d95066b67908c7211f3a8e3cd68ba60eeaff719069c91dd0648b9e38973c2a0d

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b48f8ea27682d08659a52f765a3b8bb_JaffaCakes118.html
Size

55KB
MD5

2b48f8ea27682d08659a52f765a3b8bb
SHA1

850cf3890006e1af0ecd571447776733cdb0d979
SHA256

d95066b67908c7211f3a8e3cd68ba60eeaff719069c91dd0648b9e38973c2a0d
SHA512

d5c9736a046905ad5176687f2b2566769e649f54afa13a536018c9d99289e3136dc1b37d9a844fa742c2972c5e258d45c1e418808998d6f032141fd464d88337
SSDEEP

1536:Mu2gIBKpwq+eeeE2uR+AvtkIgEv0svE5/FEr3NqE3rMK:Mu22uR+AYHsvkFA8M

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421440897"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003e93e72620d25aa8b476bcf25f8463508d1c2aee384228c13244b5e4be76fac0000000000e8000000002000020000000ee2b8d2033368610b87748727b1dcd59040c72917e96e7bc4c3d5a16a189a5309000000085095f5b945db7ee8353bfd02de77be6544c358c9cfe8831dde6ed3514cccb14666233db6e43b31155d6147210b310fedfe2df38b4d4fed9492c25a55b8c6ed464bb53316045bebc9a418743914e68476abd679be257f4dbaa6d69088160183eefcc0d34f507d6d5601ae6d499bc70a8758cc4fa86caa5c2b66bede7ff2a6b1c6eeceb9116810e2cf835c32aa44fb49e40000000d873e0c25807ba0c7010f55cea80987c13701110bba471f329fa7d7e8fbc93438d74602d7dd3489c0c65513a21de4546a10b25c1db1581e965c2b1ead2a22a50	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d850283ea2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48715521-0E31-11EF-965F-FA9381F5F0AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000af6581d687a414baed6044f636cd6c325b43b5c1f774c7179bc6aa38c09fefdc000000000e80000000020000200000005b97d8bf8c5a58051c1d0c0255ccd7efed14c00776d073c282020f477ebb2d852000000053374aa89b9149f6eb9c5c40cd8d833f219fa689f70ca363a0edcabbbc161f44400000004554abfe98744afa0cd519d9d284bbf0b92cab96f0a9abec69e74c296a825fc22aac5aea484390e21ae175de9ffae87862d68f37ed78641db051450adc3e16df	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1704	2176	iexplore.exe	28
PID 2176 wrote to memory of 1704	2176	iexplore.exe	28
PID 2176 wrote to memory of 1704	2176	iexplore.exe	28
PID 2176 wrote to memory of 1704	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b48f8ea27682d08659a52f765a3b8bb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04c1e648c8558d015f08f3ae526ba828

SHA1
85a93b749780b5c2357a6f290bf100145412ff85

SHA256
63258587c12dd0f1ad006ffff97f3db7d228b3496b8eca2f50e8fd731e9c87de

SHA512
e3a6a50b8fcd3230383febdac72f8a681893f87541693ffab8271d34acc00ca68c434bb3fea1a009a02437365a40d555ddef11323ce867bf985029c237e21a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
154423dbcb3948bd8cd1c331100d9f40

SHA1
03eda480d85ee30430e39ba9c0610e9a6173806e

SHA256
9f27e0b0bee1f5f9da9631d4d65ebdd4406ad236dcae3c780ae5ba0ec20f9109

SHA512
8d1c3b594d09bee1b5a483af7d558bc6f21bc47346a0e58f013e5d7d53b39aa31e8ef5bc7729330c2c8e449d513827b1b2255996adfba7799997dbda9fddaff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b244a9c5b2ad2de8b66d4cef8d8c4052

SHA1
2ae912e6e1783460666acfa41e0c901d1d511696

SHA256
1d9367b125933cb7f08db24c68b2273c2f3e99a77ac9e34aaf0df4eae51ef953

SHA512
834e6a9a4c9b7369dd085e791bee54737d49a0e2f780fe338d73c59deecde904003c21316c04243f12b45788c6204ac31fdf2ca7d50ac4cd25381729a83a7e69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc8253f9ffe252617ed9f9edb664800

SHA1
2410dfee180d2558ff14910f9b2d94b02c103ce3

SHA256
b763ac9d4ea58c0fa353fc310999b5b88ee518152cd026afd113303ecf185111

SHA512
f5c923892f8c5df5c8136bf576050653e870f58ca754ce91276b6a2f3784b9fe69a69f3b597b6c67f1af8e97ee82bce840e42a735314191e2d01362563cd23f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1cb740b57e0e7313c54fb5f341692b7

SHA1
026732d5bdec1a450716add24da74a4b9a6b8445

SHA256
cabf945f0011c7dd6165f0a1eddbbee1ea5bf9b7367852af5c016ba9c60c5d0b

SHA512
0aa75200a7f03a0c6b5f9ef6430244b0a01b528bfe7130718776b5c72e7eb4224c39393f841fe1d2522679da5960a2d5c4f7487ccd401e53913e343e3cea2922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b52842c43afb1b65852ec8fc72868e5b

SHA1
9dd392d4d64a03a9ae4341381980a90918f29732

SHA256
7628447ab52396f770100180160614ab942d0aef4f3baa872fa7680a11b813c2

SHA512
136c52ad26e54f0d41680fa926497d4a64cade1dfcc9360b6b715f27a114985815041f4a897393421a147400ac3e42c61c66e9f29be7ca2f7d55a3d02da2827c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
460ea891ba9a09bf3d8db3b277aef9b8

SHA1
343842d0aa5de018510a2d36897dd45bb2f55e22

SHA256
1ee6bab38737eea5e28af25c9c21286920690e8f9185115047f171941e1849dd

SHA512
430b19c692ee9c95adb1fb112327ee146c8a10be3aa9b9d9281c446696ae20ea4d82fd3394aea0d6080a84662916944e31c1362a8fc8a23cb87a4f6d5c4d02ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8ce5c40cce6b9fc9a298034f2246d8

SHA1
abec6278530f10dcee5e6588da016191e597cae0

SHA256
19c54cc3a5ccdb23022f29c16775443f2382fd10d17a005973e358231be73f24

SHA512
aebcc530c8cb200ca1aefaa8f4cd3c9fc6b09d9872ff3432999291d9dd2356b1cddf64045ce6078c25cb335a84fa60b3256acf4c7c3ed3d60feb0f8cfb17851a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df35d503fc80d1083e1e2c94ffc0761

SHA1
d8a2e45212b686bfcbb9dbc5e4ae0b3de19e5f50

SHA256
ff59551e60e3082a517353894f195a0ace611c001042a912640d8e054d28ba86

SHA512
4f5be701f772a000ca9b68e631d319cc400b4df164387914682a2061a34f79c86ab251825c8415effd8b36f9d0f185e01a5c6caa71f4657c547e8f559e211d99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89740986e971d5b7f7d7504512cfb4a9

SHA1
889c09f7aa36f03300938cc7c116d952004b09db

SHA256
d078e6333374dd04c005ff0a04eb75c80e202580c4ffcaee93a36e0cadd4f2f7

SHA512
0bba81254d60c03784e2686a77611444237b1ae7d4e3e47e42fb8b88496f6582f55925fcad301c70a5806570d93fb7028c2a074febf507f659564a7e588aae35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ff4529ccacf944f6b1a4d40491dbbc

SHA1
d8a319412a7c1d497b35e6ce33ac090697615032

SHA256
f0dcccc2bb41920f75ceca13a112a64df90324530b13dd8d73f15d0fd7bd2d74

SHA512
724117daae54cfcf7899124f90f6ef07e37943cc129b4a96a45436b34a1ff96fd70e36ff2af1c5364ed581af44512ba3b7896ae8ac315c547d67d4e3baa99777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f37036282efa09e4accdfa9ef6247e13

SHA1
20a151ea301c58cc8eded1f216144081358dea5a

SHA256
3e0116024847ec2828c77fc001b7bca2d4136dfcc7c7ec83e197a80173b30ece

SHA512
92064e6ce6063ad9da8d6576294e0e9d31126e1a7c0526858a578b77c686af48e62c2b62b87a91f15038e55b00dce3bdece8ef8d3654c9762518399daf9e2503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a64a0ba7d8a7b8b176c6b9de2411f20

SHA1
52582dde1dd8fb63d6145af804eda20facbdb987

SHA256
36a4439d4de5fd3d8432e762a6e642812226653e2ab4d0c6c08d6496adb1c07f

SHA512
feaa9489203127ba3f092568df51441d4b1acf0e50bf205afc5e55a5b3a49a9eccf14f76a4b1cc9f2223ca1a122a69ed0b41767294f39a7579bbd1cd864703de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adf27075897e2ebefb893c3b361471b0

SHA1
ca12462e817d0788f8c5ee15d9c60a2669abe34e

SHA256
9ce26187f3d4e4fe12121566c87da31bacec005898c5f8c138298147cd62e1f0

SHA512
83633c3f1966e44d2d440af66973f7cfe13e4a21c850d00a59116b9ba9cf2879cb02b51f8099c0b93bd598a789fbdde3ea135d97342b141fafe3a68430b7b413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
174f6102d6a9b619cbae24170802ccde

SHA1
c10793d49feaeeb52633b360396fc5c28fa3067b

SHA256
d5cf13d7624db59fbcf0578ecc266150f0d9289d30fc5ee728888cd7f1797179

SHA512
2155d5bd01e42a7690430d0ae49d4d0379b1c33fa18cdec8b0457be8790f35bab6acbba2366d07302bd3678171f926ed1908810b05931ed6eea62d28d0987b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5922b5626c0ba68220f8c377b459203

SHA1
43ee0bd4b8e16883e86351ba77615a6e84e75be4

SHA256
1e7a21eb02d240630dbe430c7b1717a254ec988d720e01ad1c35106889cab7ca

SHA512
54384518e6a83449b8959f7d932deaaab244849724a659590063efb8d9aadb4b0b34c82b5c8815cdd1439ae11fe8e60e7f5141a9519efc4422ea220607503b5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3471aef5d72631f8d5c034ddfec9329f

SHA1
b9ab5e8388a7f0f2bf0c3a2d961314b14a178c8e

SHA256
9f90fe1106862ced2278492817d44b25eb8f862a531501083af7366ba4a001ff

SHA512
47300fff53db637bb54f659c2fa1c1e8cbba20980e96f4ea708d44c544dc692885096a39a5d326f740d83d9bc4291f45d92c64956668a6fe31a2abf0f7c9e0e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abd1446b2d4025e212a0e78c8c014e68

SHA1
0122e73eedebf6bb0ac8bfb6b39e6c9192290c90

SHA256
3db02b78196904864108c2ff32d8789daab2b210fc18688a197a7a58d3decb0d

SHA512
658445a66db301a31d17c8e628058601d795b7f05bc64c28d23fe066d6ee685a929bfb5c5d3a20dacf6ba1789fa49d11b34213a38dfd8e6dab39609ea1a1f7af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95FC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95FD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit