5a15c287466eac2fa3ba0d04841c14fb5452c528cd7c7ba351bdd23dbe7beea4

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a3ff46e4569b41c127552b8c2e767a8_JaffaCakes118.html
Size

70KB
MD5

2a3ff46e4569b41c127552b8c2e767a8
SHA1

133d88e91dd10232127b05b2c21e209c3b05877a
SHA256

5a15c287466eac2fa3ba0d04841c14fb5452c528cd7c7ba351bdd23dbe7beea4
SHA512

6c858a5bc54778255b3bb7fa116d22da2ca9bcd2a2fd9cdffa9cfcb2e51a63b046cf4911c0c4e4cb7a948fefc966ec33adf883c19bdd34ab7194702fe9aef04d
SSDEEP

768:JiFgcMiR3sI2PDDnX0g6sT6PAj2oTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:JzhTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000d32005f4fa5c88d1572c78928d5a5ce3f40eb8959131dc4e0510ad5c8e54a843000000000e800000000200002000000050154734f4f3c1b278abbc2d87daf9d90acbf0ffa7844e651feae0ede472477b200000001baddc156b29f0c9caa2e1396119896b4802a5253b9408bef8a8684b03c7396640000000cbf88fda895534c4bd7e57a56561f98bcd86ef5bed5bf9111ed19a347aec85c6b0cccf609833a37c1ca98889d17d9f7979355e31d37bedefba275dc7357345eb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3033f7be17a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000085e29053947c02cd85a0b24f291a1ebf0e7c0d6bc8c8a6bfd46ce44942d6acf3000000000e8000000002000020000000228fcd6fccfba007a5279f061efb74f387f39389f4802de03f82b8a82925a4069000000068f4d69ce4ad2c93d0856a09f2ffc128b12dd467b5b8fa03bdc1d89a7668c2ef40e6791b78ed119c27604d45dfd2ca2eaa3a723ffce4043d2641e43270d712fdb35d95b11b000fc66f1b83d0b8bef3481138e21c8b5f434a2a9e973ecbf1283274573b2daf65579e795d4e7807d2f4b3bad31b6142948cb7107066940672d55cb1948edeb40111430506ac00ca4f978c40000000ecfb52eb46a21eceb397a71d9f596dcd9d9cb75ddcef9e9c491927b3e4779e37b8aead928c015578da8e2409026959309cc02df84a85f88de2230f4ccff0a2ea	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421424419"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA325E31-0E0A-11EF-9387-E25BC60B6402} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1296	iexplore.exe
1296	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2560	1296	iexplore.exe	28
PID 1296 wrote to memory of 2560	1296	iexplore.exe	28
PID 1296 wrote to memory of 2560	1296	iexplore.exe	28
PID 1296 wrote to memory of 2560	1296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a3ff46e4569b41c127552b8c2e767a8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3bb213b6877cb5c85ae9ba740ad5678

SHA1
ce80e69e641a38ad2b78f55b92bdcf4168e5839b

SHA256
944acfa5cf6c4978f25af7a537d2499cde61674d016960920387d679ece03b23

SHA512
49c043eae16156ce15c3f5d82b7b63d2b502ec8a871b7d6de49d5b16c1929217ab125e7198b3fa3a31b2d2ebdfc51879fccaebca4504c990e56bebf885a6b8d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2880748817b032e5ab3dffe1aa113382

SHA1
b96cc749195e66b8841224e3f7d8a075c6322d62

SHA256
7a78bbb1af63ea12643eb0a666c7c81ceec7a089e78e6bae319195926dcd023e

SHA512
2850565dc58550f3c86ef5d488a86a478b19471f8e294d75ea9092363694030553d24a5e5602771344629dd2c731d3905037c20fa9cd6ebae9aa30784d0a042e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eea5582c36466b86ec7a5cd23b1fe08

SHA1
f1162b11180dbf3cd619b322d8476cf07030e675

SHA256
4b7c5ed3a9e9f28defede012c610e35b0b3ed01f557851284f74971e28ae9d76

SHA512
3b2ddad5058dd24e5f2f836fc36af5412c1da3451f39c8f79eb2b3d94e78f587a11b2fa56d1bf678884d1d36b058bacb26f9ec9bcf792c14b09793ac28437ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e39007e90b74e56fa05661f8d32d504

SHA1
9cf39714bd6dea226e290fff8e1239239d8bb86d

SHA256
e29b1e6c5a32bfe59eb129e0652ae1aadf4077240de4732c600a3f136f691c06

SHA512
16f98fe8c2d20442dc6b061cfe55a3988d8dd18fa7f0f957700abfacde286875a28a87758f58a48300d814bdb2817b7037bd886e90b2cae552f0587294c75993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ecf3b72da36737be45daced24bcab4a

SHA1
48845654ce5b8849927722791cdb6f8967f2f3a5

SHA256
e89d266ee7901e2000ed6291ffacdb2d04a5616794bcf67fa47a44f794344906

SHA512
c30905f7aa3f5683758e0a483989f5bf92830741811dfd393c2ad6d5be22a8dc067526108f8cd1f6089160367393861617abd82b65d078416c18d3f4e88aae37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ced24bd1e9f05db8c4bb724518483cb

SHA1
66fd87232a3f955fe18dcf221a454de641d3f322

SHA256
190608e8fb885b07fe6464491283864c606925f383c282f1423a5035079b6963

SHA512
f9724ca1093187e6a8fd1f580cb3b5f1645795021552ab2ab112f6ddd192a131cc4d64f15efe9dbd9527d094ed62523ef09a79bb47a7d0b8f4c95620bc33cac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aa43a3bae8f6dc456638bed65523d49

SHA1
bfc78eaf7b6270529d98d2fb74702e0338723668

SHA256
1e4981b10569e136d7c3f40820eb70c8a95ee39da91da41b584e8c6394d6338d

SHA512
6129629eae6846bd6486eacb91157bcce181ed065ea112eabf17f5cf8a94baeca57c759faa44e6af826643af424ca1a7a16361ef7a1f95450eb34faff7013b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae7cba343e8b2ded57ffe87c08c5a3d5

SHA1
b76fb26925a5b4d9c43a39d0ad8aef226cb734a5

SHA256
13d31365460f5618fb822b3af4f12cc4e270cbdb998a8cb27afb8df58c684c45

SHA512
94fbe4aaa92b27f1a7c2baea1689ed958954efe84929e5601cb1c1c1bfec2736c04a423bcf694957e083390ced9273477ec3ea13f014d0da8b3e27a5d8f85f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b40e323e3ff4944256080e1a3d0e4143

SHA1
1e309aa6a262332cb35074c05cd243912dc63c5b

SHA256
a974b6cde5cab0261bee4a106cea164b77019f350aa6906890251e2be5169710

SHA512
42b78f016651fd220cec6f3395fee968b116dc08cd80504025372d9ffc6604f5faecfb4017afa96a2e98dfeb344b4de3cd341d1695a77ef57b2b98aaa2c24da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d12f49eaa193855db314342abaa0ce

SHA1
900afc5b7f06b911314a17b6152056d47446b35d

SHA256
d14a5202f4403bae7f40e1c0ca06553ce2755fcb881837f16a011b13c12bf92b

SHA512
fa17f33203d6e0d7f5ac98bbef16e59f6deef4a67312c8979d0ec4bb64f5b981aad2770457edf53e313924613e6c646f27da3b4ea94ed6da33e94b7f70525fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
695dae16e7a595d3a05c14592700e21d

SHA1
b5db57239654fb3c7c538d6882a459201201bdc4

SHA256
70cd17edc3800e8f5e1c42cfb417e452b189566bfdd62e0817e9948f96c25f6e

SHA512
f73377009f3382af864ccd5b12bcddb9ae43e02f3a0026a55ca3a2efdf104176c99898f92a08e754e84ab9ce5550cefdff3c1245d1105478a29ef48499717a3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e012eeafe2609c8eacf0ce067cfe706

SHA1
daa9514010922d93a63bd7bfc22108d8cb8be1aa

SHA256
dd4f2e6e2814346a56d3461a3dc77d3503cd9df9295c7d41570443f52539ea04

SHA512
9e7bf0b7a8457958135bfb174b84bbb7750c11d951a343c53d2a654cbdfb391eac33dd76c75846ca2cfc03ea0c6610c12a3bae2b86270d13dae71eba54a1cb76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f40258b9e19357722cbac29e04341575

SHA1
cf9228d3269c857ae625b9b2b9adc6e3895ef993

SHA256
d31c262bcc5f561d967a8e2a2b76bac81c6ea21d20f6add7be24dc1fe80f93bc

SHA512
981a3d931e9821b03391c13f2317ce1a4acc911c15740b43c9b94a532f9daa919cccb3157af7642f946a9e67977361e81ef83cbab81e17263cf3f2a936191c94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03a9e8844e1e04c5beaa86d35da9c78e

SHA1
1630f104ee0e9e00a35f8a2f11110574a1a4f6d9

SHA256
d6702303d4e6921186d48afb6254e114a6e0a10fed3d27b7d21cd44534b763fe

SHA512
38ffa907824f1fe05b80855ee6818e5bdc454024c3d0a60a758af34f160f7da4a6799375d4221d6b846ce10f2816de63a4ebe77bcf93ddca971c2c7c7a10f0ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75de3368bf433d801363bfe6874cdb83

SHA1
926132b9e3e093374397447953d0df281a5da6c3

SHA256
0ff3d4c15066f8d72d2969676d68dbdeb7811a1238b3719a1738934fa18c9002

SHA512
6849f5edcee5133abb583aaa152908f6cbb47b97a5099d2e2cef772475a8cb11b29d5918ed871991fc138ebbea8fa5aa2692bf4b0556bb8400121c9ff6a47c13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28E7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B3F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit