356fdd81374913a5a87dde8cd181eff19e44e70540590023934fb2931f413f7a

Analysis

max time kernel
140s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ac7ead506869b1316d2fd8bfb8d8262_JaffaCakes118.html
Size

21KB
MD5

2ac7ead506869b1316d2fd8bfb8d8262
SHA1

d09e43ef168e7deac7103c5e252bdd6d020611c0
SHA256

356fdd81374913a5a87dde8cd181eff19e44e70540590023934fb2931f413f7a
SHA512

d80f9053f40d4bae99808910a4d28e5fe8c09ee1994370bfa346b548fe440e673717d9a45f31f57293639891d341ea946e4550070cbb99e33d8de7fe70b949e8
SSDEEP

384:IbAAgw1u1EiCfnI6TexeRz0/exOff/LvnNpEVsbfqDpLKxsWqshe8eO7Ntes6xFg:IbA7w1uifI6aQz02G/LvnNpEafqDp+xV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000008ce77e7d8e4485ce872914cfd255f03f0b1a5b6cf9cf89d7a2124989e15f6a2000000000e8000000002000020000000980bf95fc9f09490d737d68f5baf227ca91fef8145054fe1e38c7a92e9b9df5520000000dc2a56631d2ed3ed7df7d1aca002c321ce25e8520e90d41a385b29438c49723940000000593070510b609abe226ac8ef9c45034644cfc2fb17b979f415884ca601044ccb7a9032f64ddd34abf49e5e517766418d3716653e3f4a1a7590b6ec216b3806c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d050aeb32ba2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421432985"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8553FC1-0E1E-11EF-917A-EA263619F6CB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ee7ce237d5411e4a0a2ec6393a7c9afd35b466fc70c6a9334286403b9797b7d4000000000e80000000020000200000004794d18c8a41577ad3439d4101be238f0889b7a2c323012ce5f4045f229c46eb9000000077afba46f1e4c216b2d98a2acabd812413544f26b374cc36493275d95edfa8c2b4223f17d1acb1a987dff2424ade3390d46460a974f15b17083bacee4141133db23603d0b91873b9b93c8af4f765cff3b8095d87f3cf51aee6bbd6c1f618b86457cd5434918bd6d371a47654101e13b20c118cd438561853237aafe14d38364ae0887f6fcb9f2acbae2251404a5b651040000000f62ce4b654da98332d4dc6b2b93d0511b47d2873e5fcf168e510068572fe3c0a7a200420cb58eb60132acd75a51dd8ae82e0df65633d1b01f877f4dbe9cdae18	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2340	2884	iexplore.exe	28
PID 2884 wrote to memory of 2340	2884	iexplore.exe	28
PID 2884 wrote to memory of 2340	2884	iexplore.exe	28
PID 2884 wrote to memory of 2340	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ac7ead506869b1316d2fd8bfb8d8262_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36eda8dbf88b8e6da9939e78c6087c7e

SHA1
29826b2ac700feb8595f348a3c2d4b91c90a7c29

SHA256
8a4ff72a1bdd2496d1ab2bb479dded9f6945bcbd71ef90d5b2af685c83618297

SHA512
9281a50e4c4ff482ec155eb7584195426e5f8863e2c82ffa53ae512d21259d8d185836ae65674c777d32e488bfe60544954f8b0867070180c3a07086c0e9cd8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3c20b029303dcae8a4c207879e2adea

SHA1
898d5cbc202d4d773281a1cdd6079d689eeca3e0

SHA256
13e38e8e8edb7e87201614ef27b4730aa7336988b34a95f00e887e005e64736c

SHA512
76db8f749eb746140f4654e122b2f1ab23842764f4dc56fbb99dc974121625e2c50da29068240a02e659fd4d803f4ff560d817e968fd26f479a12881c42d798a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7e98f147deabcb0fc4a5cf0d880bd93

SHA1
cfc9e7f424cd0cae4d8aa7ef3e7efdfcff4d1715

SHA256
1e67d063ec4675435f57098580c68d6cde548723bbbb76cc6eb265e4d9e164f0

SHA512
999372b48f362d5c20a008e9edf12ab39bedba7815502a284d40352852841c1aba139e290eb76c309187f132e325bbe8b5de6a2ce5f1b74e1f1823510f2b1864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
935d0e605e3834639c04c1d7406aa799

SHA1
841fcaf928d62a8069897d059613ee4ff1742864

SHA256
6dd4b3831180d02389e3abee03426556d71dccc73a1ce04b29db86884849e115

SHA512
7791e1ac5189c9cb825a71fa38abc318d5025ad9fb345b30fc886ed0e64fe4448a9d8968bb3b0f7a143ac9cc46428b54458f77b15de115efdb113180fadbf830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fdebd89c7c72d0ebc886f28023310d1

SHA1
c487563fb17f04a65ff55d6049e1e2dbd0060944

SHA256
7ba530091144f660ae81f8cbb907fff03db08007a9b63aec2d31503a9ef00f78

SHA512
a5ab200eca88de328b32afec1ef6586d6fdd74d9bbe6bf8c76ba9b2ac47c9fd8889861fd504f6811f4926af959dd0cb348b58bd8d7b266ec1741417432430677

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3519a00ff2174d7f7c8aa6b95c664575

SHA1
b6710b45b95b8f106321f5eb8cb5205f46c7d1d7

SHA256
80e5b060dc9529d1303d3271d5232c2d87827105fd53c3eb57d6973ae2942c57

SHA512
79648fe0a49744496ec7bd3d3f58fd8ef8a54754d611c9d5c2429ebcb33a43809df63178d955ae7e134be0623a9077b3df7e341e588ef36695efe30bc7de21c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8e091c9f987cb248d21be43cf7ff591

SHA1
a054cd7d06584bb05c0ddaa5c77a613976650f36

SHA256
3c4737f903603c10fa69300f9a5cdb3673e38734a67e666e807dfc87ab47f175

SHA512
9f2592eefda11a7345d935a8cf3c0538e2eed2e5dfeffb97b50706245c0ef437f9cd55e9e1d280054cd4e251c43cceb166d4fd738da29ed0a5f3f5060213c77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd76199378a8cbfb501f30b90127015

SHA1
8e5febbc47bac7003696b81e1168ca1d1985d01a

SHA256
e86275ab544363f634eb2352dc7e0e53053f25e4b7f79ae59aa25b6e31d6acbb

SHA512
a7d2b403f010e5f6cde48410286f88a1487f5072b69030f41a1bd2cdf88751f91dad220bd5a0a8495f13a30d66e94bb9fc76b6fbd82fcf439da7adc68730cbce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c537cfe10e8e7c498f059e40d10a0bf

SHA1
c783c3d18e60b83c89ec413778bbbb56c96b7558

SHA256
2886cc42b277c8d8f5e80d4dea84ed4d19bb6b691fba7057f29ef2dcd5662e49

SHA512
6ec4fbb67b0fba4229582d92be33a109aae80db8e74b2d37d70cca6e040034f89fa53ea12db22e25186dd9011483cde5fbba65289e25bfc02477d58aab0240e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c1a490bcba99cf25e02148bcd0471d3

SHA1
096e3103da6bd5ea059d9fce6d6d223c66bf393c

SHA256
83c1412c6dfc296c7c100a14dabc449e17e3bfc6426dd57ce65025283c467e5c

SHA512
3cc7364b5a2e8ff57f4b0860a536a5042d9ec20f7308b1a35ff9017e11f895db6a6ec0e375d4e063e3d62e784e2c253dbbc938a0ce0f0682cd81949184bfab8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e7ceee0e5ade85a06436ea73c6e7a2e

SHA1
e85d3d4b9adc9846e1e0c51a1dcd63a4ff86a10f

SHA256
978af8a83f7cc296bab8cf01a5bfefca9d4b355b5b83d990b86ce3b41f3f9267

SHA512
76c5874affe6a7658d3135cb3f2aef0d5816b08576fcfabcd6b3a0a962ca8a805c319d52d1ba00e83f63218249dcbde4b693b7e8b37ca8576489e3fc79efa7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52B5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5396.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit