a9abd67cbc4778a3f29a6b3f4eb0a4dae77152f9adf9125f7d3310d1a8826dbf

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ac035374b943b3980c751cdd5da6359_JaffaCakes118.html
Size

13KB
MD5

2ac035374b943b3980c751cdd5da6359
SHA1

a73f9b4ddae5d286be0d1eb191c91637b1e2b513
SHA256

a9abd67cbc4778a3f29a6b3f4eb0a4dae77152f9adf9125f7d3310d1a8826dbf
SHA512

c454e29a963735ff60fb18faa14a1e07db2042e3be7a20bcc8897b5a91f4cc4a70d05e240eb6a4347935467e9a1f849069734529ed017e0b97e2a42a80bfe117
SSDEEP

384:ny0GnKHqOqPnCGQWvGa95cS3qwqQS5WtMOuohWaaB+HSFyQ:3GKKOqPqsGa95cS3qwqQS5WZUFj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008592b27ccc9bb821fc5f66ffe4b18c607f56f914cedd932e3a2d2dab1f07c638000000000e8000000002000020000000085705e34355c38d85fd32f6343f89fdb9296acedaf8f1df741b85a17e2c485b90000000adeeab66c3a138904b3f3ec8e99061a2c462b363f957170e827089b99a015e884ab5d4e08008d437b283878ece3a7f6b3f153ea2869a0b843836ccf7e285bd6ca116e532567b06f8818a1412a5f701d09f08202940818f7937faed6eb557bb21d52349d811856e22d0f2e43af33520492f4e0a6725c7ebcedc65896d290f3cfeaa459bdf9d59fc4a66bca07f728b3a53400000002eed60d211589427653e926208dc48c4de47dd7e170793009af4d7865117fe242f3cf1f24e982dedfd211d907255d62296656e93c956bbf3564ceb99f5297832	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804f91732aa2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000032b73b84174c0082e29d109f0d930aa6a74dd90230bb54135e6f81a48621b868000000000e8000000002000020000000bb5f4ae5c03b7eaf99732d771800ad8e2e5cc397abc9d5f3ffdebc45ad072f832000000075fdf9f92e00a5783680d80c79ed15e1b179fe10715d46fcbc8cfe919885d796400000003ae6401c4153e92a3d28f59582f3752efd28b6a26316fc46d1b95248bb56ac16ee0e2a97ca43b82e7b3a8078bc40bf8b30228b3abe80b0e0feef62ead417189b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421432454"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9ED65DC1-0E1D-11EF-A4F7-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2092	1252	iexplore.exe	28
PID 1252 wrote to memory of 2092	1252	iexplore.exe	28
PID 1252 wrote to memory of 2092	1252	iexplore.exe	28
PID 1252 wrote to memory of 2092	1252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ac035374b943b3980c751cdd5da6359_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57143e384d694542569c4893c69fbc0f

SHA1
dd6c514dd57d56562574456a63c0f9496c6872ed

SHA256
b7dfa7ce016774426944547ea1d538c1e6c3fb04730bed0f30ea0885d076210f

SHA512
f790b68d4586d6d8a37470b2c8d39f4c37898b6e05774f5939b0976a1237ab842b2ee63754c4189b51af5d6584ff9d0c9f557151e049162922ae7ce1c66bece7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af2f6802e1b1e3aec628e040adc8dddf

SHA1
7ff773da74c0dd95dc6ef678b338a54cf5afdd18

SHA256
1b9cc51e70eb00a33bc492e1bd4ee07eeeb2417481c896f7d8dd8091cc98e1fd

SHA512
1dbda8515713b5425ff060d223a7e95a84b5c979068f75de86a85a580c48ab2bc8934b2d4e77749d8edb575ff787a1b791bb34e9582dc99789c4f8e181e4908b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c0e4d3be002ede71981a71b722badb

SHA1
f90e86a58a1badc5026e4de136d94af44da98be8

SHA256
db50afd9120e85ad0f13d4f0e444422f93a90aa651ce098b32893889c6c519e1

SHA512
8cdc4dd1a9003494f83a7cc7800237c0535f62c20c6ad40f9b0d18cec989c6bcf32af3084b927814b4498983b47029309e067e5381bd55d1393d08d470643833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
726336929121d705ff157d6afcaa44b6

SHA1
6766e2a01f489ccbff7c0b6f0d34c9c6e596fb37

SHA256
fd975c7bb88ce5afb72014d6ac89694adf1bbca4c3d9f2fbcfdb858b277f467d

SHA512
ad04ef6a1f3b054652a10cc77454430c5da562f6c8216e4c208ae87ed4c55891039abf34cb818dce7f0deda44cec92491a5e9b561dac6c6aa7ca5273208c429e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e82a3ef3225605e6d1a9e77ff2385a59

SHA1
2b4fa6ab05bc6354e57302fb8d48a510613bbc86

SHA256
2c256f4fea870504d271f9b595b64f6972bf5cda90f57b954d9ce6f5b2d87809

SHA512
c2975ea5a0ac6f4a772138cf035e702188b91e3a059edefe8b0c7d5ba8827b36c298c836a18ff969d2a8fe0ef381f3a29b0677cd9f166acfe048e77405c142a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e37bbc44af657e37ca5af624e330b4da

SHA1
788dac91dbe556eab9d209454cdd0aaeffebfc1d

SHA256
1797e0bbf2a55124c531fd7b1890e2bc12322857780f2e0d576b6cdf291ffa9d

SHA512
4e9258797b808c9094c3553d9b48c25b7aff53fd0e7c1c9eac5b03361e6b158bc35f2c832be85242956d7496ba8d68f13ebf0a933742e89e3be65a05112cd5ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6acfe2d65701bdf5e05688b1742384a4

SHA1
7282f1631dec9c13ff7c4de39e2f1fe05b46cbd9

SHA256
8078ba81fbd2e52592a2be26de1f626ec6a1497be4e696a4393542bd785170f8

SHA512
fd6e63a007dd70b1e0e9e47defa57310e68f8a2b6d66c1d40f96d0f91d7a9a74fc60bfdacfdf145e206547d5cc5875254afd042bd5162d21eeadf10f45faf316

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5457f045a8c7f2047b23f2870ac3749

SHA1
75ddde65156a5c1402dfad1f86c64e64007462ed

SHA256
be3ca428d9c19fcdc3a3132c8dfa73ab774d3aac391070b4fbd6afbd2ca04da3

SHA512
f6584366ee58d356d8d041654fc090b89482bd471ed2d4b8d2d3d9a82ba4bdc1229a59e65f3bcc02c95c93ca99cb54b0c98b4d48a9022525bee9066c8480c4f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffadcf3e822688de32d236818234241e

SHA1
31ce879e60dcc43c89936a3a87fdf87bf9ec19b8

SHA256
503529df703f17ab1236c35e57b73dfd7bdfc7ce3a0113a7c0d989eccc47aecc

SHA512
0d84ba1ca5075fe99e41afb35a3ebb6845538d7a135dc1319a1af0fd1c4babf4db2d3fb1e5496df57973aa587ef05b660b116459ae9d2744035b19245ed4a5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
842bd67374e9072b8efce4ee53e3ffd6

SHA1
253e2f82c6a8599721700a04d3b413f6ec60f6d3

SHA256
9cc20033f552abfdfa9f7896039f1ff93ae8484e4ba20927ac9fbfbe32fc6b8b

SHA512
12dd1f89a684efcf4e0854e0657aa82cab21e2157717852e43560b79d6049c9b28158518112f3dd7f8055000cc5b0bbd0d4f088d81641877b1a882874d6c526d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f02a4f29bc31e1b6bea6079d7bd8b8a

SHA1
5185d0c27d7f28bf25cfff242e6d761e25e65f7f

SHA256
8531b085d6ee4bec2f48fd0094410bc32c7adbfaf9170f712434757920b63e55

SHA512
7b4d25c700b018d0fbd9635fa86c65cd8aceaa5717042c0d9c026a982e0af73904f71ef554070a440dc25d5e2801a318f411aab478905dfb4f450ca6923ab76f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cb62f6bd502299ef3673e3772917bba

SHA1
a162d4c676644d3f64db013308cc02e0de85d848

SHA256
04ac945ffc6d8cee0a337a8f6b19fd6076a5a34f7843afce60db39723bdb47ea

SHA512
9bd96687f9d26c139048a50be36f5c2f5a0fd3c22e0d9d04931e29d4363cc3d865359a49936f634d28ffe117987ae33209067ab64114d0455dfd831007f3d7ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fddc6aa044063f76a158b0c9b7d42a6

SHA1
589054dee0e7ae5e9f6e87a0d172994fc32cfda4

SHA256
6415a7f23a1660802b52f4a706b52251dbe2cf75062fcee4d7454b88e4dbb5d7

SHA512
9bbdf50c6166ff7ea2ab1aa0e33ee0c679fd17a417c49903e508655ad0f8b2b0a339e8a150f1548fd81aa5abd678c394cda0ff3bf62ecd6a5a07ac28964271b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdb427137f4b4ff4e4b7f84236088b91

SHA1
ca12132a3a4438cdb55fcd2724152368354a7f8c

SHA256
c8be5fa2c264554531f8a75cefe78aedce8a63cb1f02b73daaa8cc6af12ab42d

SHA512
cac7a857a8f37d7d7f6c6722a0ec17efac1f646be29c1da01db46509e989c4c05cb32c80dd72f894cc2a51bff5b4ad47d1909a729c04f4d718d9634d35ce0653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08cbe941890078a6e43fa308733a5683

SHA1
2f19fb180d6a2997f5275b4facc689d6c39d43b5

SHA256
6eb7213f5b02c386172e99c87ef956ce1071332348e6efe079db928791156f1c

SHA512
f1c2e713a6deaba194e88488aba383543cb00a7104d96dbda5b394bbe14cca52281d1d823f8494b4754733e7bb70e71ea5c69b0cc2f0d8d4d9d5c6939beb2ae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdc46acd9243f33947e66c38f02ab0f2

SHA1
da0a0e9f4df9cca72d7db6c8bebd131cd6b4f9e1

SHA256
8ea6c4eef428f92830557ab7966a4ed5a0b71ebc57afc371def0e94b5b7cb1bf

SHA512
509843f445967244cc141e8a40d5ecea43e8aa8c22c39b6e26f1bc90e1d57383aff93d5497aa69877a1b1041812203b706bac0e0fcf328427453f4ebe9bd4a7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4896.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4936.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit