09c15303588419c4b5039740ffee6c33b87be80efdd1932b3379db81ca0e50a8

Analysis

max time kernel
143s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ae8415782746dc62358fff180fa7ac4_JaffaCakes118.html
Size

139KB
MD5

2ae8415782746dc62358fff180fa7ac4
SHA1

62b6ee953e4a8cb6a1adf6751329200c0f30b609
SHA256

09c15303588419c4b5039740ffee6c33b87be80efdd1932b3379db81ca0e50a8
SHA512

71ea3db247cad49176a53c2b3609833f53384f4e83cc5dead5bc82850de33b339e8f3131033e0a8e646f5851afc17e9742643d2767d44f5348dc89600dc62d7f
SSDEEP

1536:SmCvx0E5mHT6lOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SmCmEK9yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000430a564f9ffe9d3bb221791227d7a7f3c618f3bb6fa0843d6041165bb2282f7d000000000e80000000020000200000004de66a75358d4beb2b9df5ab7265a87e0505812fc3ac7f4490388bfd637b6bdc200000004345782763e5f0b981dd15e0c2790ff82656b4003faa51ee1107c0c3d313786d400000008de1374115a352b9bc0287576e5cee8b25b5af3314fc10035f4e34fd011c37e25ef6258c7f1ae810c41b1fced1465bdd49ce0b8d3f1050e1487b680cebece2e7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0043fb3530a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E1AF4B1-0E23-11EF-B3A2-4205ACB4EED4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421434813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000344d45a4b3fe8e9513b349af39e96a4d9e6f0c0ca89267668371780a941a57f000000000e8000000002000020000000a251331138117f3954d14087f2e227199a989ff0f44bc1a9899a1e4e2fb19a18900000003e1233f672cf642fb3fd222c1000484eb40ac004dbdd64d72616b6550ad52d9b905b0febd5ad7d7365a92bb890e9c437043ca053a094de5185f4b04ddff5991cce6cdf7f26af547fd3dff1c3a9b1832a2a9ed6fd26a10b045d76ef9116ddb4be63beee65b2039725cf1592d379a2ee2f56168da668bf050666e813860a8c84f2bb1a36a3bc8579388961530da7c94d0140000000fe9048a08336b2c592c1ca57034497d38a40494c6858c8f57bed722b0b24dcc4f2c8cd79f2294b15af0e7bd8b5c204066652a9f55632a91cf6115d9f3420ce45	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2576	iexplore.exe
2576	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1720	2576	iexplore.exe	28
PID 2576 wrote to memory of 1720	2576	iexplore.exe	28
PID 2576 wrote to memory of 1720	2576	iexplore.exe	28
PID 2576 wrote to memory of 1720	2576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ae8415782746dc62358fff180fa7ac4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eff095ac66dc0346cf807803f21b3b9

SHA1
c4b34522c35f232e038457c3c7c8b5280a659676

SHA256
bffefd26b8b4b25d79fd5fa442adacef404aeb581f1c953c92b4b61864eb3825

SHA512
4bea79ac02f972a878e76345c3c2df94dcaa61b83b7da5ec36f47506b5757673d3d9c26c325f28367a1b6d085d64edaa819c9350c6cb7ab4d6beac8ba64ac3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2be5c186915afb5fb2efce3cf107d13

SHA1
29feb16e7e6fb07f91185718e124b7e7523767d5

SHA256
65580675ac38159258efb95e18b4e8e64a29c335f30f860913dfec89962bef1a

SHA512
30c27167162ba63375c533824b70cceefdd3db7e3732964c2017165153b028ecfe79823bebe742c2c43a6a1edbd23ba5e338dee080808ed09594039e8d150e09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d6f25d8bf4ac28dbce1240a5a682437

SHA1
17c6ae853bcbb0f6c610aa5db75ac0d86ecb950e

SHA256
f29b20bd2dee6b6baf6a041f9c12b693d9f6bcce60602c4a0f07c5d0b8c4bb27

SHA512
b90456348c349d7f667ed0b340c7e71c8dffd189332da514993e61a94b87382852d6e084aecf19b2a8f877ad8b0bd2369917dcfd6c54b60b546f42e0fcf9f214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
552bf9d0471746b97b9e7fc21e50568e

SHA1
563285daa3dbee0225bcf960a0d3a3b8ff24755c

SHA256
f0bc4b8bda120ebe33d9cf06d49d0f4a2215bd18d5be609e84e5755cd9be5970

SHA512
1bfab78fbfb75c56392ff0672d805ddecd15534f6a507ae0cfd8d2074c1f0f4894788a843fa98659612f6a2c0d679f3aea120cedb1f1f65acf4f98ab0d15d1df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d2afacf52053ca44fc61241c1f6ff06

SHA1
826faaaf1272fb1547b868a47b35178b0bef4d12

SHA256
2bdc367d4207189daffafdf1aa868ed7b8a837427383a87112b17982af0f9158

SHA512
775091255f1e1f3108f94c3ad9d60a4c03d32d1333aeb0f3ee3c32b0b58ea4d6433ad8bfa892299b18d2062e0a177d9c076fbc407cd440ba3986157f8623967c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00cefcba6dc08c350baaec1f50baae79

SHA1
975104f92d69efb4dc29c942637eb34963afbb37

SHA256
4a3557938ab0f69b1c79cb74716134949602f7614d216719eecf7259d9cf3feb

SHA512
c0074e1167d2f160ce8183f2d7b37de7a3c02900e3d0ae311c555e2605bd86b40507074cd8e3bbe3904bb30996257f43b6242ddef5209cb193ef8bd7c5144878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f49ca63fa70a9dbabafa29d818877569

SHA1
d7987fb763b8892e1a28dbc0009cbca8139fdafe

SHA256
071c0e8fcbce2fdc9c2914879dabba6c8b5fb55d8406783daa04c778f4e62fc1

SHA512
6f3793fb4ea5fbe1c607148c119a38dde0d2baf5294927f1fc50f52c81db1b3fa7cd3b8072035a93edd1f4931e929fe0e24929c7b3ea515354e2992e05c9eb81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4007014cf56463a22fa956bbd526a09e

SHA1
d3c8fd11ff45e5c19108c06998b2b1a87c01ccfb

SHA256
dc9bf7898bf6c89adfac73bc29906cf6161a8235d05831e57225a755d29165d0

SHA512
1d8de17ba49281b7e51da4c62af40ec7598e73435afc71f664e92ab5a5f6ea3fd521ded53f08df0fd99473f4816293a4c4ac7bd96b9ec3a394a654cb74bd4791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef474e020207c5552621369d6ce62cc3

SHA1
2393a119e51145b986848faff40438a58fad5172

SHA256
5a341b8ee014bc3a61313a8edd192a5af47b0795c8f89099bae15e72f279da99

SHA512
7de7ea3777d65ab8e23d88cec8769b8cb9cd55cf27d506e4c7482ea595f91b02fb5f25badef848fba1e33b324d91666ad578ad2811196a593ee958b4ae4a0cd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
260076d06c99768e03dc6524fe1363c0

SHA1
24b3a06fd03dc627d180154fe7d31ac3b849dd98

SHA256
b041e71910bbdabe0071adcb1a7af5cd889e35c445a7a391c2f7402daaf4b3a7

SHA512
08b0b508f5ae57f1191f493f4ae6ff19adc1d727faae5e9e184d3520e6d9fad3b1cf728635e1ea568f4abaa55a1100d1360da80a77a38b8ec6def218bc16b9bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7587ba56933b0fe2515906151f472820

SHA1
d3a8165a61de8795b1c96016cedf71543cd15c47

SHA256
496166138a4e9b6120fa880d56830d699d548af4dbbc9f9adf6a60c585f7d489

SHA512
1c5b52c1d88424214b6ebbc012e72210b02638c3050dc84041e0e2940a3455fc03e629e6600873e3400338eafb0f11f32d99b361604fe15a12a87c12860099d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cded70aa0b689ff776abd9471d66b9d

SHA1
edc6e4484418e8599119809e351d09c459fd4569

SHA256
943abfa94e34b21810cdb73bc3536405da3a2b1d3387ef6805588ff19a8748f0

SHA512
00aa941c156589401c2912013f98c8dc5d304bcc2df5413aafeafa047114cde699312568fa095b548902858fa38c631e8445acc12ebee5b728630119179ed7bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d50e70d5272af4ad1becff812fcb6cbe

SHA1
b1fdba6336b086cf120e63d6d485500fc9513bde

SHA256
5c70b94c54fddf6c4bb824aa8f6b03b2a924f2489b399c523526acc11fece134

SHA512
3e898086f5a0ec50821e99b1560e5437c0c1ef2aaca31eb10c380b6987189e5122d682b50955bbeeea7647d1f3c9a13bdcd7c0af5650375b45d07db3db0d3773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c8aa37dd0062d8e4c09069c9b363686

SHA1
b5d5cd687284ba7c022627f0c200b0c4abc04c4a

SHA256
6ab1bfbdc85164429c49c984691248a45679925e9a17a88ef31b054879d91b99

SHA512
af97d89acaf636a2417c8474b648e8fdf271acf5804542bed52ef148dfdcd6a43a7a95ed0e53a48861f11ddece5304d0db7482a3564da374896c2a0ea9e5b6d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AB4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B14.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit