6ee1615bd717e7f09362a72fa358586978f6dcf603a34bd8262be736578fb9c6

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d1c69ae1e3c2b1de0fa61223aa1a5ed_JaffaCakes118.html
Size

23KB
MD5

2d1c69ae1e3c2b1de0fa61223aa1a5ed
SHA1

504595720de16d13fc98ff3ebcbbd67056bc158d
SHA256

6ee1615bd717e7f09362a72fa358586978f6dcf603a34bd8262be736578fb9c6
SHA512

729e5d39974da9b47aab95eb91d857365452279eb3d4582f4f6657bb6e0f4eb716248a0bb31e702b4bd2025964b211f9f54b67bcaf652e85f7211f520dcabdf0
SSDEEP

192:uWNEuDn8b5nHinQjxn5Q/unQieC6NnaDnQOkEntgjInQTbnVnQfCnQteUwMBi6qn:dEuD+Q/oHUBiiGoRbH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3018af2c8aa2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000dca93790be883dd6a35d06264f2d782bac955ca88a525b5058e8f963f7821b83000000000e8000000002000020000000769308847b403bda0ff8d0d48587b416970f951bbb61e76cdb8a2656570954b99000000032e41cdfa4e1401db376542a02dee50bda14ea216d45f3d4ab2f0e147565e2940d8f0d2fe5c9a70a075770fec4470c1bf212ebf52f13ef0a870b4ef08b3aec0096167f2ab52ca80200a32eca9656fbc879b896bdc63d33df7d5fa5a4037076f4e7cc8da42e92b95f02435c04fe61bd30d66b34a5d18b4473af21bb069e6acb9134670509c6608edf53861e832e4ddf6f4000000079f0143457d3d23f0321af69d697103b64a36a813894931559743dc1f13c1dae4649ce16414cc75c4f59e80a59e8412720839deb99f17fb67084b7fb616bcb0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5811F741-0E7D-11EF-BBEC-C662D38FA52F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a0f00ad1299d2710464713b0c6d020271d7054184ca8b7cc55fbc3286a0a211e000000000e80000000020000200000003bf22ee1f55468d7488dbc95c98736975c1ece66f347f00d8d0cdf02ef8afb202000000058d521efd3c29495ccf8d861938a170dddf4f3e017c111903c1b5c42525011c24000000072d7df9bcdbdf62af58728d66ff1fdbf612526c21b3403b1954364c2545dffeb1872686d6c1ae481a65b8460c04b910c3d68bdcf6997b9b8da0986b6045a5323	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421473565"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2148	1936	iexplore.exe	28
PID 1936 wrote to memory of 2148	1936	iexplore.exe	28
PID 1936 wrote to memory of 2148	1936	iexplore.exe	28
PID 1936 wrote to memory of 2148	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d1c69ae1e3c2b1de0fa61223aa1a5ed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db987d7e266fc9ac70b4d35476da604e

SHA1
4fda4d06ec867d5df41d10857df18b1b7a8868a7

SHA256
a09e08e9ec6b2cb4d98a296d2fe2ca36ddb82fdb863bf911883f7cddf75df5f5

SHA512
cc19bcf13d2390caa760ab4fc7c50e16249d318185c2dc4b895efdbd768afc9f890da52d27d9c414a2d318c54b30b8727e7c5bf802473e7f8e6ada360164893d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d251c5c1be1dda83fbdb0185825fa338

SHA1
14ba217fd32ac270c8fbc23fddbac73a1db474cb

SHA256
93f8d551fb9dfad9ea2ec684f9b5615788d61929caf329a573ac06b01527059c

SHA512
6e29e00f4ea7ca58c7d0f19bb9bf3299468273fd83891e4965053ed35cf38a175267ec290327bc30d7a3f6c980e0ed2ed86cc3a86bd5d0949a781e877ef931d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
190691424523eaf28eb03caacb2920e7

SHA1
38d135adc0ebdf357136fa97ad2a5cf59a2b2ba9

SHA256
147bc6f1616e1dc2bb0ef739c95ad8084e60792fbf3f6b9fef9ace2e8b440b6f

SHA512
c7834bd57b51df84583d7faf9bda7c37d7d349620f545cba8a483f01ddda301252e053187f13bcc3e166f59112167d153676cd185f514eee198499016ef9d44e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e4dbbd3e32555dd4f867332f88e6f3f

SHA1
4ce7ecb1e47c791a757cd8d9506b15f9617188c0

SHA256
7ae20d7b5c48a8cc80c23e857c3a270c9f8f88756e4dd7e81d72b9eddbe82bb5

SHA512
a96a0ca437d1377b7c4c591f25522244cb0ad88784045175e376bab82767d24e23e47bad2dfef9c51f53e314e610e25a0f28b39260484f730ed6a6fdaa642f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0566ab3ae773599bd67cdff3e06d0825

SHA1
fed9bb5c854ae59d781b121fa61653a0a9150493

SHA256
27bbbe30c3c812ad39e501d0d5da11c33ae4c22b1412f61027b3c725975bd0b8

SHA512
4962e9ffbdb906e7272e072a2ccec3ea32b5e1270829220bd6dfbe8759c21b3eb9c396a80bdc0e904f2f5b5396d36afa33547f497d9ad2389433e84a69a6378f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28d3d99f4086057e9ee02b23bff4cfe6

SHA1
1fd4b34f638fe3e56bf05158514de804a8611929

SHA256
01e8c340124435cfc1177a949983bcf1222d12847f31c07eef976826c3670470

SHA512
da0d68e6bb39f80956a28b329f63d05347d4f5b4f157d41838455cfae9a45576fb5855cd02d297dbe344dac94e2908c09861536eabc3500133c40dd778b41bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf7304012f388bc3e02a5940f450cd27

SHA1
e0d8d02bac76195f1e5223eb35373bb87f86b591

SHA256
bad1f3a4ccb5d7eb47b1d80d759a92e402f88e7648c93885b83e6540dd7e441a

SHA512
04c0ecf996e0499782bc71986fdd9d63574b2c2db38b02e6168f3f35f0fdd048564e5afec40cd79104e3c02b00cee13bc20f20564e5b7d101115d2e5000d780b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d606c2ca1124038b83ca1503e5f2a76d

SHA1
6db98fd1827b1f88f083d5aeec05e3b05f6a3808

SHA256
b20d06f32d61de0f26c29c275a8ddd0f5d2063bbfb5cda1a905f03cf25a7e755

SHA512
bf92d9a0de43a48456d805978ad271390e989c2308d647fe2e116e11eedc37510d923f787992367113ddd774f9cf9190d6007018b0846814d51b3bf4f81a83ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cd9b4d101c4079d22339ad52472ced0

SHA1
01ef797939bc9adcd961a59c359010af4c1565ae

SHA256
c4c6592a03f2711392616ad0c38df81971984cfc76d72bb6990f27e5ffad70c1

SHA512
bdc4700c9624dde31d6cd1f168ec6561479290d6168d5ac5c866ca8a6457f69e9b5ea6cc6ae98fc7a962ff48a885e6b2824ef005d62e2fba30cf5adae0ed1ab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcc62deaa247fa05b29d1a3e71830dd1

SHA1
c67fe9f4f169dda53e4ad4dccc39dac828ad0c7b

SHA256
9453ca9e40eec9eab83f4178a47ecf5fce2e2ce0ded8f318db36d7ddbbaeea7c

SHA512
cecc427156038e878a921b427a9ffec386ffe5fe5144f0524d1f2a446602f1c941a769f567bfddcf5157a5356e3cb0bea0651102c0b9f08799c4a3413970665b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ed553c04ce40b7a5f440f342279dfa4

SHA1
d4cfb4f2356992d0125147752ec1a5e351a49e21

SHA256
54f4dda648fdbb14c802cf3c028d0e7f7707c0598b550010c1c3d76533178d8a

SHA512
62a9bb2ebc9ca6e0e1cb0d7b23264ecc055f9e934d3f50c4893583980fff2b44f622c069ed04be744f4dbf7d0df55c439652902880721b5ce2b472e57a52d226

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F8B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FEC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit