b1523913914850e5e2ce5aeebb7c47dff13db929c47c285d2a1ce68693768231

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c9b50440001cefeda6c86f38317fd26_JaffaCakes118.html
Size

24KB
MD5

2c9b50440001cefeda6c86f38317fd26
SHA1

d4163810ee615d6159b2834b2ac44129db7e589b
SHA256

b1523913914850e5e2ce5aeebb7c47dff13db929c47c285d2a1ce68693768231
SHA512

163764e6b5abe55c44e7d5b75e6ef05a12ac3d45a6cd27b2fc976954b7ab850011d496b63f52b755e9a806a6cdcc43fac48bbec3c40ce1dd35501ba3267f4c62
SSDEEP

384:WX6qUVkczFiX4pmOdOiP5oTokhoy0tet2D58tAYsNNwQzdZeoNNYU1kefSa:WlUpzFiX2XPMBt26theZeocLC3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000347004d47a3485eb912fe4392135e22ab812ea1902748ef32061a1c1e59aec99000000000e80000000020000200000001bfd119663b60b18fc656aa7d08b96848a163fcf5e5ab7b7cafef3b09484742e200000006e6d3814a3a45cdda6881b5ba6c9fb727ae56a34d02c3a35d35708d6d26c1db2400000004d5be221c041a153fc21a6f18ca5e82668ebba7b0a19cbe98d682a757b905d8f9c839a452438bfc1dce6a02aa6a133472c4285a9a66d1a816390eea97ed27a38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000059481735b1fb6ca4fe13cc8cd69d4b31e2b7e6e0b5f38ad253dcffe35af7f586000000000e8000000002000020000000617e15c8d740a333a0e413064b59d1c611b3272b8920b9804a604c52206b55019000000044d7ffaee7f3e654edd945829d67c9b82f0b74fb22d723c6f92a90175b2eeebede270ef82a22cca370212eb8f4242aea48e635bdc61cc23de3f36bc23fd85a08ddafec6edd217d2ab3ab2c3a5dd07f94e9a8498455372d514df65d39e7f3e4bba88ec5dd2cccb71cbc670895f6f48d473ad1a647903ae93f9e948e7bf51f9376a952003340682a3946165c2249401a11400000004d9c5777ca765f490c5121287b839f2466617e3aef6b09df5c1e6c7c825f0a3e9af8182b34e9c1c58d7b34864a5a24380e0d371dc55acf7fb6bd0b227e67a2d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421465304"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400fe9ef76a2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AF4E511-0E6A-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2564	1708	iexplore.exe	28
PID 1708 wrote to memory of 2564	1708	iexplore.exe	28
PID 1708 wrote to memory of 2564	1708	iexplore.exe	28
PID 1708 wrote to memory of 2564	1708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c9b50440001cefeda6c86f38317fd26_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
526a32e828ef3ae6cd925061aae64c7e

SHA1
536531e12f063ba96cf6ada98f93ff6b9aab3958

SHA256
54765ee28f2e28f8af444cb212d4b18b306ebc6f6be2dfa9719d8ecae8806b68

SHA512
1ed61daf3bb3dd4ab13b1d68d95c7706cf86b7d879280fec8c284ea215e1a38d670f331c243ce39eb170a1ec9ead5a1b387b05c77ae9d63ad858e247dabb6516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
374b1fa3c247c0c977df172728f6bd20

SHA1
be3ec02e9f781a54d25f0f74a344987674262332

SHA256
26d670eedcdfb8deb6b8afc6dc75a8f2a37bf98f2587f452d2d1acc7a53b2562

SHA512
a10ec309db8cad93a5e09b16027b7d6699d3947a3ce141645286cfa98070e7631dae15bc497ec8e220334daf0582e2a1a5791e13defa02ca6dc1147feb397ba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dc8c36873cdf6c1d4678dc88dca7fb35

SHA1
1474b64efe6fc09cbe1b83c274c584f484f77423

SHA256
cbcab5999518f7f3c41732caac2688f2f434086a6f0602144db46520833d72fc

SHA512
359e48423bcf48af473b1dfacee056a4c08a791b973c0b84b821b41f2da288f0d3a37bf9249e6cd8cf380fea85842888da505441831e43dd445630f8a0397277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d311c99432bccce11e33db50199534b7

SHA1
2fb851fbd3b4e46fa988ce60d74d97a583897c23

SHA256
ae516ccbbb9d44552db6302964f1497bf8f4f834c85fc1d5ff211e2c175e7d50

SHA512
500a6080ca11681547d1d16628168f482b83363f3d83d9f6f3f3f68e65f0b92f0edea452c08d190900bf3752e9a571d0c977ff3f3a4e43eb07f4dcd715940252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d69eeb43373da7cc34784296d14c3b6c

SHA1
b09bd8362bf903dda6c130ee33fc4d9f91382838

SHA256
1572270c11e11ea3b843c4dc5bde4bf693ab99f29a231bce86bf7f2005c2f81d

SHA512
6df5f9a26ffe10b0b843b391d4988f712a41dc826a7a41a2ccaf6523d9a85f02b875430d8306d7d620764fdec79a5b6ba1a3c424cdf005ca52b15cea87905520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
341e9cab7c364da58cd6f7c340e95d89

SHA1
1b0d4d0017751013975c67263e57b637294763a9

SHA256
24b2cb14c2a8a646ed52790818f4c0bebde3346292fc4227b217394c292ddf24

SHA512
4278e099a5d42006d7023413d9de4d6341eaea7c5e82a952afe8996d0e023a24fed1b85cb0b911411893cb19fb87b427587107865196bd196c610129cc0b9a07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e490d353e744e652c625d5a640ff6958

SHA1
acdbe936535c769a2e5a3e109d0a0b7d8aea940d

SHA256
7f391f045066c251c1018498a5ce21e757227ab01bc7c31383fcb6d53e338e44

SHA512
734d1fd796bec3fbab9a9c1d0a502569561b0fbab2338795e1262f5c3357a5a01db947d9543350d547a41d6444c682610460cd5da169e376060b093d244746b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d38e107190762fa3513b390521af4e43

SHA1
c23e048a2687030cee5f6df759994eba65da2800

SHA256
f6b8a01ffdf05821b181e178e0fed2cc4dddc189567013e901b07bc3d95323b6

SHA512
8be5338ff4ee0c17979f7e7720a4230f2de9181a428bd62215867e2f7b337cbb40635d7715ca6eb0ff71e80702e872a36623f62ead86ad649486ce5bba0ffc1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
46a4977384e715e756a9851d7bc73110

SHA1
ba5f2c621742545d7cb16982f206dd9ee79556a6

SHA256
c7012e50b346f9cd28e234cc6cb18bc969fe11a2e0107e1d692088fb3bd7b18d

SHA512
88e98016d405f6cd5b11acecfd6376edf3a3b20745ffe315bc9c47519ca3fe3264ec71d36e184a315d6498d80720fa2d2192adb16248a864d1f467d6e8951125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8078132fa79566c0ed3dacdb05a11c27

SHA1
2862ee9dfe73a2bc23d38f333274671669fa6012

SHA256
efd4b0f6d898cd60e54020b3f21ef9b16a6f481aacef9c403ae845e3c4118dfa

SHA512
bb07488369f9915c9ed5f207d7a0cd14ec4f50d4b0108721311e6be7a94d3aa39c50d155c0b2d31d1632b5e488934b34339cd438984da000160ee29e270c4504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ecc3ad9a9ed79bf699741568070a1e04

SHA1
70ed54899101c5e5e141aa2f70032bb1faccd5de

SHA256
fc51386ca971850ee5bf1e48f119cb85d754e4f23faf73ff17d4bd1183db80b6

SHA512
e0112b2f648c1d4cb05d5a7cac7ef1626389e21a1cf69c26d3516a9ff52ae489a890d3b5e40c8d9886d17116ae3b3156dbf96602b1116a365d2e3597a297f33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6bcdc0992d667be8c12cf08a2089bb6a

SHA1
675bf7248b378fa98e3604a84aacf7c2fdaaf5b5

SHA256
80627685b14d2b2c9db3a337d2253a7beb85b2cba2df76ae520496bc91ed40e1

SHA512
7edda234714f262305c416854382e0da2ce0dc435ad56c5b125323fed96dcbd29f1dfef973961f4d05ef216b82da28ff75ed2d82b95cf78d2dcac092fa5aa612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
85be61753f1490562b3468c38b9d61c0

SHA1
08f1a84122c65ad612624c918fdee52428679c6c

SHA256
f423aa4c5be80582307aeb01e216e107b93d1d89e15614e9317d0c90df96fe97

SHA512
498b157b932290c460679130fcdb09cdb9185f8ca85618a6390f75f3afdd1e3f0289283ec50000d2e1f69c9b04bc51f1ce7e63153c4828b6cbce431a1bc65cf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
26df2a177e38b6cc71939c8c391b3a6c

SHA1
f938ef36b459c85ac25fd1499e843f711a7e42aa

SHA256
ac15339065add787bf8ff070a9120df76a2007bb41301ef42e50dfadf00572fa

SHA512
0ca0d894b1741a585570f17a85d0ccbc0c50793016c6bcfd407715eaa4514242ac256bf851182e83b946dfb7191ec167eacb64080bd2324b99f8580d163d1c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5fdc0adbfa73acbea5a353a4091d6174

SHA1
5d49718e8526acecc9ebe0c8d75c1f1e2ce8faed

SHA256
401d0908c2fed5b922ed08bfc030cab9ac661644d29824ed7ef2de2190099dfa

SHA512
5bae43ce6356fd919032b34d6cdd30995a8c400ce5d3b2e2279d858f238581657ce6c19ff1bde69847daccab961e49d2305a9130fe50dbd591e85a04a58b8cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0e92f6238d5aea4e039369e2f0e905bc

SHA1
9af078e154b1e00ebd44ab1d8f38b20f5c8b30ea

SHA256
e6e8aaf4456d6560f878bffe126950f95eda7316d008356e29dc6f1758ac52bf

SHA512
b111b0dcc722c5af3eee17e0741068d1b35346f1ccc1d255d1930da93620d164bb532ca810f79dda10d616e6c71b87bd7e148e0770982c8bd7bbdac212aa540f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA45.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE34.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit