0f4b88189642734c9f9e9f86fb1aa7b85a26a577e3dcfc03c423768f1a279b64

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dff1e74d6d03067a118af9fb2b268b3_JaffaCakes118.html
Size

139KB
MD5

2dff1e74d6d03067a118af9fb2b268b3
SHA1

471b92a4ca212c77cb13a4b43d5435a4c10af110
SHA256

0f4b88189642734c9f9e9f86fb1aa7b85a26a577e3dcfc03c423768f1a279b64
SHA512

8592f0a429984c3c6d3da4d2dcac96d70ae855ecea790b775d4f093ce51e4090bbcb814217e33f556f8b5e54dd2c0bcf5dd000039b3949a082f4ffa54a740fb6
SSDEEP

1536:SZNzjcDglSsUyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SZx0LsUyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c9d3644d827555433561f6a1cd1c475ec3ff829724f393bd0d27404b61495519000000000e8000000002000020000000bc44dfd1a9f12a5298351d1ca579d7f069753f7492abee2a65eae302c70aab122000000052d7bfbe7a6e1a182e0905782339433a085af75b7aeca4767304ffb89b43b38740000000e24c106b06c5e7a0cef483af0bf5e0179ab11535cba1304e5f2bf1573a3408868879dde7226e144c6eddd03f59d1a6cc5539c5607416205a2f3e49fb46a81e4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d78b25aba2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000df00a3928353cf1ba690e7f1ac9faefd0b4455715a5adf0de546e878bdd8bf7000000000e8000000002000020000000e8da860787a608319fe5c71117179061bb090ffe390cebe82f18415e101ac76090000000d09bd275ea4f690cb7c5bd13d7b152982ead9e784ed23cccff985ca8a393e31194661ab810f0242c9d5e1dc55fd508e79fad90a699332c47be1c6f94e9e9ac7bb71fdda8691505a3799e953a64d67cb21a03446fd902df227508a8e094a6d31e27515542287c72c5e8507beba75248ca2b315a1dee51100ca0e6525cc3116a8380a5f8c7ddc65711198ba04670741b90400000001a86044fdc9e7a0b073eb0c4e8af56b81221ce9be7c4be390d1d6c43ea808e22b78974138d0e0271f5bde8e9496f18b5f338d848b7f581ed67bcb0d76bb61d91	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F1F6C91-0E9E-11EF-8A04-E6AC171B5DA5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421487617"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2112	2364	iexplore.exe	28
PID 2364 wrote to memory of 2112	2364	iexplore.exe	28
PID 2364 wrote to memory of 2112	2364	iexplore.exe	28
PID 2364 wrote to memory of 2112	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2dff1e74d6d03067a118af9fb2b268b3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07b25266fb977b7007580e6e4a7cacd3

SHA1
71e3ba58732383512b4ff3d558853e03b809eb56

SHA256
a8e3533202411a2920c46ad9a759dd1238a2c16a37c7f048667f6026dfdde26f

SHA512
375bae300dd6c47f32ec0396dd97b850cde2f41f9e2357a03afc79af660096accb826af6b01f6d5be39bf25650e0bbb06bf4b0e2d8a3cc9bc7072ba88f7371b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a61ab403df8b08c0d1b65fd2902fdc

SHA1
e353a764afc15dc5a55e53f07439dce8bdb98569

SHA256
870aa9d5339e4b9ed5494242a71aa85f25600c041f0e9ecec8c4ad9c18cd4de5

SHA512
222aa7af5454c19fc3d8ee3270b2194bdb2395977130e7de32324c108e89bf769e6a2bee41cd269969aa41b72fb1681374b190ad854d225f9799b29def0f5a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
441f7bddf49528fa6b9533b96e827e2a

SHA1
2984ac2b575984ac96729eaed493bcca748da6d8

SHA256
7c52ba0419743313d4d900f075d20ec9dcedef8abcd412e39be7956d34f1f7fe

SHA512
972566e757fef1d1eeefc1520a2ad2b88db40f7242cf9f04a8e6312d2d0a50c4f57ddf7721da879cb5c53389d347ddb84dc68a298ec34a7bf2f590bceb0381d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0807433bf414e4afad6cac178673d716

SHA1
3532550027ae170e7659d53595823caee041ae31

SHA256
9fa6e3448a56e1b6429f52b364fbad43f4295e5fd3d9fb4f6b22d87e810b76db

SHA512
103610ac04eb0fc15d72d6da8b5e946e73ef4e556c9570f9b082e30c5bf360c5e76be17dd60b88ff2dd566872db5e5dbe9ed94f1cae2d02c2de4b2530174ab11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2902bb78f53c85ea267f1d6cde7b3eee

SHA1
fd68925ac66a68249b5f6ac8628b95991a2759c5

SHA256
96b0a5d1d914bd4d6aeec67a822ed4892226a78e7d1b3f2cef2fb032ed079aa1

SHA512
96ac9a5204eede3ffc199ea4e918b776538af9983be10326235bbfa078127c2cf10c2a24fd3efab0311510e4c65f8559c6f7ba6bceb9a2000560a3c0f8a97bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
129cd9aaa4fcfc273c9ff8b7857713d5

SHA1
d403827fa7dbd8d1fee82d90e24155945edaf679

SHA256
0cf23019a1b08cb2e66e2b7ee319ec069e2a58f66a951bf2e5b6172047d9156f

SHA512
079c6815c89333f986a063c50669efa951c64e4b1a27c44d2baf60e6e9ce7ad1721b518ead449c95837e8b11c2014faf3abba82dd7d3a45ba7c328f7959e9204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e836627821b0e95c1f55ebf6128a6b87

SHA1
81e94e997ca6a1a2cf8870938aa8d53d3ce99c8e

SHA256
17c973922bab56ef3f71b2b713193ec3963adb5a3c41e8b9999c6df3bcbf8665

SHA512
c1cb129799992c1360ca180de0bc6d3f1686772fbc3de609672c6ea9114e3913f50851c36485982e0083fa6892eba07d9b3feb336e897ee4a3fd8850c865643f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71445db6b8fd75bde2f28928a1b441c1

SHA1
2d41847d2e7cb309138b689a5c4f119b0dcfde1c

SHA256
b204a5a4e6b567a08f3b86f0eed444c5160ef91377a509e1ec23f87f297c5b35

SHA512
ab97bb6bd8853288699a604634780cbce1d3852c8671a91859450e5ae89f548e8d19ce96b4e5f130c197c87ea432f2302aba6ca163f9a53f83d5d3e00f30c321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b54c2809b6d77fe6af597be540382722

SHA1
498e99c3b63486ddb4264726f3b48acb6b153648

SHA256
98c7cf75dd5e743f821394c3ee9c129a243fd12afea479812c5c541237e3c6c2

SHA512
965f7d226fd64ffee501f2619dc7c6e6d41d49a9a5171c9182cc4672af63afc5667b619db1e55b349f3af00be34722792dad6ac3656688f0fa6796e93a44d3b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
622234b32bca34bb4196b5a9f27ff0e5

SHA1
d1b9def9c8555fab208d50a3d01cbadf98b8a468

SHA256
e7e46ed42dbdad6469fbd1318f719b4ce80c29278e2364a1c95e05f5a4393e67

SHA512
4d1b642ee762f07bb6693c0858859d28af0e070dbe6ee459bbba7e590a634ad83df7a1d693c2f4b4be17c60e5fce5bb5c59fec0684523718699cc949811e3f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA5F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCF5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit