6eeb150e7eb533ee557bb523151cb9b2c54b50582d4fbfb7de5ec5ac5125f5d8

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bc201ac82eb894c703b56db941ab8c0_JaffaCakes118.html
Size

3KB
MD5

2bc201ac82eb894c703b56db941ab8c0
SHA1

32729350fb3d6464dcc223f992b2a67fae761928
SHA256

6eeb150e7eb533ee557bb523151cb9b2c54b50582d4fbfb7de5ec5ac5125f5d8
SHA512

d92f6b51bc59feceffacf7940acb608c40cfd6a8fe25eca363c68b439feb25ebccfce75afb846112e9333a82af3faa918bb6f2375497e1ed39c14514bef164b6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000003904207a5ba4c63c63499f6561ba3a43e87cb86c287084639e7301db36b6671f000000000e8000000002000020000000419cbd3f66ef3cc17928b8548900378383f3f4aa10226b83b65e8aa9d5cb4fdb90000000fde37cbd9803f3ac0185a42f77616dad8deefb33617a2e04a34a7b986817f2bcd7a6240405e4106cd72f51e6c613fde3899f49e024319c327f1095abaadbec5a9c4d899b31f1d18c8d58c3010b2a31832dccd5e3b38c45acda1f8498749fe83f4870dbcf7b2d81a640d4abc425d7d9a22786cb0abc2e04b77be10c909fa84f924c371c7b1539f06dc75c6a5a288b337040000000c4dfbb0953eeaef5027ca7bb8eeb9108c4e00e52458be202d35a689e83f05773c1567a2e29b18b2ff5ec7fe45e9920219d583decac7e7f172869c4c8fde44e02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421451520"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03A8FD31-0E4A-11EF-995F-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000aa5ceb380e42584329b27b652a29d35cb0caebeeb7b8f0d07284f625215a2d46000000000e80000000020000200000004bedf8d9f6385134043a25fc7bb6771c7b652fabead1905002376d3ec5d20f1c20000000fcbf7f6940577a301d5c5f9f4954aef6d033ce3e08aa4974c343f79e3ea1a6ff400000008e3bc49b687de64cf789284c595061a725b384b2ab3f46528e4d2e86926becd970e010905b7cdfb6e4bc561ceece5554f36465b18b8bf3dd1b15a689a0cb26fb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908d61d856a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3036	2292	iexplore.exe	28
PID 2292 wrote to memory of 3036	2292	iexplore.exe	28
PID 2292 wrote to memory of 3036	2292	iexplore.exe	28
PID 2292 wrote to memory of 3036	2292	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bc201ac82eb894c703b56db941ab8c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc0e501ce16cb6a995e4183de3928778

SHA1
725176343380e06b1b6b31adf8da85657ed20556

SHA256
56645ba8940389d92d9e20e0f7b5f7a7c6e0aded7829c8d15649139e1e91048f

SHA512
61f8f90c6e47e19688772228be2c969f00d89bae433fe89a932329b725c89ed5f8bba1f171d3ecb29d9d3acf02667d81eaa5a3629ecee65488011d4840abe920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1405a19e27aad2c5200739a532a0cbdd

SHA1
f18c38c7e5112eba572f022cc6f3871054ee987f

SHA256
7b2896651ce42dc85f3d307f80ae6a56f8840b796181e92b66aa55df6eedd9c8

SHA512
539e0f7b25554004aefe7810f5b3c3e5ba85853330457300b0fdcbd327ecaf32195bdaa83c56b365ea18ea738c3a83f26a9173050fb1db947106fbf1bfa4df74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c9b1773e8b15495a6ed23cb40f48cf9

SHA1
b2dfa661d54c8589bb2686dfbab45da6e358dfb7

SHA256
8c3e06b629f43cb73acc4889defbc8891dc9626261183e25b3095fe08c2c40bc

SHA512
2ca0c9d43ee40f617712473655d2c86176c6b1b7c858d49f9fbb68fc44467581773cd8383ae51d217ae4c4dea623a4d0478dfcbc87661766729969274d7a9f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b0987ed5fbaf54440492c4c3f5ffc7

SHA1
712afaad912b2e634275f7d181956146c4940c37

SHA256
e96ce7c462d00a5ad2b34f446499a6d333b1fb581b16a7c52c2e75fb5145f43b

SHA512
23804ecb537d702b5cfd3a7872f223a772adbde77a7d5c0edd9196c21cae6ca597cbeb4efa265d6a7301b64bc7a50e81f134fc20c7b7689c99baa2855a630c7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abaa316f91660bf9eda682c4e694cf7e

SHA1
03078e20e742640640f9ce151e9f8da4c06a4cd4

SHA256
d75b9858f0c0cd419e7232bbe5ab4c4c4eb81af9c7118caf29a1b9e1695c13f2

SHA512
69f67bcecb2d0b5a187ac952619521a8e267a23c26908212f4bfb6c6593909ebef8e8a98d9de48aced3f0996e8f68028d968b5ca5eec99bc6428add6972275f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5554c5ab13257453023d70326a370a42

SHA1
798dadb4a614cd91729e4cea4fe039b064cab6ba

SHA256
f3865f9829690da7a1666d998af272f1861aa8f2fe6df832a699ab4acaa74764

SHA512
1d601ea6b80e6ccf527a5f2aeee7aa9b820c7f3b2a76cebb2fc72d0eef0f7da2f2110d054dba936f4396af7daef903fb279d24f27de4feba232bd3393a288e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ba42db8f00ea11077d923179755adef

SHA1
f6af4564189678efa18a5c3b6ba23335a2d04e68

SHA256
05531b015788433c4c7f4332b9c8eb21871a8dc012fefdc491d3c690cbb95b74

SHA512
4ef00ffd21bcf3a666b6eed5b66b1a5031d92fd8b16a7f61f39538325384dab3a27c8449c72bd9ddee3f049a45412f575c796301f29dd469fbc249581bb822b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7331594285ad1b074254f1175f332b13

SHA1
1a298a73a3439b403cfa33ebe4f5155c2623a661

SHA256
4843b1dc18bc031a1010f6c869ffa648ddc4a0f5a3a570e3e5402c2fda566c55

SHA512
d63e8e5fdd80b66ee25b7de67e7dae7164bcf4d30c03b97dac754cb02ba2164604e354c1cd68c20f4a6b3ef7813a77c9062fdc3328eebc1ecca3d152cccebe74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6da26001d16bcca598789d67e668e2de

SHA1
34f453090b3664587790334a1c594c2171fc1487

SHA256
41ca2af4c599bbe8a1a726495bcca8aaafaffab10606f52da95a03c556c27942

SHA512
28ec14e6f10f7b0d38c938c87fa20f0d9fcf57c2c58ce08e10fe5810429366772cd0d79ae12ff3c2100e09c74b6de07555d1fec66edd2b05463cefa0d6144252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8827389b1958da6c7bfeb71292cb90a4

SHA1
a766c3eeed523cdd06f628e154e1c9be62d2c7c6

SHA256
67d678340aa9d7718e3c970acde7dfb81e2e9d68ebaa03a615c0b510465ec917

SHA512
4e5d3702fefed1c1185fe841620b05b895735588e543fc602f75c04c685d347b610ecace04ccd62a09b3ccfd03f0bbd1a6f339b20087a3aed05d69eb349ef232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7fa4c7bab253a2fd234965f9ba7f956

SHA1
5d75d5a7b1939a4a710f21437d3646f84050ebc4

SHA256
bb634cef9a93efff1f3a5ba3f235c71047a09f558f22d9a387e66c7c52f37e54

SHA512
434fbe5a1265c301274f6b6f51adfcefaa157521b4a49eef3a4ae804bb43cda95e2e1f11da923cff179d17b41f0078499804fa53e3a9c5078725371915716ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5113335d1ac05047fe03668e35edc849

SHA1
63abee629059a757c289fa0f46ddd2d8bb86b9b6

SHA256
fbd38ecbcae55ef6b512f38d952d66469706d0511d5f10f49524067d7f40f594

SHA512
41792a4b815ecc378c621feef92ffdb17e4144c4839a4daeab0ef839aea839183cca14da812d39975e030249d8fcf6eaf96a1ad033707c7048b200126d2ba1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72a1aba6605f438763c7929b33511bff

SHA1
bade19388b5c54eb5f32eb389ac423fc103c3d18

SHA256
f6267f52390449315c0722443975db7bbfa0137825baf9c5ecce92b2a269ac2c

SHA512
33fde8769db9caa883237e2356ec9537fdaf06e37c998b60fb9b7bedf42acfbc1def5565813b0b4236be97a4fd229d9ce4990f373dba6d88504bfc84d24d247a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14646558c9377f78acc4c6855280b72b

SHA1
06c0e42c155417b0d11bf430b425d7d5da6a1780

SHA256
d24ae02a364c1719f37cddd4df806abd4ae814c37d5273deec5ec969767adf7f

SHA512
45ddc92a0beef09c5a0b51e370eed73531375fa27d161b87c8ec200134c734e3de69074ebb0aca166a18a232c5fabecc9afa96c48f82044da62277b270670b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aeed48436c3a6e815a2412f6e6f49d0

SHA1
1cbcfd5d946dce026a64e1ef835eb697e4bb8d47

SHA256
9d4fc073c33d55beec75c2850e46b62d360383ebde708cf23457609340fc58c9

SHA512
55d2b973bb317641fdbd5cf27688fb46a63d30c693c982c0ce4bcd678737f4e1ea6f0ac103fba4040d9e59fb4f3ff2f779e70ce0157dd6d0aaffab21a7415035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3317d1d7ba17d42b6dd63d535ee296a6

SHA1
070cb6dd46eeb099e84dc88df5ec62d5a9fc45f9

SHA256
2f19d84d41b34c81c600dfa80cb6075f43510a694383c14d5814892750f9f51f

SHA512
bd31006979ae867df0857eb63784675e04000a3bc2e40dd6f24c01e5a646b20ba3fe8a3499728fae323e8be34aca8ecbb87f23a34c39c7fb1bc5ced3a9f93576

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FE8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30DA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit