c8489aa66dadf345f71fe90f342c5c280a30210a8ca0bc17828723cb10a4c86e

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bc111ec24556f0880ab784e67278a2f_JaffaCakes118.html
Size

8KB
MD5

2bc111ec24556f0880ab784e67278a2f
SHA1

3bd09188b0e2409c48e5f1e323a5a1a1230ac249
SHA256

c8489aa66dadf345f71fe90f342c5c280a30210a8ca0bc17828723cb10a4c86e
SHA512

077ca7f220271c3564cd752e7f1d1c018b93102e72d75b9ad59e22f7e95625ea0cf22c60d584c86699e70ad740c109c66e663d3051a69906d6954e1e402684e6
SSDEEP

192:rDS872pNo9g8i8ueKs+3J+Dv+0GAuMDKc0g6ohwmx6ROpPS8uQOEwi:p7WOz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b5b8a07afaa3cb1255ac2467b05b54ac4673a7deb97dc9e808a548fef621c761000000000e800000000200002000000064d7ee0c6744257c8d0280d23ff464918991048fafcb7a53e5b79598442147ed2000000001a065e341f7efc8187b1230600943c627102a64966b49f4525aac0d6b8b2d1240000000bb50074b527e6563e0eb7a3bd3f358b376f60cea7a35e8b9158ad01f017bd4e7b74ddf27d74648ff90e22b4a1f5531d908d27459522298743ff30413faa3f8e9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f758bbe2df91f21d5efc3d20c41b3b526e4f59f8fd9d840098f5d05ac28a9fdc000000000e800000000200002000000051522717c00db965caf55d4a24d9730042e21748cb14e92053cc58b4c58fcb63900000004eaadb1816ae3f1228e581b633e799c91aafdbee0596a5c62597b5932573678887033ff1025497f58c629483249c538ae7b1a842ed176bd7764f42feb9b06707a8c46e85f62eb10f4ade3c0c4b77292ae3db666b3c1d592a20d2004a083fbc3639d5a5a2fb122a275d33f26066f68471d6b12260d185945ff9cdd62751c2c842524456dbcf71e5af523e78e28c8351b04000000056444271b3eb7e2293e20cbdc97c1769294bc7949e02914e3714491eabd96ea1f39b5886c90ef33541ca18fdd0c8bdeef3310db8b890ec635229433aa1ccf5a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421451490"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1C769D1-0E49-11EF-9BF3-52E878ACFAD8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201985df56a2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1044	iexplore.exe
1044	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2832	1044	iexplore.exe	28
PID 1044 wrote to memory of 2832	1044	iexplore.exe	28
PID 1044 wrote to memory of 2832	1044	iexplore.exe	28
PID 1044 wrote to memory of 2832	1044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bc111ec24556f0880ab784e67278a2f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8627149acee9a7339bdd81dbfbcaf459

SHA1
fc04e466fdd1bdc9207f7cb2245801ae8f34d4b9

SHA256
4d860c58d757f59938dc2fe19f8724a0e723302d16c160f95294e119fd170c6f

SHA512
d016ea77b8bd72d7b38c3b3bb4e887ed150435fc83232548eeb8c3623fd2d253fc5df269d58a8185b83e4fd5940ac6b48911234ed4379f0dd5dc77a7d5ee0373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b347ee68e3975f0b2e098310593a4449

SHA1
6c7f42c0387d46ffe856ab2445262adc3df66903

SHA256
a289b2fced78ecf042bb9444d851063234f8020f9b4fa7d2ec9b5b3814571040

SHA512
b0bba345bdca1e726387048d67c26167d30aecf0f5d904a26dc927c9a4047d93fedcb32c72e2338614020acfdb07722443026e0f99a973e10e70bbce4ba65d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f74bb6bae052db99b1c36309c6991223

SHA1
d0ecb6db4d0ebfec5d00f8bc86cf3979ac3db096

SHA256
443f068f34eba2fdb7606c1600c1942f2b1bcb1da878fe31ef845f0a62a88c3a

SHA512
dafee47d31411644bb396fe121eb4346576b3edb1d46e92ba8dca63d1a02db074ea719638ab2be25ece7c69ae9673d154305f91595b0caba114aec6cadb731ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2db32fa70fb641a01ccb7d2b7672be0

SHA1
8e2040fc95871296aef1deff60bcc162e9510200

SHA256
7952d33a2e22a3f20a97954e31b3d2cad73dd26eb723744ea105bdf9104dd79d

SHA512
8e21276a18ac3125d1f8dceeccf71c5df3cbe80aa2fa5ab621352ea7e6f9619eaa7b259cce42eafe02c7e78ead67ecb93690a0fc99b2ec60ff8baa423f2550e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05ccb11d5debe7e790cd229424246755

SHA1
86b580d2caa5978d81ee57f1aaa4e02b8559c958

SHA256
2ecef8b9c263aad5399cdf78d67d2104a0fcd9e6faaa134314390f079ee015a4

SHA512
c2922bc113a40dabd2dbd13b4d54dce450e635fd7ce44f45bb040daf1b934cbf27717c73fb075363ab2e11fb6c22bfbbcde7cd3956d852b9192ad741e596a0ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
314f0d6a5232eda6a23fa03e4fa3d931

SHA1
df9af3cbda2f10c1dddb0ce18fdc2984572ae900

SHA256
650e9f02b65053a3343b589e970511be9fdd523d1e3bfd106c8197d964e96277

SHA512
a07c62f92dc13a29df092c42a3e4b9b632c89beed2efdda2a33ea71cd73867b5d6480d7432c095d0e8ec12a359eda3c5ff6ee45a9c25381d2f2f104c6483787e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d67ee3768ef31d537930bb5bcaf1b71d

SHA1
e634af2ccdda593c6a36073dbf897bd13f5cb5d4

SHA256
b07a22f84f68a5b050d1dafdef498e5864cf18dc7db4ddb2b7610333f9a57882

SHA512
c693ff388a8bebd853c1811e6ba44bf9b4b33d6def68f388d0f8f53c82fca0344d4073716a008e241adab7c68efbaa43cfb189956bd680084840396f03da12a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee089a564efcd5ab1a80ccccb2f5e239

SHA1
701f49bd5388e751b7b36ef3bc918854e26c8380

SHA256
f000eab6b33723c26f182b9dc2544d4d04bf5dcdf3cc7f1712eb47bc2e5c6b4e

SHA512
4eb20c1eed8e4227cbd2b531ab02f7f9571d10766a804675fd4f7731c781d53c9f1c43bd978057c5d5d48716a2ab8c9ea63f6d918f74886ed6f610fe9621067f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59fe816c51d1ee0539d35e092a2be4d3

SHA1
7d170dcc15d23e49551b29865c3a9cd550eea825

SHA256
8c66075e72b9989a9119cd1d998cf8cb2bc584bab14e99f62eef4158a1372fea

SHA512
dac2aa761c40b5ea0e107eb789428d0cf1db4b565fe44c04033b81c66bbe44afa76ac0ee66fa14beaa4a6ae8a8f10d30026666ad0af703a433043ce3ff9a74f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
648c557132818ea0f10208e2281d54e0

SHA1
5b1c50673f576bc9fa93985fa92ae9db10a5e698

SHA256
e14f62185e81f1fc26e4700dbc0adf7ca13b8296f07ddb72ecfcb158a25c7147

SHA512
2147d7e18ff0cb3c8d89ca0c6601f2971e41a4027647f0a76b7bf6e10ab645f271bd1a8ecd53e37b12636e988285534bf119b8f88e8e59015fdd14e730264e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c95b0d41229e77c406e5e036dca010a6

SHA1
c57b46e72a1f501b5caa1d0527bdbea562deed80

SHA256
7f4cb9410cb9d01134c3715fa27224a098ef747c9c91715dc71073efa5ec8fd5

SHA512
d2a1d24013e9c78f8f05c4a5f53a48ba3093b13eafd18965017a3814e05a081268419e8e2b3f994dcd4e463adc170d286bdf2cf64889dc21245e59dc5685f11a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3746924c0290e66ee6735e0443629321

SHA1
a13446c40f738b23065db904ef071c3dd64fb077

SHA256
4f70b072ffb61fae9eb71968f5ee4b11df938d8dfff5c18b50b4ced8f205c6a8

SHA512
9599d71f0fa69a5e98ad827896323c82f3233cbb23e1059c2e118c4123cdd43a973745c65319dd712361ecb32b8346b7cf289ab8bdd5821797581a6a0b597b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fad75b88179265aeb1ae0526d49f7c51

SHA1
3138f4f9906255da4fcca371e81cd44e779b6c23

SHA256
f3c5429d3b38c0cde6938bb9299dc02d360e9b4d12be753d3f485380d8cb314e

SHA512
0202a79bfbec36fa667c1ad5d5b55e13062e78e4200a9454fff34a51e795c5909cdaa1b1bf317295796b1e63976a4346fa03341f21a758efc4352edcc4f4c63d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13a7134b0aa1fdae909d68d5d8b48c99

SHA1
b02470bf0f1a2ccbe6e4dacb1ab7eb875d82e34d

SHA256
29878554e7e277e5763ff03ef377d659bb94d8372796e4d0e8110d4437013611

SHA512
2cded2ee12bbf1486aef473bf25b7d03d5bbbd3a0b993c7a5fc64e6030d31e01b4f8ca1be8dfd76bad98c03765eee0ff78580588b66d79dcb24a2ca1164b165c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7801bce62b0553bced07bf36cde30378

SHA1
f48d372b92f71eb1ce1ffcf8a792d9381c0fc432

SHA256
102bb3815559afb0335f27adba08e0178378e401eac070dd7bab57e33da9e6cb

SHA512
6f1620a18334c739de9c45a814f7de089094738b9be747482998c3527e189c5015f72f7952c37a8d0690ebb09382f2c23332cb44dfb457665d5fdd19b2f4181a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35e602761602d9aeb2fe9bd158855645

SHA1
b2d526116e866597d131bc8b01c26bca05f25644

SHA256
02179ef98bd3fabbcb658a8c0dc110b96549a7a02dfe39ec9816f5b0f3f4385c

SHA512
301382b2d01367d413bcb7da4f62ab156bc99301f4a606b23eaa99843d4fc283229c99122063247ec5277ca557c23e4036cdb868a2bb090bca7aa3048bf88fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
528c5898f6ce51e7d96f5da092abf2a2

SHA1
0fbb59950005a2be709f727ec19b81c2368b4037

SHA256
450c5a96f4470b127932312aa6bb8f5a75ccf6f27ab8a90121f7bfa0fb36e74b

SHA512
c07f93b5fa9b5e21b6df729b38b6fa512bebf0e170a21bea83db2fde2318fdd9490918301c0f603d9d0fc22b9a1d6d8e93c63fdf856e796f4a1d2fc56fc6ff83

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC15F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1BF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit