0ef9fc1ec0d53252ba64d7b3caeebb422bbed5344bb200bba3e727ee495a1353

Analysis

max time kernel
138s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2cc263a7d8809a3625e9144ce969750b_JaffaCakes118.html
Size

158KB
MD5

2cc263a7d8809a3625e9144ce969750b
SHA1

e6b1745c3a2f41a741b08d81b74958fd691962fe
SHA256

0ef9fc1ec0d53252ba64d7b3caeebb422bbed5344bb200bba3e727ee495a1353
SHA512

2143f9795cb96a33eeae73e6a08375bbf90de09d31f6f6846952a23a518df649f01c33a1d502bb180057290d7f6343f7f822a0a57b21378eee88f724d01d2277
SSDEEP

3072:SXLYeGenp+GGByfkMY+BES09JXAnyrZalI+YQ:SXhFp+GGEsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d059c1c87ca2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004e857411f0c6129f52b64afc10af9e2c5855d5543725fd63713fddc283335e81000000000e8000000002000020000000391070f8a0dcb8724901571375ae20945684e9c36e9144f12c3b5456c59426c4900000007f42b9f07abcd8b5617d14cbd74aca8ffab3b429d96c221da73846e9419bc102c4a0660f580acecf84ba307624dbee8363f85570f5c4b96f187a1688116297b6b89d949560fef7438af667a632037f406516dba61b786b085bd95d83caa47f5b02593a5015ddea2c81fd82a37014047993cd9d43523922d94c8a44917e75d20c9467393961e331d48ceed54bd9f4879c400000005332fcfa9d932c93f3b7da515adaa7ab41dd516992278bb7df84412759ee42e4c328c367b051fa8bb0bfa31a88fa227f572b79f8330451f118be04f73bb92eaf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4971671-0E6F-11EF-9F01-52C7B7C5B073} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421467712"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000016947724a45788fbc5dd5a18fe2d504c4c42386de99e6ca1b3c8bb5411f6d75f000000000e8000000002000020000000e3d658a5313e2784c9fbccdb1377da94ecd5df80429d3a80972749e974429bf12000000045fb83a48d34a97fdc617e3ddf43bfd51d44f346304956a3a512344d0c6607db40000000368ba674fa3b6c07b3f8f11f38d1370ba6d6da0158624727404188cd5ed7f971635345131ee0ebecc1f5372de28ecefcd26f0f73fe3ee3b8990ff82631160dcb	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2768	iexplore.exe
2768	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2892	2768	iexplore.exe	28
PID 2768 wrote to memory of 2892	2768	iexplore.exe	28
PID 2768 wrote to memory of 2892	2768	iexplore.exe	28
PID 2768 wrote to memory of 2892	2768	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cc263a7d8809a3625e9144ce969750b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
896953505edc99925c18d7d9416dd81a

SHA1
7e7980601ad20fd61ecba8ef343b42bf8841af55

SHA256
91d0551a30ad40dc4a3381e781fb8df6917702dcfb5d916c4cce5643f35df26a

SHA512
9a976c3e317f81a3c3928c6a58a08114297d6f2aa1b2410ac9e4ae17015b4abcef99461225474646230defe0779cd6a59482cf06000713ea301624345d002347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21d02e5a225bdf7199b3c95aa3bb7cb3

SHA1
f47c2fcdd7f672b6fd40c990e1e32c8e16947c2c

SHA256
8efbd78fd7da84c8195daee6ab04630b802d6a2f48d4886ef8d6b30ef61c7dad

SHA512
0752c04849022795bdbd4102a2a3e3ce230af667d9631d704bf509b910b954e3b78c82b510971a5cc38b562ea223dc44f5b87b1cd7f0656357bd51a5b47d81de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab44f9111a2eef75e3e74c1faf26da47

SHA1
0c1184f093741ff2f77009174da47cecdfcd26c4

SHA256
66c50836331a1ef341cbe94d443dff3e7acce678bf9781eee9c84d2025ad0bc5

SHA512
4d97a06848639ab59d80c8c83e1536cf7afd95979633ffd4806fa47efe5b543321c425372102f8757e21ed387a9322ba89811e28bba08f4fe36bc11ee89aad51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c182f197c174130a8d146101dd5b3c58

SHA1
205a4e6561a4be10ca559747abb40a6f2b70b6a4

SHA256
b5f39060fa4658dc3ef5bc36e08d31a46c27d3a85dfaa02400b0486df5505668

SHA512
a95352d070ae1471febf9c091bca2aa7e5dad386918a0b7aab7499def424b7e035f90a89c70379db1b6ded9a9bba4a6c72f90b5a90be10b22784e431b4778e80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44b4993256c37439f5486f2be09b3ef8

SHA1
39e8bacfb7ad5be57323250a426a420c95704b8a

SHA256
c622dc84673e02deb968876654efa804e0a7b9c1ad98af896696385b52a308b3

SHA512
5c00559ed9685b8bfe8ec519a4f10b3626b9984bf3b6a01ee2c6bf16b4e1796cb1f2a51a9c007a53307a478ef7f4e6b115a970f5051971489dbb0feae1652cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf39f136b9ad4e532d6ae6a8c3748bc1

SHA1
877b1e19ce5260f2a1283797e7e38ab69410fe70

SHA256
67135ad18802bad56f3a64953da8504e1bfde78e3993eb739b5d8baf87b0aae3

SHA512
c02407d02e4dab0726038a4f0ea15abc2d0a26ab40f340c594e87c6b4a6af305ea1ed17d3de73d4d96168bad22fb79f4a73372045566768270a7715e871267bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb87fc3d924ac741779043b9d91a7b3d

SHA1
0383ef986ff227b685a0540e431d8586b7b991c5

SHA256
45856ee86cdf29ec59f0bc7a5877fad9bc0e2c79eeec33ad2c53874c8b1bde24

SHA512
ca675fd9fb36fe5cff445516a0b2e9289ba97ceaf3d95ba60e7ebe8324b4466f1b6b5d093f2ad3939d2636b4e14e0626e10c0033c380d88c410af35c8fd4b9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af7b0febd6956a35956c834be149405d

SHA1
9f0deafe5ad8b790cd6e883d8be96a50cab002ae

SHA256
f6ee18a25a15ac718e7b5afdb0ab8cca6e4b61d3771e6bbadb5a44e07fca9568

SHA512
515b088c4a80e3a735772a03ac84a65ad096f4cb225d2989fe116f8320e2210f6c14024d1d3eb45583b62d914c1ca0bebd66224d15608560cc3da6b56f425d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9889736c034f838917067b7e0cc4e17

SHA1
8c34eae37dc40fd417faf394642f9e0bc257db8d

SHA256
e610a5f38ab8388aa661977f8cdd1448371c9584f988cc8ec46f88f3d37c1c8a

SHA512
68e46b54dfbf8a50fee08ee2f7d546ec8802c8493df87178679921a70ad11638214e1f0871e662fe2cba70abfabd4116be7d77701560a3e78adc1b7634de3973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e545928a1644c0a8455f2dd1c810e2a8

SHA1
734af1782056a70a9b487b80395310ad2fb19a50

SHA256
6e89811c27bc180a74ab5c6b9fa3ed3c96c6b2ed2b42fcc1bda56c469bc7730b

SHA512
d03dc49568282edc677046f01eddbdff9c626067a4fced3fd5f4dd1b76e03a96ed11c648192eb1cfdc40163b31452da6b6096f3bfc5fd89e84186b94f1945e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9CFC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E5B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit