1c0e6cc4d3f0aa7d2c6dd0bd6541a9d274379b44f2d30644f4aab6bb25ca30d8

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cb9f37a9672ee163b22edaf18f5e796_JaffaCakes118.html
Size

35KB
MD5

2cb9f37a9672ee163b22edaf18f5e796
SHA1

a5cca6e9a6e8cd954cd71c4e2cd81c7c82d44ab8
SHA256

1c0e6cc4d3f0aa7d2c6dd0bd6541a9d274379b44f2d30644f4aab6bb25ca30d8
SHA512

ced656204f77acb8de6b5b655045cbb4c612b62dface464379e2316565bfd98a30fafdaad9fe0333756974449173f5f9ff64a4e13552e85410c66f951911178d
SSDEEP

768:zwx/MDTHsW88hARsZPXvE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T5Sl6zBy6OxJy6l:Q/vbJxNV2u6SJ/+8OK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421467211"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003effd421011160b5be1719696dfb3362da03021ae0ff7d1c8a8a4845c08105f5000000000e80000000020000200000008431cae231567b48a47ee5942127e45a4174a9d94087e5f552cca90b58d19d1f2000000047af5479041f48f791e6395001ba4bf7a0352e490e490ea99d5ffaadecb7ebb4400000005315d711b930ee0a534fb9d1d3232f257391fd66e27e64934c80b7339b32f281b10f0a69a497b3bc34f6856f53302422bf1f156c3c1496cedff94d8176fe02c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0df0f647ba2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ecca714033d38c86e7f0d4b1c136229fcf0c38fb8038409b508e8ee766a846c5000000000e8000000002000020000000a42fa22800db5836bb9f6b2593beb55081e98befbaf8d8069b62bec0ec7ad5d5900000009fec106d332126b5d7b68d9163eb6e17cc6bb1348e9e6078e8acd9a685cda0f3d90eaac00c668435d55eca963cdd6b4749a579906ffbb9bf00bc8cd1832b043795884cd377846143acd13540558b38188a13eb3e322270452dd1e5d0f10fffb5666abf9a34932dd0f38e53ff6789765b08b7880219d377e545d6af7b29de49f68547e3170ca7113ad4fd4c35505062d940000000e80fd2658640e3e537ef392e42e2cf0938a33d7d271c18d10b2733f2dc930c33f157fa93d1a0d5ec93c93dab518174849e42ec1ab9ba41b456381f52e2a89772	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C374AC1-0E6E-11EF-A7A3-7A58A1FDD547} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2740	iexplore.exe
2740	iexplore.exe
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cb9f37a9672ee163b22edaf18f5e796_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b832564cf3f7f8bfdeec99099e52065

SHA1
d42263513b2c3cfc97a961546cfd3cdc45940185

SHA256
cd26674b9504a7e82b4bf3affbe6fc565d6ea27df198ae607a70023c6e4aabe5

SHA512
412e3c1357d3b6c8ea522258b2a60d928dac091c76a77c8c84c2380b3a2e4ac19ec6b269b3b31710ee274b9c038f72b705600420f1ff60478463368c5e5b119e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82caa9501d1ce93e04c2994a3f213153

SHA1
58cb116629264df8c5621c87985366967c8b3917

SHA256
d3c39752d05e402ee4d0ce0acb196888a2800ace7a909cd520148138c6e14dfa

SHA512
a8069ffdfc3df8362093c35d7e89d3ef90806a6a39f3144ab59459bffa5eb3660e9f08b85f5a9fc950e86c4dec4fba3efcee627252b7c1324ab6edab28bf0bca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d35880c117676abacad442ce35d19870

SHA1
ed01a650b4fd125c7cab23fd449e8aab00aaa954

SHA256
2e14fde1a293b66a0c6033685cf00c36f1923a7bf7ac8dd9993bcc015313baef

SHA512
af8f3ae660bbe9b6af5aa865de9a9c14baf540ee643f25728f683619935f44501e9dcf7665c5e66b85a2c2c06093f466a4fe3eb85ad706c5901eba6a8673b598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbb821138dac0b2a960e48a3a7b457b8

SHA1
ff204ae65944c027683243af8c9225c3cd07d48b

SHA256
c5668483b67279eda16bbe1b5ace634451d898a8b97aafb7a12b5bcb1e113b22

SHA512
1a69a236d6187bfabde15ead200998bcf8a89f7f238e80fb3fed11d8dd1c7008bd576ef071b8299d0902bdb376c3467150b5fe2e7db88b02c825c839710dcc4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcca73b46f991fbaf7b8c70eb4c22474

SHA1
7c04f0a03e4830cd60492c66d636aca1598aa637

SHA256
03a2020a432eb1e10f50dc0c62ff60661b41b44f43a87e4baf2833509a43932b

SHA512
bb3944abaad4e461827d852fd62dc64cf8d8c5af8791fc4adb28e8f8853be1bc319f101aa1a49ad9b2db88e5a90e5c0e5071a087e5f099814eac78d9ef6b8584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9262bfea81bb7408b61e181345a14346

SHA1
86e9f521e7418aac8eb729c5070dbaf110703368

SHA256
13d35aafe0804648fb146178a9535a85d64f1d0e8d2fa4affbbf4e950b84e072

SHA512
186b4a685375d58c0b30f6f84a3a42d896a96fd58eb9e18e6bc6ddc8a104dd1643d1cc0830829a283602bf9c6e228625cea119e8f23399e62c360cf3d778c6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd6d7913a7c8ce3ba308b6ad492e306b

SHA1
771dc227c396678b3534f57df00137c89e26ad40

SHA256
c7630489e82d2f992a32aba13060a21cf052bfc2c08bda6545293a3b3e74a5a6

SHA512
c7aa0ebd5db385a232f0ef7a705375ff5dd34f51e625ff3457301690c945ca7c380f1da421b931681f092e9e52ed1bdca2af486dee213d4e2647e3ca4bf3c15a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c71c06ca72faa2d7fa04e426362538d8

SHA1
f7fd7a4244080583fe1d5ee7db3e627a6137f481

SHA256
854cdab02e09cfa4af60009fecfb7ef9ab703d3cd6bbbb2b21e8969a8f20149a

SHA512
48dc4ff31b9b109746969cb58d0b195362b71d331bbd3f6d873c05a7aca437dc9d5a87493558d2586e6dba96d0108070b485b86989373788aca45f584a171965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d80358bafc7139a4cb5fcc2093218e3

SHA1
b2b4b5abe03df29ac62831cf296aa65223797fb7

SHA256
054d0ddbd81f32e4e1989641fec98f3d7442e45f41fbdb50af78c65885e9458f

SHA512
0e2d499131d14651109d282b942a5e9e4ae6958ac4166b6bbe030d7e4a3abe15c4e56234879090484c9a28107bb19abeb12a16823c498793072ce2f0fa2e00d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bc2f78ac90048a6f72acdec5353e9c8

SHA1
b1b1a28e21eda6c81354e2c21477d658ec583397

SHA256
1fe29e60cfb16992fd5d41f4ca4a6a1dfba8b9835407e190089dbd3e9455464d

SHA512
4f4ed0c4fcc5fc37ef664ff2b38ae8cf2bab08ab05213418c8b9c008dbec06189b62e03c8b821d93829e1bb0f2e3e6f1bba7b067d37dfeda1cb77752464d0078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
044403918e5e930d4ea35efd948068e2

SHA1
96f1851d11bcf343c033c4101514ba9dde4b91d8

SHA256
25684d57d1da77c446007b8c25e7dff3005bd473457fad30c5ad39719156e676

SHA512
229a11021518f3ab94c6a6ec7daa6bd5f998dea46ffc221a973f133f3bfce290337e0d88cd0ff4993536f5b24a98eb4393e71e49d0c32691436345c0ae85b92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
077ee9631421f69a539b24a4530c1937

SHA1
2c0c4d7a1ff9fe03e6381450cf40c049b27f943b

SHA256
3816f8dd4aa0ffc88521d8bb7d5dd1caeb0bea56063760c616b21f542368edce

SHA512
0803d149f451a5cd0c84e4973b08966f4467986858fc7ca2220f5868439b7f6c939ebac32d0a06f19ed9d9bf12217e785e05b873d52730cc95485b0a41b7a81e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bdbe313e1f51294b66b6a29d802db66

SHA1
5209fa6397518d4d4e3e6eda141d734de251af1d

SHA256
6441053f887959a7aa98409ae8652e5efc5345152fd569b338559eebbd517c33

SHA512
2dbfd9e5976c18283dac9a4240350262dac37da05b7c990df5d457005328c3ea8986fb9422e2e708a8a9d55dfa3080c9939657a3498e0581789a07c0004a9879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0009b1d8ecfe14505c241d993081055

SHA1
d4f810f6e83dce6a07eb2c82ab2a6746862d92ab

SHA256
b500c38ea4c5d5f7a7b488c8d58fbf54516170dc68343a1a46319751173edf24

SHA512
6de9db923bccd4ecaa4a5ae2521a4bea7e8d645d4a6107ce6be2cd185b7604841e068d4e84d5314e859ed5e06488884d1fd7b9fc9fbda7198a8c1a00b8a6c027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8af96b9eb145eed9cb8efc0950a52e7d

SHA1
248717faa245324e44a9c755aebc1b6e36987794

SHA256
ba633fc3cb4123a60cc644cf29453d361fbf32fb9896067c211c4b1344ed0b87

SHA512
b18331880d25a8a19498a0a83a2ecd848c6c1920cc680b05ee2dd9057dc07152559958c967a4cac47d72f6e8b2b8c8d26de6580ea8b29da6e212f1ea574de7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58be72fc635f2f124d3dfcfbb838a5c9

SHA1
8a28d2240cee0ef636607438d3f7c2b1490fe842

SHA256
24e0eaea6cd46103fbc6ca0a4c4f2a5fdf28f7d9975c60b1873f08e12df68a85

SHA512
24f1b52e1a1a92f6f49fa34e36b148bb1785da2fc66134b3a59594d85b1f82874a8d7daa5c93f3074e469e2ed7a41d78897b0fcc14641515d26d2c1e5f9208b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11FD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13D4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit