06e4532a8ef66bf326f869753fac5416f914b98d5fbb57b52b216aff75b0968a

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cca0aeb5ba8659181ab0f49789b6e63_JaffaCakes118.html
Size

462KB
MD5

2cca0aeb5ba8659181ab0f49789b6e63
SHA1

cdd5ab5fc3225b95d2892b7cfa379da8fe14a24e
SHA256

06e4532a8ef66bf326f869753fac5416f914b98d5fbb57b52b216aff75b0968a
SHA512

4d73add621ec4b92d5d8261c43520ee9bcf6569e7d29c1531d7a9f20db4f8b52fb3263815b11426e79d3f23240f59e4687f77a6ff9890941abda0eb990bb175e
SSDEEP

6144:SfsMYod+X3oI+YnUsMYod+X3oI+YJsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3s5d+X375d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421468244"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604202cd7da2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F47AC7E1-0E70-11EF-BB01-66D147C423DC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e43a55db6ca637ddb836c78ce14bc673b0708dd40289d73b7975fadbd19ec30f000000000e80000000020000200000000ce0a4b84edae0d413ae1e91352333bf0c6e620305e18d9f88f6f1ff5746276490000000e556b5279a1a5dbce68757aa8cc04eeed245079318bbd0148a543b4ec4e9e29ac376e6a523385363a64832e7c008d6a7a5c89cb21d972806fcea5d9f7bfd6f1b0898723945d473cb11eb3f25217117a79f28bb4806c4465ca8224007e97e7820f273557bee19cff71b3d9137851b448c0df3592e4f088eead7be66331a9b1f1f8166dfa5547828e51da7f0509d261072400000007ce8552f8c9d2635bbd076ffd255c0a413ed2adb157df9c00c86be0c9b854338b259ff261527e717fccdc442a9c80ffe2e6cf5ae7d07a835a66b812f3e083b68	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000003074071afe8e0368f9d601b97fdb6abb1452b543ed9adcacb1ddf573215cf656000000000e80000000020000200000004b7d4f4b8db7fe14db5dbede1ebba31cd593eb3e999bf1a43ebbd579e7c69ac1200000009be82ceae8f9a583f680a3b68b800fea52d1fcd923977246b4c591d950c6350540000000fe5a68800e880b14829474f6d02124b2a696f013dbb873b07d9b3d61f34a34447caac112e6e2dd1132d068c2351e3c74a0c57335387e2ebe3be9a2819590bc80	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2192	1732	iexplore.exe	28
PID 1732 wrote to memory of 2192	1732	iexplore.exe	28
PID 1732 wrote to memory of 2192	1732	iexplore.exe	28
PID 1732 wrote to memory of 2192	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cca0aeb5ba8659181ab0f49789b6e63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a8536f147463b2ced54dc603a32540b

SHA1
3719a454ec138149f5a46c6336cfe058817c15d5

SHA256
8c1486dacd42dbc0a17474f42f63a5c110929faabc64940fc8189f6c419d7ad4

SHA512
7af99b940eb88f2d6e2ef56cba187af04ed16def7354c9042af19555ba523b863cf5c0d44764dc7588c3e48b057af14d34fc310cef1fe92d09498b8e7f98ceaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8142c188bcd3b03f1bd422ea927ebb7

SHA1
32ecc86d1b98b3b0e158fe6024a7be52e056c9b9

SHA256
f7e910eb405da60753f5a83f5578d11cdafcd8c275d0ebe2f3e66b82653430b1

SHA512
35379dabf10a60f131370516af285a35a78830ca1ab805e6adc91af37a8d75d1d686bdbb8fbca2c6a0cebc47d76991d1a5057becffdc194e5cfaf78798215bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da827b7658e619308519839e825b431a

SHA1
0e8817e93146ab50a53af926206c11b0425d16e3

SHA256
802825f05d0af28456b8596cba54a88bf932a2ad30377ef87772277fde5fd188

SHA512
fec570600e9d1f0e0151aa32767aa069eeed3f5a6c3f8e915901756f3ad756c449ec0415fff1b55cc82f04560f75621c723fb9ebee2a9a65a72207c99ad82f3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3e3048ef25aedaad5a4236656d99c88

SHA1
8993e7c424823c2eab35d10d58862ffc07b97b2b

SHA256
46763c1eb94f668eda08ff061d39de45e7a8e82411c2850ecf612eddf1357779

SHA512
148184c1bef54649767ab7ab58008dd64337b1ea0f2bc88ddfc9d30996bef542e9a60960b0dc108010dc5159dff36d984ed7e3174197ae1976dc83c27fec2443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20a7af7328d738b8ab6201a014590381

SHA1
f3f9f748c02226b7f2f0437e238af183db6ee4b5

SHA256
791e86f764e61099dfb8b384e10d4b85d11d05765175381026ab807560e257df

SHA512
ea4b931754eb162891803933e9c72a24c742d8ee644c95904da8531e615d6679d32ec32a2534694fdbc467415a970a925874a398fe64e3c7f3f2537c5f1e1dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc2e42a907500aad9eb25ff091f488a2

SHA1
db7915915f95013164a2694b45750936be149965

SHA256
b19c785b7dabe7b3dd44fee0b048306d6b3763cc8d8343d499eebcce626c03e9

SHA512
875faaeccd0108e835b9af3c976dd96460aba26aef380f8d052081e7409aa5efeb88287e256dc3b336ffd78b92b95583997ed1c521a525a9bd218e012781f8e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e4df12e28819e877a06a0c437cd85f

SHA1
60c78572ab287b09130cb89e09abe0aba65f2e25

SHA256
3162d9fa9f39680e407ce1023457489f2e864abd7af6e1dd192eb433e38aee87

SHA512
dc6fbc7e1848837a9643ac4e87b122cfced470579766a2e89f99e813e6aa89d1ee7f758fece43ba58b1ac76258615f69cbbbf4ea77c4567477b8f112d9d84518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f42d6837e69d455c0ca5060e62bd230c

SHA1
7a6de465aede676a1d2773cb8c67c0c2e56b8498

SHA256
ea8cd36a8a7c34819fba6a1fa5ec33c708a973b6ad5e52e5210905490f94c0e2

SHA512
f1266d285dc79a62bd20b1efeaf45779393c7fe2499b5b5a20966c13557c0829517ac0dc680bcf06bf02b4d2749e2b83a8d8b83cb13054cd5cba369da06280ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5896b2f5b5e308748a303bad93f113d4

SHA1
69750fc6653584528a236e1c1c7ef22aca499437

SHA256
dfbc1e7344b51c9a8dedd70db4f82244f007ac0cb901656b09c5b34735434863

SHA512
ea79f890dc7a2e3ba028f87307577a6e905051ddc38d671d233c96af045bf8434f9058dface8a2988f2bf3437cf6f9489dbb40b3c91edae4d727640a2feb7d14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac1d5dabd241c69b0322b4aaf3aab0ce

SHA1
9a8fea5cefacb2ae65ebbae8e2244c84e9d05a99

SHA256
d53e6625ea7a410d393ce9defdf557872e1f9c738799da3693988499f0b67a7c

SHA512
3486c8facbbdec39260cc3a1740387ca8ae6cb1292f7f265f316bb63244022fa3c48d5890879676c0a9a9cdf3753bf717d3643370061c2ed39283ea455f6fe67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dec4145fa4e91f50d33da23813ab4d6d

SHA1
9dbde7fbfcfe47fd74c453dd53273a262ae40378

SHA256
b77470caeaab8ba76c076b382ca0779db3e280478ba8b89f00cba21cfaee202a

SHA512
964f1a27029784fbc079632bd5c1f1cd52ded1ec35a3df94e7adbebbd084d604134f6486e6bfe51ab895ea47df4c47da14db581a751ac6f1538f84c51cf7e50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4edb8087602e523e25b14e23a5f9f97

SHA1
9d69fcaf70ffd5a7ab67a8537d50df0c39de863b

SHA256
945b9232d18db82fd45b9a160d19d36ac81d0a98d4eebf8246a230b6f8ef6937

SHA512
fe7094c1fa3916bf69901998c6ee4a5466c21e59bd99e2963526ab134a3b96977b5a406aaf2774a24492b553daf0b26e97a3019dadb9193c317952c792f49f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42EC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar444B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit