56d4bc9ccd0eacffb3ed5d724597ca16d7f42eda3717491444473cdabe8a723b

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ca2b6c260e15ee5de017d8157efb407_JaffaCakes118.html
Size

31KB
MD5

2ca2b6c260e15ee5de017d8157efb407
SHA1

fb2c68fee5e75fcae23d9e0b8060ec10bac8db8e
SHA256

56d4bc9ccd0eacffb3ed5d724597ca16d7f42eda3717491444473cdabe8a723b
SHA512

aefb42d30e833ba7be6e667339d9f4ccd75938e2bcea10a24757c621374458e4e0cae0cd6abf72418f46f0b6375e2931c6bb00bef8c2009b9e72c9f2f0835d89
SSDEEP

192:VWCk3GDG7GSFGNGeWqGUpGtqhy/+b5ngenQjxn5Q/nnQieeNnOnQOkEntdNnQTb/:ACk3GDG7GaGNG9qG8Gt1Q/fWSDSQ/jg6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000006bb5c536b7b89da85f1a455b27e2b8939e4d6e7c21701dfdb1904a61f6dd41ad000000000e800000000200002000000004cc1a08a5583548fc8913df9d850d5ac904296a7c1a54a67171b637d119eddd200000005dca689a549b6a4b39c12b570d23160af4ed59214c45ac06af22ad1689b0e02f400000009a8433346cdbfe929917df47da8b7a6ce9d96fa1e21f0855dc9a9e3dff95d85b3ecd63879cb34738e1059c73b286570f9e7cd8ebc0336b2af277f8d679dc7d48	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0da01f877a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22A2B201-0E6B-11EF-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421465746"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000cd82995b007b1073d79cf1d6ca10860e40014f18e85cab43e76bf8427b82da6c000000000e800000000200002000000066abd398c327b8c5def4e2d87bd834ac24db38d1216e1fad449ead0b8f08f0919000000055579a4bb07df69b8e446a3db945dc83cb7274b1d25edd4a8ca2a0ca8514306bde95f647432f4998903cb5dc48166c3181016b4fc2206608d5150a8234e370c12e55ba5cdf4909091ba5cb70482fce94e4b6a59e4e33a7ac44136fe2d9280cc5f79a4498a05d098b498754f039ea6253273226567e2a32e3dbd9c30ab4d33479760c3384c39fb3336f9bd6a3bcd3862940000000986dbe7a1a99df02a11d6ad82d58fffaa3dd35407bd26cd28a5c6b58ba44bdc0ea827ea4d480837ce062cc183dc220d6b3da26f22683eed39fc6ec176ece2977	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1308	iexplore.exe
1308	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2516	1308	iexplore.exe	28
PID 1308 wrote to memory of 2516	1308	iexplore.exe	28
PID 1308 wrote to memory of 2516	1308	iexplore.exe	28
PID 1308 wrote to memory of 2516	1308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ca2b6c260e15ee5de017d8157efb407_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e3a0f1d0152e0ac36c5520b7f1d0e69

SHA1
9617559844c8852cf1949dd799da442dfb70e273

SHA256
dbdf6622b025a0e072fc2cccc28f196ed7ceca8ea66bace1365e3940860ddb8a

SHA512
004ec47b1d86a2cad6ab1d13346aa278bbb319ff88373ca7ceb104255d3dcbac81f141ef5184a7b9c6b77b8129c354b0ee5a9c422b9e7b7f4f030c3bc65f2f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45f2150eed0f64ae7b659aba3fc8a24f

SHA1
41fa16e6618a15a72965c7d00c3c95f400d932e4

SHA256
7eddea93060a7a77ab07fb873bbe8cb08557d07f4a2e98328fe660c931f9ddc4

SHA512
ca4df5ef525b5682c2fdf97ca96684aeb29a9fa21f04d54345c4d209bf645a77b3cf39550409755f2c81e8abd2aec3f88bb52dedec6384b9c3dd0a5b52fba5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eef5954c19a9ff869394b26e7611a4a4

SHA1
38c7bb87682c1f810fc3f16e1d0cbfd1857d3f30

SHA256
66c2be0e6621f630ba57ec16316b8b589f0255b5b3eab545b4bfd14854e58be4

SHA512
94e7d34994f993d1ab337c7dc0bf14cdde761ffb7b1c58f4c4dc84cb77c248d2444124b1bd4543622e9b47de77651af6a3a992783509230872baafee8d27e041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca14133758f2409981635ae35879aae5

SHA1
ff4b94dc82f3be54be27f40968f215094c084c22

SHA256
20293b7887f84658aa466683e1c63da27df15c2abd0b8e5480a9783de6037696

SHA512
c2c06458be16ce14ae1434352e41ba407bf869e9a9a80966a1364f8c7a9f45fa8ee323d1f952eaa33019623f52467afb1c4c5a170f648a2932bc77a4a5c66617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7da8034e84bb4f1af2616ad4e425c16

SHA1
b12e178eeda7538392b1fecb369b6334e9e2fdb8

SHA256
dffa3fb326f64525cf5447d8655aabb8b7353c4a01f4fa7f69d9bf15124d7101

SHA512
c1873bd3c631335a025b84135237a0c362c3b568b154eca89e24496f8144085b7f40d5c68e0d02d8abba41df5bd3bb8a94a0e0e720dad0709ec5e6e5bcfcf3ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9448d059e79fafe1a0572e18e89f703f

SHA1
f01c1ee517150888fb4137334f7d58e94619b6c2

SHA256
8cdb15c3d8e24f86cc16fa65858dc215c3191c2e0cf3257ea4126c08705d5573

SHA512
0c084a9ff74cf8047966e35d4949f8d59f5b4ab098fdc4b31627a2dc7ea37615c5d86dae498aec28d102bb66b738eaea2e0e7add52177e35db116397436c54ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8722df239d14638ac35d8e8a35a1f9d

SHA1
39f9b0f38d37fed81cbcc6d077958e87c1a0bb5a

SHA256
f4063a032a1c715d64f9a79ff914849add8653ae31751e50c7b8cfea477661f7

SHA512
089d2b5d478f04087de187e0df48deeab72769fa992ac492dc7bbd67209190dd13c042c1f57a44804e16ca05833d03406836044d23e44067c72c0f7acd8bee9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7bc58c485ed5cb7e7fca5f0a01ef4dc

SHA1
cb3da7e5a444e29ab36377305dbb0b431b65dbd7

SHA256
23668da72c85c21b33d6df88e54fed9f88a3b8b5f414e14a5acdc40cda6e7fe7

SHA512
7251a4f726b72154ffe4cd693016b4da1532907c0f0dd4a287e7436b34e5ce608d09ab468f5c54aed250bb40f21e4530a3ff5073821a83464c35de2ad33c8380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f78538a662c0f10b19c9b24956f8bc4e

SHA1
95dbb67de8dcbea158773a7dc71641a661cf70e2

SHA256
011c28792b319960ad68432dd8e78f892d09f1112fd0dfa60f2f4c8c0dc10a30

SHA512
294d7ca0ef19aeb35fb8a13a38adc940490741ab3b8efd7a02473453a37f29350eb9e9f4f9705fdc560399170af4b9c1b3b0f320a4607c7139bd1ae4072fd633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
721934e126107f8f3b86afb245f3a148

SHA1
ed7dfd9251b4159d5af6154c7c9ebf3fb0bf030a

SHA256
c9c8db757f16e6786d6ec7f828d673eda255e038eaf2e409d3f963493767353b

SHA512
21be3051c1bac0c194a3a5a854f7071c663156b3e41d9978efaedc0047ce3326a055617b1636d7709f0a33d41965871a063234b6f6af49ed87cccc09d322e683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efa8b3ed2dee28d04569246396cf0a1e

SHA1
304c459097e18e34ba953e3e0b3cbff58421b744

SHA256
87c59b49833873f8a6e8cd0f1ed4ff437339f741f570bba7c7e4c95b607fdef4

SHA512
a363b9169368429b7a1f903ad34c9b4732e07c1867a25e859177fd75ea9188983106ac3b4a804be6f8cc06c8985688e93e7700aa4824b38421899eefae0fb004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51d26c675b7db5257d8478092e4bb1bd

SHA1
6171058fd4f45803d907127bb2553f8213fb48c2

SHA256
f08d0611704ff18b36c2769342ace4c9343f9a5f3f58e18f5aa2279b3bf16073

SHA512
fb7e470a6d7a2fbb4081c4d630025015b86c191f8ba86d02e1740f7017adb60472e91bf47e01c9243397920be7bce1eef212ce1dcc25a425650d83372f250988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23d8feeb84637157579f6ccc0f8763f0

SHA1
221506a6f07b10f1fd5c0c8360a67421213faa61

SHA256
78c9cc00eb0eb404defa1ea8d9b071688da5bfa882d0041575483615653a0348

SHA512
ae09484173662097f0a4dba7b1d0d6544dee05069dc8ae533a8c52523ba62d98ecb37de75bf02e35f2d49498bce53fc055ec848c8bc25269c8bbdd2c163518a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da31dc7138c8505e4bf9f1cd66419945

SHA1
758763ec427e6f74b119c221208a3602a8ef6600

SHA256
fcbd85d1b058445a6f5b161cbf92338b63a70f59e65ef42bdecdf401b10cd452

SHA512
ba092cfcad8576da1e15dd29640ee142427b326dadaf690d6e7abb6e28315200cca36a9a6b5d9782dc2f4caeabee56fc0b1b046e5cfdab52cc7b7f56e1e9e278

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4B7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit