253b4b9db2a73e4b2a47c6a88ff7c36c2a206c4104fe91c6956138e8ffd8e1ca

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cbf081474fd074d10a1db7d0dba2544_JaffaCakes118.html
Size

879B
MD5

2cbf081474fd074d10a1db7d0dba2544
SHA1

a123c4125b70e5480c4ad457bf0955e9264388a7
SHA256

253b4b9db2a73e4b2a47c6a88ff7c36c2a206c4104fe91c6956138e8ffd8e1ca
SHA512

b38fd6412677dfa39308a70040e67a72a4cc9a9f57b5e2a90a9fe4f0748cb6717a3515989d30021eb482c19bdb0ed992050a25488c721fff0bdbcaede34aef00

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000c04a6ff0198a12d110087623a804b0371b8fedeed485b4fd7a3d72b4ac9666a7000000000e8000000002000020000000bc191ddaa293813eac1f2cce49274d016aea0716044a8da7e7f423bf0733aa20200000005a923d30181113570a7beb6afeb2489a2f4f19871e82da2f3d5df43bbcf109de40000000ba7935c6bdfeff700a8ce9d6fbb2338fdbe71561542356a89eaac5f9d71f10bf9c82288770811b9636bf86c2125dd193b0cdb3101f5e3cebaf9c2abc09c546d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421467482"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DBAB441-0E6F-11EF-A965-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000006dde54aebf6d271b654ba8efe9cd2f2f8ad820dd609a03ddae40fbf19c99faa7000000000e8000000002000020000000f3ef0515e2c7489d0e30c6df1868adbb6614bbd84587496e5a27fa1a88160ce190000000f0d38db930e50aafe1b25c5c3334b3d0e492d34d1659dd9ea2dcf15b34748c8e45d1100fba38d3b26cf2bba92db72d622bc053ee3bbb5a9f7c962bd56f9428a12732853b3b222ba0854598e682bf10deaad6695a61879c8bd4164d58ed6f2d1410dd2c328050c478c7ef937f00ee947e2aa74ed71c97fc50dbf311b28c9e1b28fef3ac957ac8ee3e4dfb44add8fa8bda400000008d31c1d5575c59d76280054897d3130187d483e075ad7cd3f292a4faf2dc72696f4849984ddfd226c381696be1921279e511550cfa6cf721ddf19fdd68e69a54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101056027ca2da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28
PID 2868 wrote to memory of 2080	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cbf081474fd074d10a1db7d0dba2544_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65b014a976aab564ac05b7be88ccf80c

SHA1
e5dacb7aed910203200c5e826e5b81d71fe4b3a4

SHA256
4c058224e9c91c8cf307065cc7d9b4336e418556447ee8d1ebe1ad34cbdae625

SHA512
5a0948e70efb4524e3084aa2cfd3815b217f0c21ca90d6dfc3244feac0674dc6fd9d3814d5dbc42ed052ba8556c3463be32537ae2fc63350a49f715f9b9ccc3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77a7a5b58fdf223627731e0d50b430da

SHA1
bc295d06f2b3a382e71a616280821787b57cbda6

SHA256
8e946e657f3a06daf8d840f2e6f3c779b67fcf02a5460d86f725dce59d6bfe4d

SHA512
304f79b63b8fd8338693c6bf40ba94fff695f10ac02c5e5194a031261405fb5ef658b4fca653711691f8535d0b69c8147425a5018fa9e99e4041c012db72147e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832d1827b1df1e6d7e5d338086cd0e33

SHA1
6fb2fae4b59628e014e8b3511fefcd2a013c8220

SHA256
497df85881f028adf71411007111e26172b44cf91bc9eec1635a67ae4909e570

SHA512
0a4b698515029a0a6706c1e4df88d7fbd779fd840a922a4b3533403e5ba6a4ef82f7ed43de8f3896d23c5fcd5c5f4dcd993c109e50e31522be17a7b600a45a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32860b37c99735993ed05dd113cb5921

SHA1
05c888b89a1baf3be55937ec02c953a0c4b069dd

SHA256
14b19186c32e6438482438833739305dac748592cbf0ac415a40683954a83e0e

SHA512
fe06a713891f19d763073f85bfd703b8352838583efe6571d71c3f8982ef8266e76e7d0aaede15533ab55bf354a6e90900ff6a61eb5b2d009d072eeb24b7504e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ee4f6c1efd450ee0c355dfa898507a4

SHA1
6b97908d1da10fcbddf6150efe88b70097ff5502

SHA256
9639a8cb5876659640962a021fd867d4feb492314969af79daf05c9589c08dd3

SHA512
e5f0f490bf94f9d1690107f0941704ee61504f78c74a746b7bd3ee9f13219a31facf81a03b08374897fd5fc94f741d84972a468371a9303509575363d5267cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07c3747f0f30102c165e111ad9e101e4

SHA1
35479746a1432ae0057aa08af6b42f4481daeac6

SHA256
a5bd7c8fb919c3042d87152404fde2a9c642c4cac13717deccd25473f5dd6460

SHA512
a928ab32531742cd5b6b46ccd1fe2e7e4cae702e53464fc037174d09731a42d6e6a8e7d43610825b27b1f5a813791278cee6ab58eed663996a4c384935d6b2dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f1dd70d2261aad1943c68892b4c1427

SHA1
c55bd836562929284306d447e94dad975b563e9c

SHA256
7665607d7be3b227f435f1700896faf6d95a24252ac9402758c6e525aa699a47

SHA512
b5fa1e8071178f14d9e32cf366f64f9e3fdc1ccc53f4104ba5fc764aec523dc4b3caeb3bc3ba0d98af49fe62739657230059b05526b4d8f41709ef4246273c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
760bb486c44a9ed42185eeb1b135d658

SHA1
dc2451465ba8a42c099970644a9a7b10c8f6f347

SHA256
cbffd33f86a35a25874418ff9a6933510510c0e3f0f180de9a11383208a2e3e7

SHA512
e1563122bcbc8cd98c3d184037379a8a0a0cf85980bd0b3d0bc8e661baad05491e9cf1476c6b8651f3b57b10504b694de66604aaa3888882454bee79dd661c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66a699a324cb71977525c814524a4c40

SHA1
b2079e98529a8d08fd14e83c9fe4db9a3a103221

SHA256
9c7f18767937e1e6d10227f39b0dfdf8c72551b3e7f1453c7083536ed661e625

SHA512
6dc65de9a054cf7633d24a968d80187d804ad6cc1a2b1f06651ab879c27ad46b8d0e777121ba49dc48bfe9f397094db8b26ab0ed8df8349e8ce8a5b464a2cce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b0a32eecf6ca690c780258ddc2fbd79

SHA1
5d9fe181e320b9c946b14ee62d0e777f9f36c4f7

SHA256
18c9b293e459dea61c608d5986bc98c8a5785521b2ea17fbd82a9e8ee0b497a1

SHA512
c39e6ea87edb07db90b0b1ae7e55e844faba8d7923ba863ffa5618159f331fc013885e2f1ca58f89217ca5001a71214fe630272f4d3e66cba1f9c7ba965edb2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2EAF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CBC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit