3ed2f38c086c7d4c687686ca492aaa9df39f

SHA256
3728c1db4f39f0635d01b46044b3a64eb798ff3f6443af93051834c33762300b

SHA512
515489411fa148f57288fa158f5fb0819cd86f2117d0fb935ae191b8efac6f5dbf3dd9e3e2dfc607473a1dfa73a13e486f89fcf7c07cec624de01c35f2b1e662

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab256F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2584.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit