f907fc40c8486ffcce729fdda84022a0b9daf7dac228b3de8af2366dee68bf23

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e2698ddd1ce9024c0067db3d1f0daef_JaffaCakes118.html
Size

28KB
MD5

2e2698ddd1ce9024c0067db3d1f0daef
SHA1

30cf7c38cd84e26656e3bcb006325bf6e98d65bf
SHA256

f907fc40c8486ffcce729fdda84022a0b9daf7dac228b3de8af2366dee68bf23
SHA512

d88d8ef801f647faa7c2cc7ce7c8991c2dc2be7c4c4b476cc556e1c3b5ccdf4b41fe34c3927100a7368b10dabbaa2edbf6fd7603d0670b3fca4b2fdca4cb8938
SSDEEP

384:UyBAK4uuk5JnlaQQeks2IUBIlwI0bIOiI0NIzcI4XIeCJl0hBWBMiz8:UyBAK4uX5JnlaJe32BxJ4vXfql0hwtQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421490300"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000080440242c70bd5951343469e350a24c693d8c37717d7fcef1f43a31bbc56d1e1000000000e80000000020000200000003e936ba147aa6077964321132e589c67616ab974dd3903491798927d12f8fe57900000000b1c504392e8fdc23eb0f4536a80b42af5250790831a61fa3a5f26d798614d70b4b27dc4083a687442774e66ea8727b331e2d12464bebc87042cef32c3e7b110feb1e428475fc36a0c3c71b5d3fdf2eca949aabf653dff0da3a047d6560f401216cb7da0887de44b7b29efc5621c5a0980ae3b7c5eb8b414f105d2e793862d59c3183741d434eb8adaf667253875270c40000000308a055847b1862606727630a8840252b8383ba1ee77ef2c872600f1476ef4cc8f6820baf3e0796fbb30320c8046556529eb37514f4bdd3d4ca8bde4ef37777f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E598DE1-0EA4-11EF-B27B-DA219DA76A91} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000269c538b75142dae9731a0f7a754b7d3704d02af1d7345ef37935c932af13ea6000000000e800000000200002000000013b7b5449e8f2dbaa2114a93fb36c083ebe60d676fa1f00ff9941176b00d4f1d20000000bd1fd7cee120a4b9b95dd56304d8fa926847b5275087bae5506fe8552882b8e840000000ed779a10b03249db3a83a029a33ea2eaa73bd1e26bd0f3f6e681002b8d6b114fab073da93fe5a3606fcc6f26850089a0463cd08c5aac337553c627aa095db397	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ad7c62b1a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2748	1636	iexplore.exe	28
PID 1636 wrote to memory of 2748	1636	iexplore.exe	28
PID 1636 wrote to memory of 2748	1636	iexplore.exe	28
PID 1636 wrote to memory of 2748	1636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e2698ddd1ce9024c0067db3d1f0daef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4d3fe7208c5f64b39d1e23fc9e99631

SHA1
7dff713f0c2e71dbe57544022150a9353d0213da

SHA256
d47dac232eefc97cda20df7201423f92e84568790149fb325b92a708b24a2e1b

SHA512
823539f9b354d98ecb28366f1e0308b8ada015abe74ea266709817b493dc60f72cd77618eb0693654aa883f424e4097b3af41b6828188ad6347556a007c7c02c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da2d54ec8f3ba95ffb784af04661cf7

SHA1
e36201b03dd87ad72243b31a76e62be4640c73da

SHA256
4f89ac0f5f23612d18ac2f04f56b0c792513951eb8cdd2b1c3223d7c14d59075

SHA512
64f207cb12facc18aa00001319cb27ae16f2e96c8e5240ee5127583b80bf6b70549eeed05b19f0b1f8f0dffbef8b23fc8181ce39cc12aaa23f6bb7690f9ec791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ea9d2b4dce7f01bf825afc12b8f7110

SHA1
66f1cfb31a59f3ed15b3ae7044128be154bd7b3b

SHA256
a5b191c8bfe6887da55255a9c75e08b4abf3bd63525a872524e2cef2524ddcb9

SHA512
b590afbb7fd9c572f4b92f923f0ad804139a0a286a48100e3458317da5c2d8e7f968dac1a961ecad2b9a9c3c4bf79514f5f68e0674409ac03a9dd43d1495f2cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3e177bfa49b4664ca6e582f8694e0ec

SHA1
a2e8fac5cb79582c9ac80429901e706fba413bb8

SHA256
0f1dbd3d6e550c04d9bab911165dfe7b5b9689e0c028744b00977f4407d14dcc

SHA512
f1c744958040b3f0c4595f653c47ab5470fed70d5c6deb073403eee2084c2b6a8a79d978cf02c4f762d225d757327361380fdd1e91e480a0703cdc0f7055bb1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea03773cb82eb2a9b2c652b377bb3c8c

SHA1
835480813fde9d725279f7d6e81cde9c405a13fb

SHA256
e95eb02633252707dc8057b85fc813fa62c400688fa42bf3d0518bf7338b6225

SHA512
091caba78577c1514ef4d3ee7ad7cb46efb76c6f9ac92cc3a119211431c6612184d43861d7c3aa3507dc2a934e9236139cf44a349f5ffc304e4a7eb662db55a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8d2491bf890974e5da918d4d33c1963

SHA1
55124c21f58504072756ffe5a8a85bac123174f7

SHA256
a383300c34ca33c74b53ce283b022066692616d5162d0a73c0013b6bf415f2ec

SHA512
38705270249d36a96aec1515545fa16c59aff68cb0ff9383f01225db0412779ba81cb2aeafc9b38a2894767665f5c7ab7d8f76d7ac20241883dbd0d6b1254635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6690ba916053f298e208023a95ae2957

SHA1
762c8e22f45b3a3eec5645f4e7e56a1799df33b5

SHA256
45960e80a3ee26e3277e49f146feda259d166ce9c73fbbd44aa20c1d61bc9300

SHA512
e8806adad930eaa354b91afb59a38685c0920fe4fa88b504231e9e3f802d14722881b51bcda5d1bc1f8cdf23a35e2bef7353121cb441e98457bd92b6ce71c8a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1144643fd26584be0715d40576e61129

SHA1
1da9482c03a3aa78cb51503233b99dbe4135037e

SHA256
da62a07946148b816bd86a586ae82150d897c9cffef9351a39ce346a200c243d

SHA512
0eb86e0193b2718ac4a790be768b426989de9d3a8c94b9e84c293b43fce4c184e79ce9b6d9eb8f443cc76b17353e358f99e978581ba100d2f88c5f3620b25fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaa8390e29f5932401cd59ac0fc4fb20

SHA1
30cebadc16f90a09cd42b95c87d682926df0b878

SHA256
8883e19bb1505b44932d008780d2802df80c048d59b3011b9a8afe14b867df8a

SHA512
334aa95e36f59143f9f26093a6502c70094ebe62150a4346b873d7ea111a57d55036adfa56bc662f85537d7a63c189d3dc38ac86616909e9858b7167b24a1482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fc143cc7c97468efaf6b98ac53554d5

SHA1
b6407911ae121a6fd6a2e29f605c753e0769ac6b

SHA256
09bad3ef3b0d6a0a0f6c72d4629f80984f716ca98b2f6fe66bc56403778af7d9

SHA512
e8dd856bdd19446047732e7a0f72bc060769c1f6ea41c5603191b85e0c3f1c0916f1d5855db6b9becbd4a5be5e4fe863d44a43c05a0751a98656213566857112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88267db92fa4d63eb159880b8348d0d4

SHA1
9a146684acb521e6e1fbeb9e06010d99ec9ae7a8

SHA256
bc93626eb76a00d9ce6cf04aa080175684ed97921b7e31c78ce947c9da51ced8

SHA512
22e475a4f92714575d179a2400be05573388f0c4407be001e25833a834dea9138ee22282ad29f94ba51713200fa3de7da19949677de66213c1803da10b5e6174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74f95d209207115142f811b9b5a41afb

SHA1
3a31b15d3a25e9cf0752d4337ddc70ebde7ec6d9

SHA256
aa685866277f9de5f1009ce6637fef9f18a35333550810baa7c95aafe7921491

SHA512
96b0690e62434497817b7c9572194b43459cffa0728597f941cc24cd8a009422678ab5f000c857af6cc38c54fcfac63b8f26e58151742f0207c083e7795eb406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4283e45458966fbf9b896ab9ea0687c8

SHA1
00fdee499c5b50e86b15a38a09b7478250e5a1dc

SHA256
a525183bedefa461c5877bc88bc8cf16d95dca0ed16a0d924d2736caaec2983b

SHA512
bb038e2373e12bf47eeab3f0a5383a44b7b0f454be821fedfbc67b9db234e4b99948dc7f9f78661e4d62448519add605c88210a3be5725a579761f2bb6ee6811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05735858ba1b69a73b16afbcde8bd66b

SHA1
f9185f4032cf43b0ffdb440353a6ccb729922376

SHA256
fea4bb5f06e768ee105c86d77be120ac97e95fd1eb7378e83e60d789ec606138

SHA512
a940d34ad13b1d79bd4e0b5a336593a27e19b19586221e35ea18b792fce0483292bfb6a5e4bb9f939536a966bacf06ba429284cefe98e12910d79dffeab3b864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f55f76b7725008e1172cfd5385836d7

SHA1
145b205a54292bf201c9a2dac962e52ac7a8dd0c

SHA256
092a347d7573839de206fc7f90bdf0b43aad4a07812dca1eb7aab6166f902f51

SHA512
c796e0817c7d07ec6c139ee5cc984723090a59a96baa3ab801a704933e9d2abab2087567943be13e55f51bd907ba570adf6a8882e2ee6d688eaf6ea08c379cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64356a536b8845781845364eaec96b91

SHA1
e13a9990c99dc23df915296d67292371e8c98177

SHA256
ad84adb5bdceb384a4481aec4c06909120fb2778633e884604c925aa452b212d

SHA512
927c86b17ec9872712450a63735d12551eb81f6a1e16c20b517d3ad3960f1905d97c3970b1cdd4e05a988c2a813b94ba783aaf927fd862a1a29be6f2be6cf7e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39da6c6f31927dccba7b7f43399aec76

SHA1
5b091adb48bcfea8500a9d15b0f300755008d273

SHA256
8a8302d6be0091a50f95e96dc8a8d2dcb7b836b62630e8c6de0febd09a491e8e

SHA512
bb276c51d07de2b07a258fae1b5435c4d3d74875f4a60e52b0c123089ca14f5e5cbeba981ce4183853d7c0d1f6a5b71015abcdedbcaca34b9384f1ef5d3f5166

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25BB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar261C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit