d905209146bcad7eb76aa351296a2eadda8af8fe1615e8d73addda8da54a0a79

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d2c8090224e4b120b89fd397a9c52ac_JaffaCakes118.html
Size

461KB
MD5

2d2c8090224e4b120b89fd397a9c52ac
SHA1

e4b430c0854e96c497261489b232a238b996dff9
SHA256

d905209146bcad7eb76aa351296a2eadda8af8fe1615e8d73addda8da54a0a79
SHA512

f2168f90c300f7d6495ad931318632d1ec9acaf9d7f3c46599f049a7720e34c8415465709949ba5bce6df86280d8eae5bfc98eeed4a5fd65950b492076336114
SSDEEP

6144:SasMYod+X3oI+YvsMYod+X3oI+YUsMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3Z5d+X3E5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000007733acf8cc9b53c5fb0499c3b046657995b27e37f3b49e091a4bae98ec8b08d1000000000e80000000020000200000007557bd6adb0c541778ef5de1e8dafdf0c75549c176c77c100d2bc6e8af436d9120000000c9061f1c0cd616c4291e1b8a34c536705365e0a4d89846f310f9ae2161925ee7400000008900a134b2c87175eb9026d83dd65765967b83dc951fe4c0164d55b4adfb0a147e6ddf4a85a9c16284dd4f3240a39fabfc931d15eb391dcc901a7f83fb4d2f04	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D96CEAA1-0E7F-11EF-A1AD-46837A41B3D6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000115ff22bf8e87b702b7e6f0e37a012003186f81b5faa4b6e99a85076d0cae331000000000e8000000002000020000000b68cf8a5389ddcce68206257de5bae8b0526554dc7cf27bef75fc5fdf0a27d069000000033a4b5e8ed0d0cf667504ef1a738aa24f5ced326cfa252a0016f5357ad528ec628303c1ec2d8f3a0b555ab4ad48c0e9f6bdf4ee07184b721479b07e137cd4c4da0b182fcadb00ccadd1685533593465efd72b9bcebf6eb038da0bf9cc4f936a83c32e68a536338a501f4d312b954f42c26eb75f2d35373d511e3636ce57528d6635d016bca5d44cd95dc1746640f6e40400000009f3545615fcf5745876c7ae5a53bbea86a781feae705c2c0b4c67135cb51a716c60a2a51793722379591967ad8e9560d7586be09b19bcdbad8e814389cf8609a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fbf5b18ca2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421474646"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2060	iexplore.exe
2060	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2316	2060	iexplore.exe	28
PID 2060 wrote to memory of 2316	2060	iexplore.exe	28
PID 2060 wrote to memory of 2316	2060	iexplore.exe	28
PID 2060 wrote to memory of 2316	2060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d2c8090224e4b120b89fd397a9c52ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f02ac259be7ca30942ed92337fb15d33

SHA1
c597321cbed9cb2e231746aa8ce7e5021502c5f6

SHA256
4c559eff30f036d58692d44e3c2edaaf802191576966dfaec5993c475a724bd6

SHA512
30f65de82619bc88d06303fccb667b6450a615289fb88ea4368afb64b0a03d51c8dbe519afc1e2d538dfd1ef6320be07d7e70d1529f17c9ef6533060eb90c046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a186d47de269447d3b7262181c153418

SHA1
5b24d99ab12f9dc416c7f0bd25c854085f72596b

SHA256
6dba8cdf36ddc6ca71c61c817de51a694df57f364f35da674238815dcaa3fdf8

SHA512
caee82fa09b4355cc8b7088d0d3ed65ed48d54c45978eea2c34b5d4484d4abb197632cbd8de3c747b4f9d2f72f156b73c28362f329c5482e84bdf8efd0022e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95b595255e1344c9788775d3f7c2839d

SHA1
40891b7579e29ce2098b8956d0692c73f462287b

SHA256
8c90daafc3c18d68222999ee69b5bc2f41c2345bbe772d29e69461ab73690913

SHA512
1970d30d3aa0a2dbd28180319595f364cffdd6c37b522173e6a64ed589cfd097a799630e16bcdbe488d94c24644d5a26b6ccf979d8cf6e62e37657b45455c581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56756dcb11f78e15fc0cd6b0e252d270

SHA1
37bc5777258d38f07bf30d959448a4258bf97de6

SHA256
1c1fd6733ba6fe5cf2579af91dbacd1eb8dea50f4e2e5a20446af0abd0ffd100

SHA512
ff3f4f45b769f6d59e6711cbac915c79bc89b3be2ae3758efc14d597299eddaa6525b1acf2b01c8c7b0ba0baf2c85cb03d9571d161b197112afc923f625de13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6ca0c91dffe7e6bb0a79f73998a11fd

SHA1
38cde60ac8e4e4b4b66f80cdedf291adaee6134d

SHA256
99f8da0ae33b2405fc50f8d1a278f0a15d162f3f6aadbe7473b8b2dbdf6254ed

SHA512
ecd46a71e475d3b0645ee4e0298d0cc576e8a89d009ad50dc118b4ce3fe04ff4e9c47ad193ad37e3a4c2cde079657c0cc68eb8adfff33a87087fd031e3c82a70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a35b4fb40559e9d0916967b37042a5f

SHA1
a31274f75818322536c6e80a5bd4fb3173d005df

SHA256
c7a8f132b355d761cbf949cfc478f2307c445964af483bc2aebec2ed8848bc52

SHA512
1b750de6a46d695479f1946528d92f089697dffde306c1f37d80533f2554c427cfccb9cb2f2ed21530976ee4464b2723780f788babb53af4293c9b141e54c6ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1006e326802314f30005a20ac2e48be8

SHA1
41560de84904d66f9adabe34c3861f166a986b39

SHA256
b38328c24b62543eb03237744fd82404f6f006e8ca65a6260c1a3dc33858125f

SHA512
186dbadb8d4b80238cbf243e4b50059763421e8b0902e7148183757980781a7e9cc990df9ccaff6a0b862f27fbdac880836b8a322b91f496f2d9f38466146d4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b759a4defa13e24079e8a1734129db0b

SHA1
939cbcbb8e89c0bf6b41b6b13be6df2ace90bf98

SHA256
6547fe4dacca9b440e084ca306de5e7de0ec481782628b4c5bcbb6e3b6820124

SHA512
8c2b6ef7b64a386aaf06f537c0dfd48ef28494fc1495fd8358cf4e427f877b9ff270abca73d396de264bc9b682522ed140ceb001896ae3d14820f24639a59566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35beacc6422da9fa25b8b91e9dbfb4b3

SHA1
61b1a15499a7035d1e635f868a2d427ba553d786

SHA256
e0fe81ce112f9c6d2457d3312d5f1d4feeb9dab6bdc403f53bcb4df37ea19616

SHA512
8ce92dbba1d4e446dfa08ce17397d1426ae138901ad36e63f6cb4c6beeecb2df46ba7cda6c55c25bcac40a7761edaf6219d26aaf7349cb7a4a13d46ee5d62214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cf4d2351b8145e850e1405b9a3ceeb3

SHA1
8da1a11e9d06b9e556e26be68239267855541680

SHA256
bfebf2a4d41a316da939f26c7c9d22611d775f75835a918c91eedbf68012b51f

SHA512
d1dadfe2091c39b8b379bcc5f9cef42d1c163cfc152ebf52a170b9d48a77e3263e4edbac7aadc74807d4ae22cdff9e2a3f56f0f32068c3bd908faaa495d57b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
428a9ba3b205130a72a6dddd732c65f7

SHA1
c3336bd31e4b237a9d08cb0b93c98c0c7f69f25b

SHA256
d1e6e412b96d6ac6250593d2e0ecd88fea2bcc0618f21cefe1c201e64fe6dea3

SHA512
9fea5bce894c3d55de8287d3f38a7a96058e5432b70930ea6711eea655490e3b66987dbbb29c5e64a6eeecee90b222882f58ac12a5af12ae2e617a1dbfcc9084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77e0cc73e45d2e827bd3a5d8769b66fc

SHA1
de4cd7d284b6ef3c752a089237ade3632568391b

SHA256
03f18cf8baf17cae9bda2184700128051b4f312883b977eaf579d297fa1992d1

SHA512
993cd125a4c33eb7585932d08b122428556e8173e50f89b8455974206eb7c3efb7795f70348f489f046dede4953e94dfdc812520992e18435b2b1912bbb8a00f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05941d196cd536f5b667f623f69a3c15

SHA1
43cbcfbacb062f027bf49c0e4e172fcfa658488d

SHA256
a47ef178545be3b8b0bf1fe6046506081ebf7f619a699d973945339ab72aff72

SHA512
441009265249e16ea5b36cf1a8c46ce871fe6dd09b47057b76e1b908a8d7c51e1686bb3761fccb4152dc51ca013a64a6da73657c42f0e7db4ef342b4e871d65c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f83b73a0393b6adb21090bfabdb4bac2

SHA1
dfc757daee8e71bbc59113cb49d59b4f37e9f1ca

SHA256
ff062d0464336a4c24255cf1a2574e4c4a74bd67ac86174eac9739a1d165fa28

SHA512
cc8371f2927d17d67b66f806f79703b8c86c9b3f728521d5c88cdf7ef887fe2db1bd0cb5e6da0eb787ff0bb35e8ce48dc773bbe4f942ec8f10f60d767389501e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c671567e9502c98613b5ddd29f274ee

SHA1
694dc84f4822a26b29f36799cb6318c58c386dbb

SHA256
eafa86ad56c8ad76e468e39acb02187b400da1857304aa2e6c88e7b93e74c499

SHA512
0b102a89af2bb6fc5812ad5e3ac1f3a15184b6a6eddecdc7aee8e52ded8a4489d43c3225ea2190d49e0e687051e18ef83f749c7e43ce47052d55f98508df1b3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C18.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CEB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit