b6d483b15ac6b1b1211c0f0d218ac5d9cde5851541a93ee2953b5c8e19491122

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e35cd90d37cf800e80f67f8fb0331d0_JaffaCakes118.html
Size

4KB
MD5

2e35cd90d37cf800e80f67f8fb0331d0
SHA1

6cfed0d7bb67cbe96fec10f26a05b788e2e1102e
SHA256

b6d483b15ac6b1b1211c0f0d218ac5d9cde5851541a93ee2953b5c8e19491122
SHA512

462d8ebddfc2f180781340b9f8c809886deecc086da54081b21ee4c80847d9523174df8c17244c4efb57fae4cf9d1aadcce73eed6c7253f26e30c1add991ff16
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ook6ReoI:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000023fd3b5b29b476c5a35c4d5abb764b94e371420e5a590361ad632bc03f30adb4000000000e80000000020000200000001a6605d6d1456af2bf9ac2473aec541ff5b471018bbf48fbc50b078a490c2178200000006df315640b9b3a85631ecdca929d85d513bd6a36282e5946047d979541bf437140000000cd490b963082bf95522cd3b53f8eddd91d6512c6b8e5d7e24889fbab52a746deb8cd17c6ff069bf31bde50a5e9d370ba6afa27c2d9e19cc786f77879053c4267	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000006ef04d3c0b4da567f7bc1492846d2906c468bbd0385da2d601dca44775a487eb000000000e8000000002000020000000ed7e8dc94c9fbc1da04db99bf457d9cd9bffb92d41b782cb8729d47917261262900000007ebb009209a5a07f4d84578c0c1eeb021bc790c9ef9b3159301cc4a3e0bd6387e2f90ee1d5ffd3837de4e93a52a5f5ebca6f8dd8dc121706cd0cdd651070e1a88fc635751f1d5f48bbd41319e90f15a0011be59899131cacae716d0ff63af7b912a630df74b6823439d3fbaae1ea4e6d9f0387df130e2a676560dbfd8b6deb9bcd174ad1c08c704784aacbe7fd75bd2c400000004e19d5397fabc27450f4033a1f9b3c2b9734a505f04ff260f07baa550530a07b03cfebffccbcd1ad15832ecf43d39d09a78fc558244d29763516f6365c72f93c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421491321"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08c7d83b3a2da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEE49271-0EA6-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e35cd90d37cf800e80f67f8fb0331d0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13258cf3e99c7747b547938284910c25

SHA1
7f9c193225e05b868af7828de8fd807fa62baecb

SHA256
8275130f9bbcfb352b21d91f760d62254e4b3976d07155dba9fd7c10727850f9

SHA512
41584fe9310e95f887f2b54a6f57327b07ac70fdbd38f33e2ce3c4f68d8f6f5e192a5085cb2ef8fc63838ff80a93a11208186862e48ada039ee7aeeb45a0beaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e24b442a85fa4e2130f29053276a601f

SHA1
3bc58c0be3f7bcd27e6b1c42bd72a3fe60ad56a1

SHA256
8af4cf12c5d739de2697de19acb2e43893c23bbe414e21fc84eaff94833ef7b3

SHA512
7a166b76136ab9871d62cfc464e407292241d6f5bf95360a35538cd6f09365759bd038dd66fab58de9613872c64f270bb95703ccfd109fc165fbe96073108e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c22748dd2c1c27c0452cb91d1033ea10

SHA1
8f45d1ab8ab1d52a0d76af004c122ae80ab06b52

SHA256
b9df667a33dbb2c9675746d63b102667592943c99faaf01966425c4809675716

SHA512
cc42d56b2ea043ac4907c1977dc1779f2b169a02d3a612c7f410604b91b8796046371146b369d8c45080e8d96f5c19b06b29f07076aabdc5cdcb26f24b5d0a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41b76e1d0a61974ecd9b4c1906e5ed92

SHA1
e2e6908016504791e138e53cf99ef5c8db1de86e

SHA256
9513010659ceee48b334691f92421ba3cdcf96bafa7edc8fba4d7358da955448

SHA512
1bcd7bae4b01db823b0abb3046eae6b246ac1373f6c2161bb0e8b8cdb038a8f2506e03cd19d18983020ef065b034b980e18896f321b53b2faeb811e23bbf4313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d960e42357a20dd6236455510709d6c1

SHA1
6f0eeb1331a21f62487e64973dd400db2351e11e

SHA256
d5b14e8b18f2f1fbbe24d07886c595b5b1dfc6e1f90c10f7d5947b13576ff6ad

SHA512
496a1e56f51b65265c00bd336b8a471917b64bb2cf365b48dce2561e8963011de75e55411ff855a7642ed51fe9acc750aa3bd765057f6b533635d89dd29e5a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
952860ee8596c2ca75e3d3f5b1ba9e83

SHA1
b77a82ebea90f751c32b033305e801aec0353ed9

SHA256
27ee3b8d7d04e1c576d3a34b4a33641fed923ddc101b7b2ed91ede4ccf675361

SHA512
34190f60c834b7d6019b6f19da92333206670dfde2da19cf59dfb25a1bb5e3df23c20b3cb49170914a20359e68d433dc20573b7a884906649195113d16c3515a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea1bc6b006b91b456dbf8e49a21fb67b

SHA1
549a035c858a7dc6faeeaf0f654101dab06df7a8

SHA256
d84fac2ab0472b9db9ed81a591e92fce9fa342c1eec9696d047b153fb1a45f84

SHA512
4b7e35843555557a30600dc36401b49f9a8c9ee55897182ee9e06593e559d31aef20d941ab73a1f2d1e2f99e3c17fc5e97d642db3a87de9dc01e7fffe43df436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
174a2cbaefb460e55e15ceb62244a7c1

SHA1
7733a985d8f6a8932fc1e557dea9991b7e6a902f

SHA256
8979a6691edfe8fd035ae2b8222868507cf758687f7e8c1911d16fa48cc664b0

SHA512
374850949b407f6d89bd8360e78116d64ef54f5fd22a88dc2ae74488860c23413aad23bc2a70d75f170340da0c9b6d853adf4b40319f44b9673b9cd0ffb3f851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f248c2c4e448cdb40fc31a689090e20

SHA1
9f191dbe2f0eb94648bb7b050083fff4d63f42bb

SHA256
816351fe906adaf623de3b41ae7c1840f7b027e57241cb97719f8da69d207833

SHA512
bc1f8144a6ee2af4fbe4cfa9a68f492d5002df2b65b4ad22aadda5fcd2af173ad5b21fc8913cf3306a2fb6e9f817edbde48a508ca88b9a0c3b6cd87f7064eae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f15616591d7ade0e37fea900f122e7d4

SHA1
f1d1067dcb8652b264df0380f77de8a5f02ba968

SHA256
f571402c9b771a28f78485cf1c445c88fcf11ae4f8278d0134bfcdad83a5ed74

SHA512
9ed4a1aa7b2c55a84e7b15639be4de761318d1a5f0a4a391accbeab10431f8e0958c8c97765d534c0ec496afccda2c864a35cf39073433ffad48819108101ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bf05ce9456e99edb09e60f8ae90d51b

SHA1
4c0ff1cda83a557e69d23bb3548568d44da9247d

SHA256
433fc3137e65e4596ebb2b260cf9ce5222c871771b9c3f82a9bc351f2bde2241

SHA512
2e18f20e762aeb132e08dc96e523695630b677d217f6842e5ccce855c6a684f808caa7cd251b10649c94e45337b3578b46d4ef33ab7ce414da5ab0ce0779375c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
765a80382a553ef99599b607ca2e6cea

SHA1
b77287bd998787e07e328a1aecadd2ab52d47289

SHA256
c6afad3fd212f4fa16005e4a9c8c19f5f2233995f2ef8f1d6f2b2371cf7c3ef4

SHA512
561903288717fbc3c97d11bbb5d10a22cb2745f974f25ba2e6500f10cd44b3ba66cc4e9e46f1e0e4993738744ecc46e94e7f5d28916a0373befd93471f5c6d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab399A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar525E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit