92cba43ee2c55573ebd4244f95355ca0c4db05e25184d5a7b8f0cfeedec9b4bd

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29f0e70be0eccb92bc51ad4fa0275555_JaffaCakes118.html
Size

41KB
MD5

29f0e70be0eccb92bc51ad4fa0275555
SHA1

f2e3cc516466d084f3cc194189f1ddbd6d60280f
SHA256

92cba43ee2c55573ebd4244f95355ca0c4db05e25184d5a7b8f0cfeedec9b4bd
SHA512

34a12ca1f668020bb958590c3f322fbdfa9614ad0801b1afd035a00e5e90aadb2adfdc25510c995c89ffdaffac54d197fd970e307ee897167281d34539acd0f5
SSDEEP

192:uwLqb5njmnQjxn5Q/3nQieWNnenQOkEntdJnQTbnRnQmSnxQ71VVWcRjdaGBHtOi:WQ/78xcZdXMnoeH+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{767F4811-0DFE-11EF-ADBF-FA30248A334C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005f6d149c33bfeff6181955af1e563ced8142e96bd83e981b40eac76bd15f684a000000000e80000000020000200000009fdc9d1853514f7c62da0cc1a34c99880fc8dcf88aaca7c0082b6879cd76818020000000eab7b8107b2e0d36b9e7e0bd6f9eea556c0f064777068cc038164c714754f6094000000095c7cdea42e30bc38d1e9eb2ffe9c010f3fe284e1d20457bffdc16afe5aad30260f541b0807e1f296d256a9cfa277bb6315d50414cbcd938b4cfaee24d49a014	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000015b7ae6d42b6db4dc9902e85dd926ab4de225e9e6b2506dcbcf766ec82632d9b000000000e8000000002000020000000d4cfe5fd4dfe72e4931487f9219de9e42ad2b9d8947c680bdf8915bd76c71f1d900000003e408f66d6bcb1e73c586c245bf3ddfe263c87db54113099c0b88b4eaa378c0220350939b89e812dacb1cd297625ee6f6d6365ae21069e2e013cd3823de50e811d05c91bc4a45784fdc1ee4e454631cc0187823f766209d441b8c48b066f00ded080e6503efe140abf86c7cf964f15a80941530650ad22cd89d993865e1c25677e6570d5dc6edcc6223d310751e2cd024000000077264f4755732ef5978121ad462ca3e108d299a97938398353b57192dfdbfdbb03a967a2b9e944989624b997ab245c8e6cdedef2b8203b98dbd46b3a8e21a4dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421419072"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f9494b0ba2da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1300	2416	iexplore.exe	28
PID 2416 wrote to memory of 1300	2416	iexplore.exe	28
PID 2416 wrote to memory of 1300	2416	iexplore.exe	28
PID 2416 wrote to memory of 1300	2416	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29f0e70be0eccb92bc51ad4fa0275555_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c55e70c69dd10ff39061cc7beae44158

SHA1
c2ecb15019552f036e9008f4b404dc3907f83472

SHA256
88ec910407d25c1ebe1d124c4390d6e8663c54c3c58cfa242ea6e719ce16245f

SHA512
e7f510b4fbee0705a53e8fa9cf6c3de7e665e5d71b83724bdf90b5cdfecb531ef190a787149ae32c1eb9fb29261fd50a753e1e9c4d775e6cdde3e8528c097a67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1fa9f1707656858f0ea8e860cd2acc1

SHA1
8b584d7e0f8560761262b0814e0217b7c36f29ad

SHA256
2147f4a6e85336436636e20b3cd45c32aada5a65d199656dbc12f96c77a06841

SHA512
fac4182ac5c9d6f8df245f88551cf93f4f854969cb856f7de0526e82a25888e18f84796fe01aee8521f40a006bb1393fa44eed7e655dd0753a4c6249fe361f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2b0e81996f4176283c5f5f5d77b9df5

SHA1
8b44d7aa40994fa361d6dc382169f451a52c81da

SHA256
1a46e8c11e7e31921dcee81385d9e3f06492cf9c29f5f4b71bbefd1e97dc9d57

SHA512
9cec73099e58af57b40bacdf6c7a8abb2981ac2019758242c81c1616ca1080c47e45bedd0600a9049273fc61e1e5c0893cb4020fb580aeab9239b766474d38e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41d90375b484a0973437bacdb6aea819

SHA1
67250d60895eb0dbe3763acb6e84355feb5592c8

SHA256
6532931ef5bbe73f69378c943598ce26317c68a912ead21975f81dc9676e423e

SHA512
7421cd79a675060e07085933e064467c9c95ab7d5794c210c36087e0d84715f4bc1a89566ea80b2eeda702a154aa9cf3b435cf49dca787ee7ea7bfd41904ef56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6e860a748560644fb11e6f2b15ab58

SHA1
7266b39b731c9a5fb06cbe082904fb7e707432c8

SHA256
9e11b5479fd672a12df2eb01f4e250c5d00dfeb37918bb1e2828b36fcf3f9c5f

SHA512
e914baeba0da6d4714d01e7400eb07f903b4496bcb3b21173e970fad3c0455d3dce7f776af4f9a11531a76d731a449361aa274a74fd03922e9c25aa29824d3da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64f976aefb1b8fd0fc8018ab3328a435

SHA1
23061fe1a7664a15281dbac992d6391e79900364

SHA256
4c64049bc49a2c16c7cf23714588457b4beff0da163e546e1632700d13a37e92

SHA512
0e5dd4b2d2426ef485f801391fc864984833561a8f8ae1c9962d73e7dedef30f5b8735cc6d34f7266d7566df993e97c9be748abb5c4465029b1070e26e6acbaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b08725740b09b8f05172f4bd822fffdd

SHA1
3be9bdab81be93a95d028741253f006831653e58

SHA256
4f1e5574e04c9c0645da7aadae3c9e476a7b42f5e11f10a115dc93982d5721a6

SHA512
6f60dada8b4735bf11e8f4d0384b2ffbb8a6ecdd48bdb1d5b33e0fd2f635844d5672d0a9fe3ce18654817f40a9a43a0c647c3bbf683b3316174e1328d57cefc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53ecae375d11c0478830572092c567a0

SHA1
e988e6d02c5349f1a6718f0d39538dd4e92a06ce

SHA256
bc6c9b20922a6a04afc442ee1dec1e1b23ad24522f3eaf3640b6324c7fc548d7

SHA512
9619fd34d285d377a2b17fb2a9b3d8247965f0b41bca8bc8d9b02915a487e4f7f49b2b8f94fbb762853651b341f6a3cc7e262899ace6fd13dcc35ce43e77409c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da0f5677b5980c278fdac62ee23119f4

SHA1
11d0417dd2b5ae154f2b3b56e0e3d3e8dce44335

SHA256
24f47d0eacfbe860984cb40f279c1bb4fbc2fd57e6eae52cd47c58db0d1532cf

SHA512
ec0ccdb0e41eb0c8b8f98f5936aa60417bdc78510a760a763f3888afc11dbbb5f2ebd1daac5f1f1390c5d79648c99ebe0b345231c52bf680238afc3128f5a65c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fa90a70083b92cd64ae5e2e069dfe81

SHA1
68ee97d52d4851174b36cc1eea9e9869c500c117

SHA256
9983921d5547254ef01ac67b69d30dd46e587eda2afe4e2cc0e08ab538629d4b

SHA512
cd9210ad6346ba74b065c24da34e44bf55c88a878ac794107b8bd58a8d2a01f8a4e5eff7626e661182bde111b62e3616977424894b95b0e4149a69d9a311933d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a1da74176565a55f9dc0f977dcd66a

SHA1
4b541d5fba734d728640a4663f16672e745924e9

SHA256
356455f74039755ab83239bd18a6f0ff1a422c8a42d32ebb31fe5867c32d933c

SHA512
5c185f3dbe1b61348360207671cc85841ddaaa8894da2d3cd68b2ee89d4bf5f96d7f9367389ce148090e654431de89b397e153bbd4b26ebe06a0135a40cb3c21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f991f059baee25104aa78be6fe2de81

SHA1
b6e5c8288bb7013dff605ed41285ae936e2fda8b

SHA256
a0b71bf09a4ef8c2773b6a93782ee958a5ee7fe10e5be4e18428afdd21230f9d

SHA512
00a120fa449a47b94f1fbfd023c26fb45d3d2326a153c2b7b197f8e3a00fd2cf40bb5bb8433a2d67af0af8289d541b0fc2f8cbc318c9c8094bb1eac6b0f90700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2455.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2537.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit