a27c419cbbd1e28f814da621615de9cf3d779188f3b6023b31694c49d46d791d

Analysis

max time kernel
139s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b0ecfcb2c5c6ed65724e11ec37b72d8_JaffaCakes118.html
Size

18KB
MD5

2b0ecfcb2c5c6ed65724e11ec37b72d8
SHA1

d51fa716974d2a839d12cc3d8b57fdf933578397
SHA256

a27c419cbbd1e28f814da621615de9cf3d779188f3b6023b31694c49d46d791d
SHA512

e2f846151a2183aafd52edfaa78022d2f8210167599611d90b3bda3dc7aa319009440a5acfdbca56c7c4d4e983cf599cc422a390c383971aa666d2a9ade6110d
SSDEEP

384:OhhEqcOku4qD+1QPmNAydtqg8EtRm2WrNO6NRCE3L/+1LXDi:VfOkSy+PE8f2WtNsHDi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BDD6DB1-0E29-11EF-B2DC-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000759ab0d3b326f2da9892ee59b282394d3a2db301cd3b17066c8a46d33e8bfe62000000000e8000000002000020000000a7ab5b7dcd50f87616a1c1e0f7019b9c7564f6d21cefa4480e7a1e6b66892ab190000000464f2046a8e90b929f571d5013fe2e189f44d9c354c04e61b44447d37bba66b2686e13abf4b0391e90ff2297cca8a42a632fd97fb68919eb399f548a8d9bc5c44cd7b8e02cbf73cad33ba646e1c8038f517035c1647fa31d16a1e0d73596c108ba0bb378fff747fc55f593119e42234a6c504b50f2566530f6a61997c6b9c728598003a745c19146ac5497a0497352c14000000035ca8ae919342f73807f85d84521456af25dcde091faad44e2baef5ec4e57d700c0e0039c51696215336dea457adf2897d9c9dd50ae20b9a2b8b7b0ca30e7947	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e8c15d33e899d2f5cd1019008cda8a0efda25edbed831008ce981c5f22b4978b000000000e80000000020000200000000720040baa2ea60125cea6681934266be5342218aae85ed8833d7aba5361a2f620000000b656a454fbbe9628c0c7ba45763265205f05d5b510c84c96a6dcd5815a2ee8fc4000000084482f9a39a5f592ab416c515abd0cf08dd76ca33db8af65ec044a11df9599445661bebd2e713cec203b501a2dd9b32b70e90a7e6260fdeffc5f00fd0d95fc67	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421437442"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a2721136a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2892	iexplore.exe
2892	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2456	2892	iexplore.exe	28
PID 2892 wrote to memory of 2456	2892	iexplore.exe	28
PID 2892 wrote to memory of 2456	2892	iexplore.exe	28
PID 2892 wrote to memory of 2456	2892	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b0ecfcb2c5c6ed65724e11ec37b72d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d577e86b12e09800e3493e038ba90c6

SHA1
2b5ec93b12d01b0661eebc62d7c8cd4f24e93174

SHA256
137a9cf9c2135e724a4142da43bba7db444505636287f8500d963d59dce1bfb6

SHA512
75dac816881766882e7f897af8b56748f8e56f78b39264efc4589195e1381ddefc04b8aacd9fc9b7543b9c63cf9ecd8f5b6838da905a7cd67e24f3002a166737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc12a5a68ce3981a4db27788d18b42cb

SHA1
cd8ffb653e4d261477a6334b9b9e28f4b7bf2179

SHA256
eb6a73151f0cabccd07df2c9adc4e0fe1f79f91025c6e8e0f0ffa6d0737c91d5

SHA512
7e2dffbbc10bf20ea95282bd784d7236a2939580fe152171d760c2503116f274cc1976ac0bb4e92cd1d8075f6d37fe02b3ae284c74f6ec2955433a9da3fe3e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f07c6644434318fcaab60e84c44616d5

SHA1
5245154779970ac793dc6badfd10d949faf50364

SHA256
21fffc641256d597d7a9b58a9e2fbd783086ad31d5aa79cdd07907dce6b6f2e4

SHA512
bd2ac333221c3d246f1ab8e29f836bb9f5d6aef1cefacab0ad5cff1a985f1090ff60902c814511a804168741a6e7ef52ff63845ba271b02f295032cf7c94dec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15ecb8e72594d12aa03473a184754d1e

SHA1
8a5fd814eb2ff1ce3ec34aa53fac525c31c117d5

SHA256
1ba256593120713bbdaad92ef09efd36ab40ee54b74e6699d199545f6134a5a8

SHA512
43a5a8a933a777b4213bf63dfa3ba4006833905998796615f995e4c7062f2420c249e85878c480ed56fc07498346ea7b92b16bf36debdd7487501b5126c97f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52ae8ee553aec44b1f8ff71c36d8ddce

SHA1
efd90f996b08d91052c84d2af447933457d899e7

SHA256
e7f3873f95a98a9b064c68ae2629194257e69c9732736914b674e555f4e1c5e1

SHA512
b8d57bb1c5785feaf8b51f89ee59438b0cc0204163cad241b46b225da96460244c9a205f923180c5752fadffd4aef72c2663c7d2650ec1f61a69bcf346dc64fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de87419a732d368fa65d7a563d33506

SHA1
73b4b765bc6fb6a636fc5382af19339263386b4b

SHA256
bcc28c086bc4515552f00ce96f5a5d5dd9843da955d79d41906a201b30e69135

SHA512
34d589f8aeb9d666dab558688976a79cf6d46cf55245932d988b7fa983ce51b540b1b61a584cafd8dcfcf364feaee940095ac5c8300b3c5d5a4947c12fb94b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1ae0fd262db0e149544302d1239d3c5

SHA1
7eb0eb95f87f1175e689f45f470d72971fd8096c

SHA256
0b289f31f5745c04c47be6fdb8a2bb52f43bf903791c4894b863a8de1265ac01

SHA512
4464a92191aff2c849c756be8075aba6ab770fdf3fc0e0430d1a64610d2e73ad51ba0e3dcb7898e74671d9d14885fccfd8833e28abb94886f4eac1d7706cbb2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b87cbf374eec6108979accd39e29b0f

SHA1
d4f8d782bbe0ae2d0b81d2c6153e7dc47c38b8b5

SHA256
c1c5df5f85f9efa47bf1eb91815ff894bfb56339ac9b805f87d84e854cd2ee45

SHA512
96ae1496adea87078c7bbb0621ebfef948eed24e189fd979209a59dd19c5fd63b06b176a60e540ca876d4f2ad6770cdc2dc749159f845f17b115ff336f032618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcdfa83fea78b8ddcc00226c7c33b040

SHA1
c641cc3a55096f8cc240050d4ee136cffc522d85

SHA256
f51cfcaf3693f2483b41fa337f13f4bca653691a40f589107221b585bfd8daa9

SHA512
4dee83785b9f55625eb0a955d3ff5e435523480f2ab79700d912bac6750b2bf8f293c15f0424afa78c8002be6a2e34415e5a4c0bda0a7ae697f111acb9fec03f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
935a78666d684a175c8b240bd618a1f9

SHA1
06edcf7eefea5656c3004486a14067abfbb87c50

SHA256
ea109a4ca37853a0ef87993b2609d739b86f0ad1515664237f2b06f7b3300597

SHA512
9f0a2be03f23363958f5d5c14a82b1b8129eac5735895cd130a5b3b796af426fbbbec63eea5706b7f6265e453d37fd31ad3be9eebb58c71539b2ecd0b7c6ea19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aa1c495a2ce58ddaf2d998f03cfbc1b

SHA1
17e602436c93193c505b3877200b1b8a8761bc14

SHA256
1f05ff9163c733a62fd187365a44afcb7063a4e5f36f8b488250556fe9476db0

SHA512
a3313aec2c45515085d81c7b57d7c77ea1918c2bab1d73f0d2f4ded33eda651178578971c28f35a4f44c769bc36458b21fcdc33d3dd72369435258ce8b6c2c67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b8d5aebbfc7856ca6e299ceb72aacbe

SHA1
3c5244367f95b0b585ebd744766ca1e3344c5d8e

SHA256
78cc5cc83bb0014ee2df6cc867bc232c0fe6ace8b8278198af3b9a04d029da9b

SHA512
921ac1d0efa9f7549794b7c358c558c6334247f7932370e8b6fcef0b0eae2a70c73e0a4c890882ca8c9e2ec240395b65f88e130be51e3319b7e2126e1bc76bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b602d5a936c6f7ba84383ad0d744b15

SHA1
960aaf63ab70c08861b711ecf76d9bb8f243eb82

SHA256
ce44104bf9a478af1d43e3665b9475f60969f30f18de686f60f2c82b34df61f5

SHA512
0490e0a1fc0045bbe6fe2b515c9db4c1815afbbbc8d3ed4ff8df6654b661ed0f1de125ab001e19e62b6c9ea312927ee20f8df100c80c1163b7ba156bbc09c3ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
830a3048561a1f0c4174e2680507aab3

SHA1
7149ea1c60b3cf9096a50c993385cdc2bd04a30b

SHA256
58b531d2d894ec1826c299997a77e04069ccfa2746a1ea912ad93f3eec6dfe29

SHA512
8a7c0b17bcb699cabfc86ac129e06d677be7089a4cfcaeadc3efebe4a78a58cffa5785559d7d7f7aa31968c2a76441013cd58de40d682e012ba8e0e7e6293b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6a730b7edfdd8d974c2995625876c24

SHA1
a4fbd20c1f85e0bc1994d198fe42314d757caae9

SHA256
92ebdf6ef6b4ceadee3b317b238cd5d9ed143ac0219f0cf79773d08e47144425

SHA512
78096bd89fa0c05677810381c7d62f4efbc7d548a75d5e332dcea9e4e5475314236f2ce1e565062970a5d274d6d74b06f4e1ffd3d5f1d8ca8992481c40241f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b705b0f7950c941b76593e0595d198e5

SHA1
85dadda078c96564cb407368654f0e4224f32c5f

SHA256
b25e16df7a18cda80eea394e1c3ecffd978e1350f92b3aaa97b0aa3a7cff251a

SHA512
1bd8434753e338ee59dba780e6550ea2164a6cee0cd1080733ddff07260b710b1268a10a44f3ec38f81d79535b253a89abe1eeca72f73933eb30cc37c798361c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAED6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFC4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAFE9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit