daeaa814298e43df04a1247b627b440340f3731012c3b2cc9aec5c6e4d3aa98a

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e27ed702847a60772b535f767056fbe_JaffaCakes118.html
Size

25KB
MD5

2e27ed702847a60772b535f767056fbe
SHA1

a30a7a22d3f197a3de8c21c701a6f0f45b224743
SHA256

daeaa814298e43df04a1247b627b440340f3731012c3b2cc9aec5c6e4d3aa98a
SHA512

5920d6374beb2b434a630a114e94b0be5e0b459e47b27c4cfd47233e0ceacbfac75e4a7fee6bdeaca34d016566780c532d386761f62b9d98d098379357e25d23
SSDEEP

384:ziBKnZHb74vVVBD8csQ3R1dsdYoqmL++qcfIk99hep2zVc9/0:ziwbagcv3zdFmmOIk9S2qM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000001d159a42d209d59261a78fe4933425afde70af23e1f253dbb44c0a41408beebc000000000e80000000020000200000000758209561e36c639fd3361c5643f6ec1d62b75a06527b9f0a1ba92ad39b8d3720000000d7410cda596f691c93cc2e20afaabba38c204147a2d45355f406166833790c4d40000000e9c0734fb9371ef0d3f2f5532b4e1033dc88823459d747208660b4345ae186f32022dbc0ffadd44892c629ec26c84f33795e638f5aa2daa2ff0f0476b87560e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421490380"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b014b352b1a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008492b55b240bc1e6025549a55aac9aa0c481a666cc46773d62feb13ee7ab9743000000000e80000000020000200000004c0f3ff9c9d93010c8d3bfba276b1ed4afa31a0a02627db1727385d66a300a3c90000000d51588d16b352664d1aa07a090d3cb05e3be1326bcba37268592fe695effb6775418e1cb50c38f49d94df40bc50420ae2cfd2872c7ea4adce83761fcabbfd07708593e5832b59f68d004640530aace238e2560aed021ccd4d30579f099c87188d93f821ba9cfdbf30021dba2755c759db8cfab5c4e3559194ec7675c7648f64f290d2acea343c9cd07ec1861955b026040000000f681ffbf5fcbaa5fe881d33b98acbeb2b4aac37b9e0831132503aae84c290ebd463b4fcbd2df0f3bd77e52e5ce8d661e2122af22a39b4af431025fe78b11c2ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E001231-0EA4-11EF-8FD2-F6A6C85E5F4F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2004	2916	iexplore.exe	28
PID 2916 wrote to memory of 2004	2916	iexplore.exe	28
PID 2916 wrote to memory of 2004	2916	iexplore.exe	28
PID 2916 wrote to memory of 2004	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e27ed702847a60772b535f767056fbe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21ab07cbf76854a7d4f256aa571c64d7

SHA1
a791a5b9526cfe0359b1299c3a8acbc3cd5b58e0

SHA256
b7743f8755aeead0066b13b957e28cff0f1faeb48b28d0b774556ef4c7e040a6

SHA512
b81ce31c45bd56bc1c730ac1a791edd62342ede6f45da45a99a1461a3908df5fab4133b82724cf6e3c5b4ca691449403450f22f769935848023cd1c7ca0352f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ede9703cee45c918453ae2323dc2af65

SHA1
28ee8a7ab1f5e91259db398824addf0c031b5b90

SHA256
1d70eade936723f65fcfc1361334c80d5dbf7f99243f21ed91575bac8f0ffd93

SHA512
bd6934d8112a4196820862b993929d71915dfb80106ff335dcfc55d535094502a1848ae59e2e02a7a7de663bd7eac2c16bffca33caf04e09d8952d57d90121e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf976889b13774337734e70a969fed6f

SHA1
e5281c23f1bcf0b000b6e7945eddbda42475d86c

SHA256
4f7811ad46d65f2e0a4e68beea22f848d7ed78f647a896aa0a442a0115654069

SHA512
230746b231955ef8528c0ab2ac8dedaf048f4aad31d2d61f1add291abaac73abd8f527e48c4362adbbe0eaab65b9e2d2140fe2f163df17b410f5099ca44f9d43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ed48e6af21072510d053f22886d0619

SHA1
81dde818a30fb1d48963ee906ec4f95960318867

SHA256
576e07b323447c9058ad079cd6e41547be99ae94ad5c22315b98151c17a2dc01

SHA512
8ebde5f7a6e5099b148135a6edf1493a23445e48ba34ec80dd295acf8088e6ea1e2a20101f24811fabf25babd3e2631e2369f4b6d59e9bd2b5ca447744f8cb31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb48d68e2f161095923e83275f37755a

SHA1
387bae8c899902a743e1f660df7441861c0e83ed

SHA256
97601cf82b142ed3d9512613b36584620008e5bc39b64a9e178d19a6479840c4

SHA512
228badf9403811af4eaf59e85090b002a1dd1c0b07aa3175d8bfe04b5a9f044616a453e7bae56bd4e677603ec5ee0f9bb20e6e3a6004863405d74850036ce8a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7288eb46f623376713584326fe185fd

SHA1
a7f7a7cf3155fd9772bd8cf87b677373aa544d25

SHA256
c2b4e4df28ec78b75d005a42b82f3307dabc08f1ee5a70e73585f0a0c00cd083

SHA512
2b12599d397ec88f73df0d7c6d18ea59f58c39d6ed634279108c6e8ee077541889ddc0dd849c7b6dc071a06f19c8a0d617483b6aeec538f055702baaa9ac9af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19e5f0c0ebd3837bc313e9c1207fd23b

SHA1
2574402fffb0b20b305113913d77426f53811fb4

SHA256
458f909a345439acf05d9261b49c5481373df0a6e8576e03708aee902b9384a0

SHA512
0429fe277f931ece09e3afd99f0d1a4041d1717f11d1df1ea640a5ec1f282bd3bf0e6225ccc62d258214ebc434b3502dc54ebba5b7bc4b1d9224cfc0f9ad2493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c3386a26f1fcce2ea748a51566d1a0d

SHA1
13906817a82def540250c52581e5ce45304969f5

SHA256
a2976dcc0e3e0448e1b62e46e83fa706638ca3cf2e9e8c275a729513a99ca2fd

SHA512
607629ac8a14027d57a4dfde171ef48fd7138f35b258a63a7f67d1b4da390cc55233af8c18c33791bc7cc28cb40482892f8bc958dc4db539105c238ea5e92178

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aad8c595aac7d9c9dc8843c4c444c21

SHA1
a23b58be2771f0bd7535a8384486d927034a41ae

SHA256
e33ab76623c8b95998cb652433c7530da0f92d4271473c03bbec60057f17834b

SHA512
18d78409a2ac36e6c4a8481d6c409b445806f0bfc724df077038d7f2080040266324d156cc66c63f5debf50869ff208c4122794b3eb40ef841529b9e093d2c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10863c869647351b156a94d67ab36d31

SHA1
54f54389e313700b14b89542f5b25a918eea3582

SHA256
ac8900bd7a35c3140f3ad7bab5bf9bde418591582ede814fbe4da02083c3db14

SHA512
c44f319dd437c4533556b091ae201131c3313de11ccc8b7aba5b6c3991f514f424a134ddb23fc645bbeeb378097e777c6be140f37641c3542ba0eb36394e43f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc84de71c1e904a30daec303350eae55

SHA1
ef7724ad3b1b3414fa07c8509d934113400843fe

SHA256
31100c6ed9fd90b250e2c260445386447e16203301e9bb5dcb5f70d3dbee6c69

SHA512
fd11e47f81e690d36bd55fbd67a880f518fd5623b1394b8b296831bfbab876c6208a895563f25d74bc5b7dedf2015a4586819658cc1a34fd6c2ed3dd9ace35e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85214d242d64a0fd008919362df5eb1a

SHA1
9ef66a1bf52a896f86fc2c9371d9d007ab3e50ba

SHA256
0b1dae4c159b37aa513dbdfd1d7f581e6465fdcf62305c2c336eedca951bf069

SHA512
e7d8c9c933fcd912ef7080410da90a31d60bc2f1cd31d2f83619fc9b74875ecd98e0d4fb34b0d57f6f66fc64261ae7f3093cafcec4a220657f0b3c3ca9ada156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
254eb49e60b52347d5a08f1639ee1716

SHA1
84fb94fce4d85685f31a0e1620e6121dfdff5136

SHA256
90c6a2826d068d03ba43909ac27b82e447ff37135bb684bbbda2c7c437d8acff

SHA512
c8c2ed7de2b602d39ece7b013b1836cf56705a8c7a579a664d837a5be1f3dd608ee82a4bd9a3a5ef840bc0fe1ac19d116c8d5c9bcc52704fb642d7303ce92f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13f47c05fe310c7c62252a4aa3532692

SHA1
cbdc4ad82840c7fdc825463c603c99965f16247e

SHA256
265c351e14c840ddd30876700bb77f0cd54408765a6da532d3b58af1b46a5482

SHA512
de51d0bf2da7ac32c793965d2e5eb15e242bce918d62df6f1d8fc6770b79fc2b2bf327e010db634bcb1d59f35eef3a986ae83fb2fdb5d3f84c6ac05f0eede7a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53f9bbf1f88a82b0b1987a5718d0511

SHA1
938675e197276303a65cdfe1efa476cac12f8120

SHA256
80225ab27ec32315dad509f998e25c5f7ab0184eaea4c5dd2af6772d65552097

SHA512
a40ff239e8eae23a7b33d92ce24c208dac9614bf78183eb1ea3a8cb392bb1a02010ede927d4671597153b9ddb3976ccca80ee3d004c0bf317838bb3d0a3b7ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F1E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar33E6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit