f00991e071f773fffd086e191f93aee1b4c1b9ca6fb0c855721ba6a4d1a278bf

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ac932f554a77e2806bded19ab38cf42_JaffaCakes118.html
Size

19KB
MD5

2ac932f554a77e2806bded19ab38cf42
SHA1

6822b1198196944f8c7be93778e4908f26038828
SHA256

f00991e071f773fffd086e191f93aee1b4c1b9ca6fb0c855721ba6a4d1a278bf
SHA512

3861f4d9524101225abfccb916a3ada5e36c68b747033628466a30f96a787ec8561a02b733d43ebf2babae1c56de69493c77856657cff81b650d10bf8189166a
SSDEEP

192:uwTLb5nDFnQjxn5Q/CnQie5NnCnQOkEntWInQTbn9nQmSgHMBZqnYnQ5cNnlnQVR:0Q/pq6NX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CBE8BE1-0E1F-11EF-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08ccfe12ba2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004f6917059976616afd1019ae0d5898af1d4cbdfee00bd3ac876fe5e0861cec0c000000000e80000000020000200000008065bcf5e87f2b7ee13c401ab3fe2e00402ae0292c3b5cfaac0d287acffcdc50900000006d24a92dc869909c31254c5716a61b214a359df5691012c914ee3c5f5226a06f6470840fe795b0734c42d5ef6db96a8a88757007f4c97274bca460e61099e98ad955ec86361f969320cb56dd366ab574b3587f100cae1a3fdfe5343527a8f35413d57321e3cd68d9c16a26ebdf4eec5c7c7e7c740aaa1489ba547b7474d809d41a25e49469196e397a95362ba6f76386400000008f66e7c8715acb1df6c4c9f27cd2923be8abfaa16bc177356a8cd8cd7d4122b98d7a9c2359859ab76943c3d0b03a14c3ceb045c05774793a0049d4c54c8a21ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000982bc60f82f6b276096d14dd838f5cb8867d0878985a89f3e3196abc974b7818000000000e800000000200002000000080687c0660dc89686b436a08d84aa306a9d8454de9f789bbae8c84602233d0ef200000005849f2e68c345683b5a2bb80e390fa16384e71aeca1b7b9d3e2bf7a68b4495be40000000f2421f21da814868c96428d16e6d2b790b43f8df7dc8a07c38827106a82c5326f6c4cbeb62743521fb5329498067d267c844c5953b1cce8d7361b71ed45c73b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421433068"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3000	2648	iexplore.exe	28
PID 2648 wrote to memory of 3000	2648	iexplore.exe	28
PID 2648 wrote to memory of 3000	2648	iexplore.exe	28
PID 2648 wrote to memory of 3000	2648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ac932f554a77e2806bded19ab38cf42_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
285bf326b0fe5a2747dae68c912b51a0

SHA1
c53107815b40971093c817365a729514a768bcc5

SHA256
08fd01051197f199cf3180e72dc6313584c9e1ba2fd76038419673f15e771b9b

SHA512
94f981851c4737bc3463cb2cf1ea12929b9def1cceb4f90d7c76b4a0f986b8507fa5b26ae2a2511b5d23d387851dc0dcccd31f58fae3c13fd43dbd058292fd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d1992016e1357026003ebb8e2f510c6

SHA1
e75392685a7a50e80a2f761bb85ad273aa76c6c8

SHA256
d282785ca7b264482e06e91cc480370799962c727f385f459c7e0c1364d41192

SHA512
07aa01a1fc100a82a57c081315423dc90b416f2685099629623c31cb22376ffe6bae6b89566e58a91df01147ab10746e6e0c9f75ea5f2ce33f5c41c15fa22441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c9f46085791002ec6c66521860dd450

SHA1
0fe2fb7d7ce22bc05d7ce33c36ed95c29a7b3fbc

SHA256
263848b32df85609eafc528531d2ccbb02e093efe776ed8809b4bf990e74dbb5

SHA512
11443f9f52dc5613aed79949fbee5b5575c49aa88c7aed886f5fe042f735b8de156bf293e144d59dbd11db7a7e2e27be37f0767ffefc3c3bea1d3ce74ea65c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a6afb953d9e953f16b66bd1f4303773

SHA1
f7a60970fa82c839523bf8776a0bca422e64f287

SHA256
bf8877bfcf0d4849c31366736a2f05762b66722f26b88900665de790451ff6a5

SHA512
3c213c004722087b2836092c7024f87af0cec74d5d7c8a97ef18bb3196673b7f380ca176952623b3de8e561314c829734975c9b9cbe6a31285a1a20f6d10307f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c85f926b0565ba4a8a347b23c39b6d9c

SHA1
23927984eeff63dfe8a0f817b712e6a689934009

SHA256
3d1b06670131ffd2edfe5109211b6ee197cf094309f9394a9564f9caf5d14ba1

SHA512
21ac8a5ae297a3aea176ba78862b02a554324e1466fb40b4d61faf6fd2015a85986bdd809060d2028fdf25906bb6c2df109b71b9b1345d4e3e488751b31f7a68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75b18fd3e9f34c5ad8aa1e45c76d863a

SHA1
2961aa5e7222f845d86a1aa9777a78e1c3345147

SHA256
720fd71c441fc3f583df550f015ba89f6c9e1f28dbadb4a15d8a5057cd916994

SHA512
1ef1677503967b73e5c0a52fc9903be7b9b1e67dda793bb98fe08fc61e48a3c205d0a8f228939ec29947efcfe57cc8468839a21c72196899b4781ebc7a27597b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac45370cb740bff2adee8e52171ac2a1

SHA1
3bfcbb335e8639ebe838439d71722e575f3cfc41

SHA256
e2e52cd8704afeabc961f3df077aac74cbe4946f64e94fd4591bcd3ba6897d71

SHA512
1dc2b3248726e1a6b76eeac76fc082d1c4c8ab64ad3bca86efe498cd932e4581e51c9d3893b429ab975d599df4832a1f4db3531d4613c3c4b65dde9b79421b70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07c1d3a70efcb26db11efdc4fa1620d3

SHA1
4fcab2accabbaa77733f1764520d97767089e547

SHA256
d8f6673ba658b12c6a6776bb946bc9bc240b86808e475fcae96f77b09f9e70ca

SHA512
acf8d0f36ac25d12670dfff0ef969df7a8c9ea6aa319937fd6f339e1498f8507412b2f2de80956f50b2c9f6b6916e201ac12bbfa70f9650d78c26323629d88f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b11f3cb43022c36e65bcd7f95acd1c9f

SHA1
a09568534c5e984517a7ddb2a5dd49731de3435b

SHA256
0dcdbbe8d410fd3b533b6c8d13038208b6d381ea8f1c32cc8efb45209021c434

SHA512
691fe3b2989b5ab0c52cda40243b002c86e223d84ff0c3bedf4f6406f046dddb3a794b09084c645bbcc47d8d27e5ddc65a0a13f00cb244d0e8477668369a759e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66a8f56b8d4c446fefa0fdc171ecc1a6

SHA1
29a2fab3f755103454b9db0410fb35ccf6258f49

SHA256
d02d30e074a127f4373fd86a5315d4b6dc96090d8095b67c7cad25771e9d3872

SHA512
247b1763a3576e882de1d68d599cc715443fe4c64b84abd73478391cc21d0b8e97150a42cc3dd10296d2cc2df7c6fac0a087aa7723d0aa03d86bda63569ea02c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e1e155a7b67f2aea91bf16dd33a54ab

SHA1
958db223aa7ede4eedd2843cfc9959827db89699

SHA256
dc86115e27d4f0a4cf570b27f17ff41bab403e9e3b39ce8185cecb11ac385153

SHA512
40f8fbb5b5ef861dbecf726745a3bc69dd9d0bcb0c29c34c92bbbae222bf570664f43cdcd84f4de65d4900cad5c16b4ca39f6c1c5b31b333317d1e39481b5aeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
311ca84da42c018a3d618bf7d730916a

SHA1
c19f82734d953c329751c760a9a0f7d03b6d6806

SHA256
9b105969044308b5741570d6e113217c033c47021cca1708c812c800abcf02d0

SHA512
2618cad08b788accfccd65c825ae09648cd910b93cedc630f974da65d852ec383b1d473e803d1ece8e41f0f7a3150acdde94540f4559d2375834ebe8ba93a45e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
644c203093d47572d9f7fc54d20d9641

SHA1
2ddcc7dbcecd250de49938174c788904fba43f4d

SHA256
2ea53e921eaa4948a2ec0a838d038d4424d7732b814a6d3d7d0085959acb8c04

SHA512
14cdef2e4229e2dd9c6c29d74d0e75c43bdc0aed80eef9f3535cdf17c6e5b2d260f3cea7dd8adeb67eb01d6f1e77c61074bb1c09db240333d0f8433c90b04cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df40561af765b60f13cad3aa3afcafc5

SHA1
6a68de5ea659ef5e21c42d8256f584f8b0d61621

SHA256
6b37122314cae965b042a0c34f5df079f7fb89d995bcdf134339e3ca1590ea14

SHA512
4cd8a096671d5724e62a1897e27ee4b24f5e2900980e1d9e8ead17e8168f089d64aa7c0b5f81b22f8cee7b985717e37e888296a124a58b5694464cb8fdbf4ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB952.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBAA2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit