628a8665e0d33f2bd6a203a77b1b4f15b8222c38602cd204332a73b8d8a1e563

Analysis

max time kernel
144s
max time network
152s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bc449b3328f978c6f74046e055858f4_JaffaCakes118.html
Size

31KB
MD5

2bc449b3328f978c6f74046e055858f4
SHA1

e568961f0ff609abb8b7a9d185d8a514977c7575
SHA256

628a8665e0d33f2bd6a203a77b1b4f15b8222c38602cd204332a73b8d8a1e563
SHA512

c8784774440cb11c85027e6c619f1c232a4cb393dfeeac49c45f46908eb7e6bd2398571e583c91e2bc250fdfc3a3c85e030a79f4536368f0e3d1443e20378ed7
SSDEEP

384:4R9iy2ifzOMBMtJFrJvYOx/+xpG/IJe+xw/TreEcSO2ymTE5ylh7XsNC3A57yfPi:by2COMCVn+xw/3eE/VE5YXJYZnJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000631559dad8029a2885ed4f39d91a3a34da7fac67f9213415f1347021f0ba07a7000000000e80000000020000200000009198e3957ad3091bd91bd7568142293556fbcf71423d8c7a2fbfcd44b94d06bf9000000030e061f674c874be70a6bcab4c67e9d547275159dbbeba226ee8b09ae7d1613e2459f18a9bbd8501e9b391e594e6f1563cdaf80cf6022d65a2e5fab77b42865fe731099c6911c3ea10149c62613fa07d5a73456392ab1ebd52d7160f81998715e905e9c8f0e253815fdb531739abfef58d50fbd59bdcbe799b65a7182460e94abbb96976d7adf38ff142aee1e07195af40000000fb50b77263a28080ed11233ba36a0e5ca3b9701ed5bd4cd021529ca29ec6be7dd9784f24325b27661815cc94d63e30c794fc31f9467d468483118121af291789	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421451655"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{542EE941-0E4A-11EF-AA6D-D62CE60191A1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806e3e2a57a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000003f2aa05295d2e5e190fb72a480494a623daf6c7568439fddb1ec753b9c66465000000000e8000000002000020000000379fe9188ea200b8716af1e5d794844174e1fddad6458c90c9008a40f79abe63200000009e67d74d24a2f8a5a2d7d4781001fc5f9cd341c915f2969924e158000da2de1440000000ab1ea12adc72d4197ca241e7051f2a4334eb0d6e90d25e766314ddfd839ee71bd10fb4f53fab477a1fb913ac27925a8fa3d0fdd494d9974800ef6ada9994dc75	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2992	3016	iexplore.exe	28
PID 3016 wrote to memory of 2992	3016	iexplore.exe	28
PID 3016 wrote to memory of 2992	3016	iexplore.exe	28
PID 3016 wrote to memory of 2992	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bc449b3328f978c6f74046e055858f4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d823274f3c6ffcad449789870658b6c

SHA1
d88fea42bd12eda2959a5f004b1a27a430e8ff69

SHA256
5120fbd932864f9a50a64a2c45a42e3d6a00279fb08f6bdfb6a8310c6a83c0e5

SHA512
0b8f47a5a078734100b8b996f37378dc5f56d630246fc45fd1bf325fd120882f76c12ac832dfdd68c716a645c1abd4827faf6764ed89b91bbb3a82c0525c3535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d2c0db15bd1d76aca44917355d4ff0e

SHA1
b9a6103b160d163b6b11129dffd3392e862c1280

SHA256
258e50a8e81425f7d0fc088bcb46f170d19a2a1f71d14260564bbafeb08c3ee6

SHA512
57f83b16c0f38c85950ca92bb2f230efb230f8f1abf98c88754d6975d77d2d0232986c22cb412b5f135bb7e20d0b55f22f71d2c9ea8d7da43f1e4ff0959d7b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1170c393624ee9cab9123f926b21cf7b

SHA1
fe4175a45de7eec8d59f1db0851dd617e9073330

SHA256
f992e2fc2dca9a22c76342e9910309abf0241abbb9abc8dbd2635019c4eebb20

SHA512
64199138e4d48ed55f0b14073a64fce5cc2b700246c195166f361a216c6ce8728474b55fbcbfbe33c55336368c4925a17aa665a08b64095e382bef3392295212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55319e7f2be9f8f9a76c4fe477e58bea

SHA1
73b0697a37a39c782aa46e1274080c9c99f39879

SHA256
1b64519bfe2d35ded9f99970c8ed8c3a861e1f1b4876fdfffaed3bdf6fac7586

SHA512
202f394afd932c9dd814ad4c7d9e53273870e914c5aba838defe386386cfc274b4fef685a94849b141da55cc89fcb61b636ba39a991b32ff128d153f49420b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e13dfbc8a23c578177050ef588a8dc6

SHA1
6cbce837c96a1a8ff8480c5950fe29be7d3e6463

SHA256
6fc5888ae4535f6fd338ff89a90706b7a501345467082844f02658e3a77b958e

SHA512
ec3d8aa2f9a33be63746004697ce908e547b208784e8e2bbaded9d721cc7a8a4f399dc15610c87240a38acbf7932858369cd036ea5514e0f6b69aaf8a2782f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a7a93909520521d1d6c43170fb84c45

SHA1
d97cce875cce645514344b2fbbad6fd4a4e87480

SHA256
a63b43e1a16b715aa97731bdadf5f735f7b9225362666f793dc4ba350ab5382a

SHA512
3148bed21794c4ccb3a6295cdbbaba1c47ec5c689f0e5f67cfe3c23c80d15e74a94a82188674a0f53c918e653384091f446525f1d2939f06a7aa7ac72803a75a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a68fd5cd891782fcc544027950c69bc

SHA1
0bc8814867720c8613249775aa9479e72de69cce

SHA256
68057ade92835ccf215f9e4c17ef3f2ab6315850befc86281953f475c793cc02

SHA512
f9a7d6e6a5e78c205ed86dd97d75aa7a9fc1e7277e524be8158ab8513d120a3562488d931fa71264bc16cfcbaf338456753a099b8829ba23155f3f9bd370f63f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d00f5c711daa0b2986e5ea8de771c1b

SHA1
8c642a20804edfd55750958f762b9f74d6c884fe

SHA256
d3b7b072f8dbe1a8c1fa3fe62a870288c5fbceee0709c735f498c8396a08a3f1

SHA512
dd27408b2e7f162b8d97e059aa8511e589260cb0beed377d106f6c439b3f4fb53fa39b1a4acad201be3d337bbf1278432a4d8323665fb1fff8a8b10599e7965b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cd9983aa717b224eeaa2ee25509287c

SHA1
056065cba45976238951c823766c39a319fd9f60

SHA256
3063521ea2179cd457fabc1d7ae175906b2004b0998ebc0637478c613c1f5193

SHA512
f01a996a18e1578498fb3c4c31eca0419193c3c18e5605fdec8abfa7303cbb719615d42989187a02c0dca824084096b9ab66e0f0f8ab66f1768c23849ec50915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e188e63eff02174277bf586dbeccf0ee

SHA1
52c3fd1d5f9623e4797310220b0cea079d6fdc72

SHA256
16a461a82407ea35c721a7df90991932b08ae187e86a63c1f66f952da52e85fa

SHA512
108065c694e9a07c1a09c3219ec25ac2eb90d86152cf3d17a7806b818b18d9ef0e53ac05d7a9f4450c62f3fc13539b139e7f05d379fffb5f0873548d0e50d465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23aa3b8e56c25402fcef00375ee858e7

SHA1
8b2b03fa40dc3bbe02913a6d33f8ec860aa97321

SHA256
0ff04b9f5626f976cae0af58af3c24e14809a89794b4bc6b69176185d29ef18d

SHA512
a766d149640e3b8983d242a0f86eb62a272c4c8b02f4a93a26b53013c7166f31e9fcf7d90359bc1320ed3fec832123219debac4e559d2ea0e21460ae3e5decf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45cea751ab9d08ba65765e2a9d7b895a

SHA1
26f2fc7e5a45ad026c2c86b21c71379121336c8d

SHA256
bb66ef115191e31062bbb937599e3a32f00117fe466e4ab6c1dfedd584b8c356

SHA512
3a02d072a3865aba05004fc59b24e9e956e5fd642f4855d65c3d14b63cb2703d3b53e8472f9218b3e88bf8811130f4f357421ea5d615fd0f468b563511ecb303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b89c14df9b211d0ff271589fea874b4

SHA1
d6251231767d24525784853f83c55c6998c96243

SHA256
8ff1aeede2eec193807582459c40fc45048626ea5dccd4f6aeeb6767caa4ed16

SHA512
e127f990e843e717c5c1d08395c435731f61d8a9df4f1e65fb05e4fbb4dc082164196cebde94a2f93056a88bf6b5ee9ad0514795d5abf01b92929da4e2779968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56547e783c9b1d23418d51d768a593a8

SHA1
0af9929bd3ce6a001ab79352113bb82b33d47b21

SHA256
a863da8979c04ec97775a28e95cf76e6077f1d8fc68075a246db39f7ecbedbe8

SHA512
b50a4f4d9a91246df4b28574181605402704815b1aef7fd81531f50236aad5df7c0859c48570544ee89e31f3768ece8ba5df3e6a9da6bdde3fbaed0483727c07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42b28e73bd18487a813a88ed092c571d

SHA1
3432085cf18a7927742f4ec48464218548bf0036

SHA256
f065bb5a21b4234731bb703ec6fe974df4f81376c32f163516595b64514f136d

SHA512
4d3aa6da9bf3ec5decd05aeeb8f3952adae2396c24471a07a773b260b72bd3dc26a461bdf978afa73f1bc0bccd56b91941727eef85f9d84f62a197de07d3e118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb43851781efc90874d31b3ceda47ee3

SHA1
7f9f42a277654647ee7a394b213da80cac9c06d2

SHA256
d876217cb3144c51063585cb4244606a01867113e1d0449112435ff2dd9c1c15

SHA512
b151eb17f9f6dabe3fd3af54eac9b280849db2b979ac2bd1cdf421c63c177c304e75bb570b4bf23b777165c54121bf2d9a925623197c0b0a59314d5cc92a6da2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31026e61200542c800579429adedb00c

SHA1
79a52e66eef588e84cdf285689126ab1ee805557

SHA256
942378ad3a431e959c3a907c15724baf06976d84b0c66b1c4e1834e9dd8dfc35

SHA512
a9c6b5f40694c291ab47c834ec024e5a2864c9ce8aacb757a417526dff4aee82aedf98e24e0f513faf9d26e8a84a42d5add2c5f06e1c24d943e4ee764825a398

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5800.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5842.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit