e5d1c512766aeeb9aaefb64af8e3f0a729523e99559716ff702455b7f11b1dd1

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c7ef0b03d057d56b0a3134694906bae_JaffaCakes118.html
Size

462KB
MD5

2c7ef0b03d057d56b0a3134694906bae
SHA1

b676039d4069e515edea0694b9caa747e019c02c
SHA256

e5d1c512766aeeb9aaefb64af8e3f0a729523e99559716ff702455b7f11b1dd1
SHA512

867b7245e4b5a037ac2ff4427b05112880a5d8db9c2c54cf4fe6d333c701a735c31f18e4e1090229d90ce5b487b1875a459482fb947ace663970581756ffc22a
SSDEEP

6144:S4sMYod+X3oI+YLsMYod+X3oI+Yc8sMYod+X3oI+YLsMYod+X3oI+YQ:z5d+X395d+X3h5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501111f172a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004cf3186b5fa1783cc23a38721c7616e4017fe9b41e88d8579bdf6a80d453888e000000000e8000000002000020000000a0c5d69e2be1532fe34434e196f3806fd04ab77c0b3997d00b9d324565cc3299200000004c2217767ecdd97bc93e5096cbca0da0dfdb2cd1e8830472b529616fcdd903e840000000782cfcfcaa636314751fa8eecb66bb385a7d56b0504f8f73bc659a051779b0f5e2376869fbcc7bd751ffd864083e03155d0c9754064993d06a59ee09a3237a30	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{188E1B11-0E66-11EF-80DF-F60046394256} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000042eb7282e81a13bb2b0b854d4cc70ee98969868386c10a73edfc9f1554eb66b8000000000e8000000002000020000000a17e6dfd075ddfd4396fdc8fd59e27209332a6287f29b4311d2180f68f68407c9000000083c7e8fb5d0470f6e6841d914a019f0bf04bcc5bf7baab0a9a2eef1582befe57c197b10c7ef1d8b37c72b3692333018d72d315f6079b89a1b89d21568d364c2d8fca31385157c5eb62009995185c7eb878c0463b044192f687606caf0a2de90422b0eb4c4024e77bf4dad5d141ae73d651136eb711dd93bfe3b37fc6570f557c6a297971ef0c732474fe88982d8016554000000002065bab8410f395e114b35fd927c0266ddd1ed6c34b549121da9cafdcd1b926438856fbfec9877ecee9a4d36a7fd2d09e155f30e618c5098315fe62b37c1645	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421463584"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2900	iexplore.exe
2900	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2420	2900	iexplore.exe	28
PID 2900 wrote to memory of 2420	2900	iexplore.exe	28
PID 2900 wrote to memory of 2420	2900	iexplore.exe	28
PID 2900 wrote to memory of 2420	2900	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c7ef0b03d057d56b0a3134694906bae_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4766b1818f1bff386e89dd2f3f80531

SHA1
db99524f9a702eec9c00910e04c7b99de59ed53e

SHA256
81df377c1bf83b65fa73a23b9612c712c77361e3b5a32fb0c44b4a0224d820f6

SHA512
d534e1578c95bc836275efc7b3a5154c0ed7a54c586afbf19d17c6a4f2313385ed56f36633daafae8940e7b3fbc6d3a2f41a91647864d4dc7c7c1c32f51ffd3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93f260eed786d2092f73c6feaf40b447

SHA1
32a0782baeb0c0f121969221653430a3be0c0641

SHA256
03bdf9d7f3a7a7f3b57bfa57a332c25220e2e7da1b3cd529ace8fae79700e87d

SHA512
b00380e4c0380322265bc434c7b4e4b01821b8863791507e3c0a9cd7fd0a3cd8ae8963f645486de68db20dc2ee44412bdcaecb0da87cfa272224b387bfaac3ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09fae949c33d48b0c6fa88c7133ce3e2

SHA1
eba449633ea55b0015700c2b395b5bf2087a2190

SHA256
ea58772a9bb0292ddf96f697e8df627afc15bdefbb270f1768131f3a2da54634

SHA512
5ceef0e560321f57b6f3899c7f166beda6e94f0bd3615da1f64f1466d54384e2f411d20920fa3e5a390be8c3238210099340b010c01c84bce07dc84718596f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b88440cf434942d044e37265acf3cb7

SHA1
d87f872c958256b8651374e59b85d54a9937b8a0

SHA256
09837da8c3f53d8a10a8bca006d8d083e9d51124bf96dd0313f24731817f0914

SHA512
79c5f49ac403036dddd12e9d3d40d5a453e22512ab43414f2adcc482d7f5a5784d74c8765001ce74aab935982918f56af1c139330556d30525be61697dd0910b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a63cd34f2b62fea8286eabf144178711

SHA1
feaac6456318059fa1c40bbc660c62ceb8df1c32

SHA256
bcc2623724286c8ce58eef63d0cb4068dc186135dc413d6ede3a34a6201bd8c7

SHA512
0edbfb651b0dbc73c2e1d07a10fa8c360367612d7b9e738a4d9275ea11a5c824cbb5d5fa1aa5fb2d16d957be1d867f33a1d3f22af7e7da4438482367deca8302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
276cc8b1183e05c59fa233bd979c4bc9

SHA1
d3504e1b56a9aca09cf0cb61b2b6938ac88cd2d7

SHA256
03e42e7022b15254180c8eb396cd9af2889085bac9511beeb7d40b4bd686a991

SHA512
f1a1eca408a2cea49ea67ff7600df2c7bdce507306ee77dc5338ff1b9e557af5c3ae2d014197bfeb84f9456b6b1c989a6ff70d49ccf9063ec5ee07c2a6dfc1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e60b8e9a48500ccac39da5a16ee1701c

SHA1
1bf76ca95eca7b1236868bd7bc89880debf12872

SHA256
099321711d2eb49539ab19c7256e12ac472994c3931e5d3e26bdca125b733fd4

SHA512
a978418fbb87fb6b0b6df7dc5cbb32a6d51fdfd709ac0f4b81c7a93d80bee458cbfbece19466725858a53681edbea90d518aa9721b996b2773eafbb85d6f42db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33e8eb47f95056c3a50b21cdf590449a

SHA1
9a31712ac59440dd62086d6a7a88d0bae5587b20

SHA256
15de47855c0e007d660beeff577a9d46578f8fd26c9a7ac1900370dba5780473

SHA512
dfc9f741c5a17e3ef928eaeda779eac3e07868b8500d2dba7f0cf965c3c671a6157b4a4ebeec222f2a0a607846d1c494941416f5005da9e6270830ec9cdf38e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9170ea7d5725c9c91c59e343ac3554b3

SHA1
b1a7e658325fe44297a7ea5960fd380bcafe694a

SHA256
b4a834e4021c2b0288748a36b138cf56724b92e15ea834c64d3e6b5c73207b32

SHA512
45ac07d81bd2e9cb64ec10a06dd85562ceab5ad9031956b0b3f0517512e81eba1d60bb3ce638f7d60b1553aed8e08eb09e007845955658138c9eecfed8e22c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AE6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4BBA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit