a30b48600b835291c9b4361d4309268a72f2efaa5f6abd8d2f89b7cbaa2d5024

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2da6f35e741809bc13bfff802671c5a0_JaffaCakes118.html
Size

213KB
MD5

2da6f35e741809bc13bfff802671c5a0
SHA1

f22c480d252ad501353776434fd9415c9a0f3130
SHA256

a30b48600b835291c9b4361d4309268a72f2efaa5f6abd8d2f89b7cbaa2d5024
SHA512

8e88d048f69554fbe4182f064a1e94f5d91b2238db6a4cb2eb638d9a4a88eff7c1dc4f4f6dbe412f5710beaab88623cbd32830b7393431bea0c5906ce7e9c8d5
SSDEEP

3072:St8x6yyaLXNyfkMY+BES09JXAnyrZalI+YQ:St+HYsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421482067"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{231B57C1-0E91-11EF-A4A3-CE86F81DDAFE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1844	iexplore.exe
1844	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2688	1844	iexplore.exe	28
PID 1844 wrote to memory of 2688	1844	iexplore.exe	28
PID 1844 wrote to memory of 2688	1844	iexplore.exe	28
PID 1844 wrote to memory of 2688	1844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2da6f35e741809bc13bfff802671c5a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
597f6a10be10255e24589ebfc4a12381

SHA1
14ef4db0969201bb2f6ddfcd57ad3960d7c3feda

SHA256
f0f43796f0d001ba35055f215f9162a0eb818aa0946d7f1efaa2b5618dd63106

SHA512
50b1174b547f0f12b2f2c035c6727841f41832fcbc93deb73b6aa2e1a8b6febf500a91d8895733c6903771a1e0c92475a7db32726b41ab6dccb638345fe8bd9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5659b749d4370bbb7149b264412790b3

SHA1
bd6572550e41f69f2afb5e069678d24a45bbfe6a

SHA256
1cd3bcbf1566027f0b1a8ddc0a44a93170ee6df1eb31e83a20d6ca981f11816f

SHA512
5ae4f123d54e14c8a88fdf3557997de7aea9d5e3f9a54d94ad5d1c4a4458450de2c39aba644b3d559254d1ec9a707238c57adf5193112a2be16e4bc89f0308a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2249ec31786a312521a6ecddc61f5901

SHA1
8355c554ae99d48553893c8db3474a5caa102af0

SHA256
5645a82000c6c129c2135b10c553677ecdc0815369770d7d3d87498d23f1e16d

SHA512
5869fe48cad88c1f652945fc70172664b5df8dfd6629a3c20c84b1be97e0e209b081f5ba88bd088eae82094fe16824dbb625756e7382293f9074dd46aef8ce58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4433da4a9683c958ae242ffbf8d2aff1

SHA1
01f734333851be9f96b51a95ad413bf6e3a02166

SHA256
65a18ad0aa579e698c6a627bd1f41ab428c3df5c31f770218ff4aebaaca30166

SHA512
b9c818ea9e029e5305afe2d811a8d5acb062994d2bff29205cfdd3018f49d596c3c8d2cf414d7ac81f8295317194216c61200f2a5500ff244e9934ae3c01b611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90f88a1b36164453b1b6b6f7f8084461

SHA1
42d77280c394a311661b86750cb79575126517c2

SHA256
e831beac28f06ba92e08570cdf93346a22fe98ac0c7435b8ab0887d735d1d6d4

SHA512
873e93f4443040f4f726126eb0eb35ed36ff0d695d3b646e299bf8180f23a3ee2f916a25d29b2d65eb90d010883866ab3c91bcc65613752424af84fdea3f73a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94deee0e5650fa62768f010278668072

SHA1
eb8dedbfecdb6f9e2724c7c71595e7b357b08809

SHA256
7e1273597cc0cd54f7ee8d72e074da04710b4cb1d7ff8973ab0fe44e8bbbdc7e

SHA512
f5311818e84cb471591a886789ef8deb7a60880f1bd4385b5dc543bc145a795ca203175e0d1cbea3d3c718303a0bf71ca6d31a56aae043cf375b45885dc96ec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b02e5196cca7f923b52d45cb1fb73c44

SHA1
9e063bb374dbb024c167c632e00bd3351cbdcc93

SHA256
2cfb8024317c53e56f60dd39d4b86c0c3e4e4db244864e3849e1dc3338d27408

SHA512
b4e63449243ab54ccd399be117252cfea3aa9c451eceff5868d64c0a8ad04d94b24e91c247caebc31d4b989be370e21c1186c468f67a4fd5aa5474418c18205c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6c79ee2f8da92db2a9d7cf2a5c8571d

SHA1
1ce29e2cd0c7580dcbdef8429d1cbe19200972a7

SHA256
87b906818f9c0c5335f830b6b3fe2fe81e16a5be5e065c7dbbe0c48eb01923c6

SHA512
2b4285fd9d64f60b064b3e01d3507f0db1d784dcd757c44f3b0f32188742345fa45636a4b00265203fea8448512bfe0d3aa72a25a5910b001622f1256b5a6fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6655be5680ec7e9a0fc67f76ebe9f16b

SHA1
c46e58fdc720dbb0936e6263882f98659f02c393

SHA256
5f42b474c6ae8c6752f60bb7f999cc6dc63e8d1bdd0dce770e1bec4eb7662a75

SHA512
cfd40e58790c71b90c3b4fd2cf451b554a9c437521d681088682ad043baba9cabe42cba6e5932d4248e0ce310b582cbac049f5e5fc692a1862146fff63ddc0ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
147f7c37889b8401c1662a457772abd8

SHA1
31cd009d5a9ea19a957b088c9840738348824f2d

SHA256
1eb644632e565c2937cd893f011cb6dfbbb88547e4004f258cc172e3b0db5d9e

SHA512
9e438472877e296ab918582d924649a0347c576ec068e4c0ff5192d7413230ea82843a937dd30b410f3c55b307b51ac492e958e808b1d23f335d6bbed0c2d264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dd0bc181059a0bff92c8840e0bae677

SHA1
a83ebfacb45282fc8c3bdf8c8af34cdef76244c9

SHA256
11085ca9805cbaa809f176832a6cb6c35b247fe338fc700a69f04ba152cd45e8

SHA512
736e2fac4e702e7c6fa872961ce7d34625fb93d513bb37fa969f361c454e4960ababfd3c195659342411e16817f634e720440a24a68bae4a945b19b89d207885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66136614bfbf0d3a7dc7b660c3973cb0

SHA1
501ac9f49e0545c0ea7eab7463b3bd088f4349d9

SHA256
7de376ac823712ee006819d061e751367cd51c2c89fda3c7f5f4f269f05b71fa

SHA512
8f016c769640f2eb51bf3ca03558236afbd0eeaab1820c62d75ef65550865611c33c647db9f9d9441708dc7ed34d0bf4bba42f5f1b695c310ed2aa63d1f560b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b5aa190599be29097b931d20c0a3374

SHA1
aa8de126d1dff5f7b8c907543730186a2ddf3813

SHA256
fd19c6b3a031cb395f095593013f03af1d943d1d5c17411c484019df7cd8a330

SHA512
b076c9de2561013ccecbf363ee6fa2ba040ecb5100b430c52562b430475025a730c20bd66006d647fce6914557418007e452aa6859f3ed9a01a63ae8a2e10af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bea599b553116f26631c923abcc7c1f6

SHA1
fb00e1c3bb8aa388c60dcdc765e27b0e1f33b3c0

SHA256
7ef300f3ec3cd8999453fd9f19a40eac997be5e624a3929449ffa7c33ac8b62b

SHA512
d449060c35535d936f3fbb47d012cebd262c059dfdefcf45224641af7033990074e7995bcc934e4cfc90bdba4b80575292f103293e57e2148c1d1eded2ece8fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be76ea9b7e52a2fb0181e5cef949fe28

SHA1
cd5e1709c0da868c190394e6d158d7dd79a7600f

SHA256
dec23b33532676c74de211d43d634644f31bb2828d119bf98b5cea96e5334b2c

SHA512
b01376d18a4f52600e10f5745a39cb71e7c75ee2f98b20e4a34d5572e6be0230733e9a58e8db5eed12b245b4ed3f518a0c88e3f58d6dfc7af1d146bd4df9e543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f2b173c9eae7c7598edf687621fdfce

SHA1
df0b97dd3943bb76516cc0ab95f50c58c829dff2

SHA256
025b660dc8c10d7123364da575b10c3cbb555f18b327efa317542588c6270b47

SHA512
d2765af6c6bc125c163bb2de106693553f7d75e4ecbcf08e7fd2d95e6c23c71102666660ae48ff2dce82112dd948ca76b3cdb06a96cee0a6878338dc2320f5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54e9c15da4af047df1b0a4194b25676f

SHA1
2a89c3142385367cf86d01b4e8aa6fe0ae247e2b

SHA256
437aa875fb9ce588bc49efc78c8110683103a161d708d05001495e7853e07719

SHA512
40ad8ead8dabfe977d98ddadcc8b79f56ea6063c1c7913d76abffe2c3b6709c978893b07942d63c0a77040a587863d07364a4b0e16dfb7ae8d9dde327f7e1aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5953e081f2273e791f7ceb3afb932237

SHA1
898eafc845529b666681771cbe2f1fd6356ce2db

SHA256
8d156784226b25cf9d321cba58d8161ecc00d17b66a43fff005b216b5392dde9

SHA512
56370644c8f6214df83bc8b0ae06d3ca1e4ffa59c8b7297f68950d6968e73ec87431755815c16ad28b8f951d1bf8926809bae51be39c5d15128d5295512fdc1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BEC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CBD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit