d836ba41d423ff132607f54dd8bce59d1e6f54d4d0f860337c759bfdd8f271fa

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b70172bc1386bb5660e04722dcffd24_JaffaCakes118.html
Size

70KB
MD5

2b70172bc1386bb5660e04722dcffd24
SHA1

478384c34eafb3be2b4ff836853212052abcf8ad
SHA256

d836ba41d423ff132607f54dd8bce59d1e6f54d4d0f860337c759bfdd8f271fa
SHA512

dc9c2076dcab8bdc87d7d36da9731314fc1d97bea350453e21fdf496374164f619f7827d6e599fda0fec01e82dfc6fa13c3f4752d1283e21afe0c8296f063f40
SSDEEP

1536:JHUDmD2WDyWFE7RTzNen0tbrga94hcuNnQC:JsTzNUq4hcuZX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cf14aa43a2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000aceea39e1100244dabb86837d6f2054bc320192733e2554342802433dcc2df56000000000e800000000200002000000015e547e1e3ed7cd5ef7148aeaed161ebc33ac397b19b83ad9b2e711c818ec7e390000000f42d92aeba53447894a100b6fe97193def92fd5cd09996fb8dafd3ccd33a402cd438d51f88daa1173b4aebcbd143d85ed29081be7291dac86d322dd024033302bcd8ec8e15060ef2e58a478d68c3936baa0b5ef241e9a14d1c1368a6df88786fd370aea90cf5a7b15edd81be00bdd22e86d22e0a2c7a976c7f991a56769b481ea0a0ee33f23a7f5520065830c2ff1b914000000086a06d78b040b6fc60587706f9e86eeafa175eeb2a10fc0a376ccb430906422d04d6b043de8f0f9dcada920e0bfbc7881cc2333fcef610f40dec42f0cfadb860	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008d191f88e584d7b84bfc24802acab81cede70254ed69ad1f1fd5dba65534ca65000000000e80000000020000200000006f955707e6d1f2fbbb0e406eb2640dfb7cd0a416f338e456d283616692cff92f200000002aca3a4d2229ecd6978c366a6408bbf26f1047735040532556777154c5a04d53400000009314a3a131a9b548b0a2ce6d63851959560bc8b15fa9ca4c8fcc958e33f2d19e8d27ee9a6604820e4ece99ee95a86a1c3224649f1fcbacb5640ab8ab54848862	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421443281"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5686C21-0E36-11EF-AE65-4658C477BD5D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
616	iexplore.exe
616	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 2216	616	iexplore.exe	28
PID 616 wrote to memory of 2216	616	iexplore.exe	28
PID 616 wrote to memory of 2216	616	iexplore.exe	28
PID 616 wrote to memory of 2216	616	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b70172bc1386bb5660e04722dcffd24_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f9b7d61102f3b203051f44e6881e9e2

SHA1
d240a23c4e64837dfc4746402c0daf7450668931

SHA256
f77a47a68cd1e6f591f7234a11d40855f84e6e795dcd94262fbe600d45f3a30f

SHA512
b7610665964ddbd44dff669dd72b7927d43e9414939e7690e6bf1b85bf3dd8874ef29221f6873177d2122b6adf574a95a596f376327651316ed918673421fd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15aea73485d2d805f1eff2d0c0750326

SHA1
cbea966cfa24a44043453c7a07d49a0117cca847

SHA256
6ff739b7c4df6d423fab1b4ca4d64b2974e5f9cdfd51c3e6204d2a76b3e43511

SHA512
5b7e9f03277319be289dcb5e1f09e35b822c08dd1739f8a2f0285accc7e14570191ebe49de38144b9a6d3822aa6054d8e5ea6dedb047f507451748552dd58ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b177e71c8446fa7a71978074a9afc0b

SHA1
e87ecfb217cb181e7f9462bfb0ba749410d106d0

SHA256
3d4a9baed27cf9293c95166abefbe2ecf9abb53ccfef2ab3bf559e39aaaeaaef

SHA512
d88e1fd3271c8ebfe1705d922e7e9cd1afda6f5aec4cec5aba3f1aca240cbaae74eae719cbecf3c4579f06019e3d2911428579713d4abcd3e011040c26079e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e24d474a105be068355b7d54f722623

SHA1
f1f51e4f6d73e4f78a24a62171e1fe894c051828

SHA256
f3ea22d7d2cd5c9472febdb619bbce04f7d81b09514c2465541b5963fc614a29

SHA512
b21bc6d4d3fe7cdc55121942834b5fb700aa9f9941328f0c19967df9b797040e8ce48a0ed51590a546d3d48ac00486491e2f8151be4ae14f81379abd201670dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2021749c0f5b37aa965194242990df4

SHA1
6ade25276fd2d1727269a47bddd222c814f9e264

SHA256
a821e3dbb872ded8258f85767add7d97e09b2bc30e307f86b4a0bdc4a092441e

SHA512
cb33734c75978934b41bf597dc8f2f6a95d2a835f27936ca5616d6a71dc01802e8ea54e7d4a570df1f2483d815b0cc5ea860e8ae2f172bb8487639bb5238c838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7616a88b11c7a081559b8f9e7160823

SHA1
633366eccc48206a4f403da5b2b8151924081154

SHA256
ced8da5c602ee92b326f9680b95150196da745a7cd2699f3f2a183f355537b05

SHA512
69950cad0182ba92618e7aeee4331d3c81ca790f07db84a07449f6a66c2da7ebeaf2c6ee9798a5ff1aff6a764b59522ca062a4586ed6d9a94c644fc3ea073bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e93e90f2addb0113709c60d59b4c5572

SHA1
b7e888376afeeb88c56f6fd779ca9823fab2daff

SHA256
d15267ed0dd83cd0fe208a41b551aa5de29b55b553e2d5844182dcdcba8189f6

SHA512
3dce069ca200f6033cf1422fbfe76b3e5d3656302624a00d62ceb161349793afc0105b54d08cc78e5cd0d449ac2e5d6ba927add30da0435d7d2a11abb4fbd8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f75ff26432a874134784671d514c29b6

SHA1
f63caf108a47296a9e62b9bfe6ec40fbef3f4d5b

SHA256
81ed27ec2d3f1c4350929a031a62511605c6b322f60a7ad97908f0b8d082e99c

SHA512
cc3eff8b020029b8404634675f73bb587c35f698f06639124e2116c890cede320eb5bdcc8acd06693de3fe8707ccd01a4fc97168ed310fdcd660e4e7e0564962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0dbd77f468be03c2fc5e818a69a3478

SHA1
5e689ebfc71467099e46b8436f342dfcd2fb18cf

SHA256
285aa4e4c21fc7a1c4c1aa4583fc3a980acaa0a794e4faca2ac21926ec523640

SHA512
b808b06f1004662d9d8e0bd2ff306446f2680ef411b0412dbf649586ab8182a2635c8e84482b16266fe46e9f115821a450f4c45f6f9efe5b1076e55ab3ddc4b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e33333dbbda1464020fd59b9a1171f95

SHA1
ed1f4e81e9b777bc46afeef8df472d2d8e6b7456

SHA256
1c25e08f71b75fad8f0290740d32871130daafd96126b9f6a365959b797615c1

SHA512
a98051e2ca831973f2a5c269487bd7be5f62043613b180652c7e1fa665e8af23d947e39beb5b407ce3f7da1d57d1c6aae57c8e568d79208742a81bad5d928fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63d57ce17cf710252783846603755cd7

SHA1
1b913b5e215504d656a018574cabb7f0563a15bb

SHA256
bf4c276de9c66af6f20d9af6f08272f752cda4c05db4f75a171c428fc038175f

SHA512
e0da942faa853a9cee87034a279903559176148c3a8b052d1ab8746b890d55ff8406e77483efa9030388da0c0532354e09b7f1b6e257ccb22b7087a9cb425e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d74e2710f46ecd6c7a558725c0d5f03

SHA1
df23a2c7f395cad224b8b359d78ade4d4af8bc2e

SHA256
2c47b0535f86328e5990a5be39e04e1274003db3f8e798f4da67582d77ece51a

SHA512
a8a94c1cf4fbe586a3cd28d8aff1b94eeeb406ae2a969f936f2ae03fd549932f6e31f73311fa8cc257ab5a2121431b5382e8290777c825872ddc6488d5f60bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64a2c4937a421ddce5414a9787305751

SHA1
31898fe9ed77b4b6cca2bbc1963da8cc24c380ab

SHA256
814e0385902bc767f214927256bd6a493100a2ff3ec0981d696f3c14d7eb956d

SHA512
f98b0a30b8ca8a1bf710c13a7b49c738498909c40308db848eb1703d6237a6e517affbf757dc61f57352464b7a9a3a1390ed13521372dbcc886b349ca14ce0d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3c016398c2de90413fe57ff24b5f34b

SHA1
359d3751a6ebfb36bb07f022522ad6021c5764ae

SHA256
137321f7cabb890f052ddb3abbfcd2f47347d75da71be720c124fe5bed396d57

SHA512
0be5779386889fec4bbaf97b690e0f57ad0a52ab8e715674f753227110f91316b3e447cc60b7328775df6628750a53ae197b4f66ea50ea9a77d9d9d28d5c0a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F7C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FCD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit