090becdb00e081697edd38a186b97b7f172683eaaa9b486b547d38db1537a771

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d5bbc3b3b745b9d0fc07d8923b603aa_JaffaCakes118.html
Size

23KB
MD5

2d5bbc3b3b745b9d0fc07d8923b603aa
SHA1

10b11d9ff5881d8ccbe33b45409846c3d52f1671
SHA256

090becdb00e081697edd38a186b97b7f172683eaaa9b486b547d38db1537a771
SHA512

40c4272e78c725d45f6d5394be01ee397f8bdb6776d25137f4c2cc106d1a501b25bf1a18f70d72800aea3dd704bf62993b0f5197ca423a5118d6a055b6b770fe
SSDEEP

192:uWvQb5nBOnQjxn5Q/wnQieLNnbnQOkEnt4enQTbn5nQJCnQtrwMBrqnYnQ7tnkYg:UQ/VV9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d3802693a2da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421477420"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000004e06f129122a378604ef710519ee115b6ebdb5ef58d99482d2dc65b393cd3f2000000000e8000000002000020000000322868ebf3a14f06cf1058cb75a1b1556033cb2e37e9b99606517826c55e327a20000000a516513936ea2130d4a2619f48e4a4c21c635cba589a0241b7601bec401af4f040000000a3ae69dc263a53deb648068020de7e70e644265d46b224081c4bc259da12bb57b150e3352806f0061368c910595b9cc48257df6d3da826ad010cfc498d317b89	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000815aee379e5893af85a89d799d271ddf9445eb9142c159c26f2dd0946eee673e000000000e80000000020000200000000f17853d436fe8454c742411565cf3e5a5eb4c4da4cad6c333523ede2e78b29d90000000ad475063029cf9c2a29fe5be2bf2b83ba82617d24481621b58dabfcd5b8c4abc8f8f595900a4b3bd6764933acf8d6324417f67bba0c491ab7d5f874eefa93967f6c6248e09df82f8d612dcdfe572f4a592a297a4a4f9f16d3401e40c972685b54ab10c89e0609865563e73aaaa61045be0358b1d133dc0dbd3c34210f950854159454365dcb38576ccf28a0807d4f5e640000000ca1ac4664ec4c93de3a95b6281b5e98db2ccaec8e5d4ad42247d0dd58afbc506f793e95f778cdb90a97d10dcfba51b326494b938f51c7240a6612d8212761d61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51D346F1-0E86-11EF-B826-EA483E0BCDAF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3044	2876	iexplore.exe	28
PID 2876 wrote to memory of 3044	2876	iexplore.exe	28
PID 2876 wrote to memory of 3044	2876	iexplore.exe	28
PID 2876 wrote to memory of 3044	2876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d5bbc3b3b745b9d0fc07d8923b603aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
980f77ac43f5acc94f4fb3321705f7a9

SHA1
a88f7b0bfddbebd90717b71116fdcf69d6ebbaac

SHA256
0032e71d1b18ee0d3bc2a81de3472da8ba4109ad573c79693001c08498ef2595

SHA512
143fc74c947344bc46f09c80f82e4bd08f7033bcbd1879897627f4359a7a7ca6803061dc0893b3ab6189b7816e6ca5726a70dd0e2a1255847a828fd3d3490f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db231cbd053937b6ac526fe6178998b3

SHA1
231bf319929fdaa96248513fe1ca9893c8518e14

SHA256
3e5c01d9021845f44019465e46ef3a5a5e2f6f1f97ad2603f1f9ad26a960a583

SHA512
ed41910ee6422004d6fb0208fb0aec07cad3b423664e74200d010044637dc8353473fb4315f3d923fa50b140e9843f41e285a4c4312e38a5587589b5064ff753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25635127905bfb700ba2fec4f6d60395

SHA1
820719ace06cc5519aa06809722af07adc41fb62

SHA256
2278478cee5d720dd75186cfb667f22a62e23d7c4ecd25dc92b967142f0c1329

SHA512
3ad394f1fdc358cb7793487f1fb5c1284b85ccfeda0d571d476b6aeb57fb257358be03f3d1ddf313a1e894b5bcce7b70e184e1dc35a271af54f5645b237ef63e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f971cee3fc49fe0d7e2254c805cbf155

SHA1
c1c7bc91e3bae17e30cc1818a0cf94f41bc69700

SHA256
0531d0c78f7db6d2aa39ad30fadcf3890cdeefb5246e75a12a9ee2ffd58aceaa

SHA512
7064c9cbe6d2958ec395c6e049c89d428c40022cf5e23ee92d76b16faaa36ef6086311dde361e88577cfa5b263067d54926a56346d1de777bfc8389954b7c2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
442d2bd706c84ebb05ba9ad4516dcbbc

SHA1
902a6aa5ca2095de124672d78fd70ef4bf3b6199

SHA256
c35dfadb3702308e488b1878538f8e35821d2db707db3d6ddb7da66aacd0a2d3

SHA512
b731f87728cbc6aa08c5ce5b85c90c224b16100aa5ffa1fd419af8ec030ed2996bc885005762f88b59fd04d4c8f0e3e292b1cc53b89ee77ab9148bad740a6f0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1245c70a0cbced0f40e5428b1412682b

SHA1
0a74553ed4e2a25f8407777bc38d5f487685f6d0

SHA256
67ac201043a20732c9bacde1933f4fde87d63535d6d98cb9dbe57981592ea4da

SHA512
138b2bb71ae0a70d4de582f065cfb609b35c6d7987573f699fc874c24964dc5ce75a752f7d631789e07f6105b9b671eb2253d7334179782ed7cc6d7969024afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ba3df66021f32e6d91ea15bc300ecfa

SHA1
73b7f208cb89e29fd87b665e653f234a94876697

SHA256
05a2d1ac95046da0ca315b9c99f11a26a6b1506786381707a06026461d045a1a

SHA512
e286066c85d5f94c37cd5b1d53b46f3fc19c576b3e6f8da36839b14f85f2fa44fce74b62ae225fac18979e2857995a1f35724da04331546a252e1027162830b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42cf22a09f2d12b631e7edd0b5d13ef5

SHA1
fa3c84dda2fc6f541bd1029ae18890e1aa15cd55

SHA256
e22000bf5d49fb94404b191b7249f0153beaa290116f9a5d97a1b668f9f813ae

SHA512
75e2cd6cf32fa63f21943835b9b29b6aa6106e0d03909394d80640cc2cd09c259b0ef51e776531707bd0df52d61bdb203beb701f7f89a1f568ab41d9e668d841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbecdd43de7d1a53441e0b6c729c8a4f

SHA1
a515498eb22c1191a5e64cd617167359c06217b2

SHA256
f5939bf565c341a57722a220c693a400ad5f1e71e4f9a688f4af648766def685

SHA512
efad3fbfe60b15dda514e0b0e41ee522ce7a76129e193995e800d12c36cfd1e52397ccc71e57597f3874e64e7c490b9edcab5f60e23d9911f0c1a515681608d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6443a0c25ae0636a0a19735e2356c98

SHA1
3ae2a138e7426cea4ab4062cac8e74b2d777984f

SHA256
950aed961c1eed7c6ee27fd22a444a5f0bda5223d05081b8abbe5beb523102ba

SHA512
8b1fdeb6b95d9f46065c25da0092326d02bf6dec9df1be79f8f93a063506faa92daefc14872f5b29721c40b6de8dd951c5198312d6086bfb583706bab12af26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
401e07558036c67d046015425e0db61c

SHA1
fcab7072cc9d68234ba8d8e6993b0a236745548f

SHA256
73eda99ce1147bd8f87a44a1aedbd158fb56209de50f357d27762e28c05bf599

SHA512
3ee95ee02ea71b0c288cd58629f4a011299b71cd34643123f7ed8871ba93fd626b86f35e442c01c9fed95e260f619f38caf7c95a399282d4c738e0393887792d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ddce543d4be7a855610126b5e2a74fd

SHA1
d03b54bff075d7a970792113e7e83f8eee8d3bc9

SHA256
7fbe32e6fd58ab35738585bff4b00f8d1fc9f1771f52a44671bbb08c9fe75a53

SHA512
8dccce14a9a7316f0dd948b1588ebbbaf53da62ef692ccea9df2d65de60fd177cca7b5f97c97746b273184d4d2e8d18308be1e6af428303f7967064daf50113f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3817259dd25bc28b9f7da596ea233b1

SHA1
734936edf06355293622f597c6be6505df7bf40b

SHA256
6f7f842cceba7bf8abd1e6856aca5d01a37fc2878cd925456314b0e5754e93a5

SHA512
b91419682fdda0fbc15c62619bbcbc48e4168e52f8dd79a0d2d782e46a8f53b155d4557ad3be89594ebcc909ffb699474d79096a7314a9253c58773cdaa3dbe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5542954b3401b278ab04e3274bdb20c

SHA1
a3e89894d8ab0a71a9cb32ceef67e73c0cd954e9

SHA256
ce281828ba55833307218195258ba75e123625a75c54976842addd2fd24a820c

SHA512
64545eb729a85e5de4a4202bb4d1c5aab79666f2d3b02de36e6172b6bc317cdf9ea86c7f9a26177013754f63f42a84c315e24d6b92f81cf0da373a297d4a38b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
619b668b9e89e5d170da67140ce4dde3

SHA1
010b90a03843743611b7da75ffc1979e0d589162

SHA256
50f5c3d72d61f9810a5d868cab84812410711e54a17c4f5a29f8427eeaf0eff0

SHA512
7b44e8969505d7df7eaffe041decbacb38bdfe5c7703185eb6733e0f5602de12abfbd491c8195ff78d7db5918f91ecb159eeeab125925d06f90a6909317c4fb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3739.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3878.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit