71d590ea4901ea965445bb91e4cdfeaafe6376f1cd8afbc549da5d69827d5365

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e422d0f6cf538bf1783058ff9ca29fb_JaffaCakes118.html
Size

12KB
MD5

2e422d0f6cf538bf1783058ff9ca29fb
SHA1

fd33f978d3b389f5c0fd5e6b6c409a05b509f90a
SHA256

71d590ea4901ea965445bb91e4cdfeaafe6376f1cd8afbc549da5d69827d5365
SHA512

4ab2727796557da6a663fbd722202bb19aa1e6ae0b0fb001812105bb74a0ec85bd6c0bde2dd294d5b8bc0a2438fbd8d0cdd3c4a7f97ee13d2b2c6946d473cbf5
SSDEEP

192:53gKSgHX90alRd8/1uJKMuqFNnEJ7xk+cQrt1s9a1UIZg/XAOx:GXet0KRdsNFUNnatk+cQrtH1UYgPAOx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2015e259b5a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{848DC1C1-0EA8-11EF-A04B-4EB079F7C2BA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000045e33f408e21be2d29cf27d1c8dfc3486fadd436dc2dd337773ffdadfabc66f5000000000e8000000002000020000000ad9adcdb48e667951f2d49496eeb9c77f674cc54ea9f2ccbf2916e75eaec19312000000064287add7b73e7d807ef956d21b16c2174f61290a07c317770d4fe8a608d6fea400000000d9b98987391a76d8fcafef4099ab599110ee43817ddda72aac6fd1b3eb8f4fd69d645fdc39744c227b8b4b5da7cb66cbb969ca50a564f925cfe09a7a72f3ada	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000c6f4d89b240a33f35d2868582c9a766f48bd181cc52b9906789526e7a3e04e45000000000e8000000002000020000000109c51bfbdcb02e5d7e8b932c63299b5b439a2014e3d5e9c7d7946a6e3df3a7a900000000f1309ae753c0d42253ab69bdcf8dbaca33b6151e6a51a2e81c90afd9c76adc44f083b2f7d2b680eb75c51c545af9fd2f376bf35cb91964ca05df300ae96e1576a0050a65ce561b383152de113c99bd9dc0b937942ae8b3cac8f2d31756df7ad566d0c3b0d47f890c9a424393abe5a8356a7b59b597c0b34879313f6337afaca77c5945b3c316980647d0667a9c06b18400000006dcd697a4776d07bd91105b71196e29f779552850efd2474ddcde6b2e53a0ef9304f878917263531100f85a64fc027200a5fb1a8b7d1a9578cce98de1a936cb5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421492108"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2632	2084	iexplore.exe	28
PID 2084 wrote to memory of 2632	2084	iexplore.exe	28
PID 2084 wrote to memory of 2632	2084	iexplore.exe	28
PID 2084 wrote to memory of 2632	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e422d0f6cf538bf1783058ff9ca29fb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56dbaeed8bb74517f80a58125ce5c0c9

SHA1
f66de39681db0eb935ff3a6a597f0baba5da4035

SHA256
4d8f1b459c29dcd74fd8e6f1127d1ba3d0056896191b25985c6f134046308fc7

SHA512
56be7467a5f6d5aecc10b6ac8b15776e28d7bdda4d938fc36f2d02b68e95892c3aa1af00b62128c3a3caaec161cff75aaa85ac67a87ae0ff927db56b9534d1d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72cdf2ce2db28db9b3bc646e2e9aa63c

SHA1
16b773e8b07dec917af0addc5cf320456a9dcd5c

SHA256
3393f1a455ee370c083e0d10a04b6346f68fef8a4b17710198ae199af12f1975

SHA512
be1dbc82ecf8b2db20b1f60c45e370f9633276f45c2873008417f1f7736ea180a1a6257c33698198e8eefa04d8a0e3413b3bbbc67782ee9d1876657f7cd9443e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7060c1cf09f8a4aaed93bc649a3527fa

SHA1
a60f7e34006e1e3d2d0c19d1031a906d7f1d6108

SHA256
931bd671b5e2d15a6560dae2dce003bd4a274da9e8bcdacc7574bef207f9e492

SHA512
b7755646f195aca635ea335101eb25fdb80201f84fbed9300bda2076110e92ef3bfd4f21a3397647873b230712528e6679c57ebdf12676cfce2a394ac6211bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f40ade7c32d9ad1a53bbb21d1ec89647

SHA1
c0733e0d0b86340b321b78bdf0e26e74fd3ac555

SHA256
b077a3bbd94e7a7bfe6ad504dd9999c0b3cda3a5d39713bffa01d0aef513a3c5

SHA512
fd6521cac8a66ccada4f417d32ef62ed62dbfe16878791c48de1488505f87dd521ecaf092791817b51a4aecd84eaf4d959d09fc21ae798018bc619a8b7acadae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee3e3aa840f57542d8043e03d02b935d

SHA1
49b329923b5cb8fb3b3afeedc742fd0684b70140

SHA256
b1837ae062ca5b0373b25a3bb50b0fba9bd7f4684e48318a9a287bc7f5f62e5e

SHA512
30ae09cf357324ddc37a54020e5970a260a5659e8ccbeb0b8030e8f8891705af20d34fb22bf72e8303733b831f11763bfc1bfc3388d51876a503004634e6abde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9a329263fd75c7ac9a7fe42a9a94652

SHA1
d067e13052e89180ab7145802fdce82bcc7d8ee8

SHA256
a735c81182bfbf850fbfadb53270665876f191d2a2b8a8bd848aa0c752a9f5af

SHA512
8f03ae26b9f373930151bea43fa5c001a067eacbd2751a0e7b9920f029bb8e1057aee2eb49b7ad1706c70985e0d4762073664f28bf9dcbe263b7e104cd2fcf38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aceab669d93ec5ad14a77b3bb92c75eb

SHA1
4d39e0c6f56e2aaec4e357688c29a507a99dbbe8

SHA256
35e47646fcb3fe7c393bb3fc3dc5294197f2aed4f1157caaed7ac41cfd46dc24

SHA512
4189d8e64e6ec5d8853bf125f804ae360285434ea9570f1410866660c1781a2042f72100ee73e7be1d3d58da6619053f2f5a619e2d2cf653e9d9cd0a71bf4156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec6f881f006268ad2a09ceeed7b6c79c

SHA1
a9698c0f99f442973ec5278252e4686d8ceb029a

SHA256
0ec511fa0ee6e0da710df1ce1fb718ac7aad24e179c284c6497bf0e7e74d6b8f

SHA512
f6382c3c8fdf1102bf875f635caa92b4321aed75dc1790adff52eda19f8c6725967e29aa1be1bd8cedf92052586ca50da0a90bec8da13b124decac953f8b4ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27ee9362b347747adfa81a1e0e5a0071

SHA1
59c00766cb5ab765bfd579b1060d3f0505947716

SHA256
f74f0c2350af693a762ae1ef2c3d94ade5a09cde025a7f3964a26e5b005c2ce5

SHA512
7ea9eb59e2cf0d4fab8dbe814a8e7516dd5192939986facdf0bb5b2e9c51abce534d4c1c4618660e11dfd864534002e1c55fe2043c6d99dd27ae7c332f2c6f92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b095dcf64e2c28d3db42e0487b1e426

SHA1
380a7fb5785936661a00ba2d8a7f25daa69271c6

SHA256
6039299bc65d7ef4aed35de2489554abb5b3f17ccb88a5685f2cae7ef215934c

SHA512
7628a3dced4473a2e19ceac3413f47d832aa4fdde4210ce9a79ab5e252003b610e1a0b29d2855c9b16bfb69b3fbf556986d45d2d7edb35e30caa54e291e67eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d89c56fc7babf00c582c39efd70bc6b9

SHA1
81b6cbb75666dc4eed8d61bf4b58be407be6d580

SHA256
1656ad0a47da5805c1202bcd314fb01f48945964b56dd5c3f586fd542fcd7e89

SHA512
ffe3ba2381511827bf0a203a0a889e67d7aa3e95ef92791ddc75be832b3bbb6dfe340014d5b20848ce558527c6956c755b7f07b459415a053d8f30aeb41da94e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efd118a1b239d3c8805dbdee4553723e

SHA1
d845c12feb65d06c14aaee8655ab9607b78ac67f

SHA256
39b0d8ed01eba9bc3e9e13fb723a11fef2232bbf0af934421faf8e933151293e

SHA512
88b92a2faf093f9255817def2573f393d4b8b9eee0bf01919ecc551ee4b55c3b3354c6d16622889339a6f6d69c14564681dad510636fa0bf64cf847156b779db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7eb8bbc82f732082508aca875bb365b

SHA1
8867663205a0a48a7fce2e52b5443dd12b222b50

SHA256
408b16714b2d033883f62ebd4567b71700f491651f113da2114f1619a1f082fb

SHA512
365a148c69666350da3fc64f52ea90fee2c6d76b06bef020e3f33a4584121be153baa7c8069864e8c9377ee81625cbd129bf2465969e77cd6c79f80fd23fad55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77fac96ecb31841769d27d80b3862192

SHA1
89ea1ab5a3110d1bbdbd00f1ca300c416e6febce

SHA256
d33728ec7382a880bc0eef9cb9a54079e3d5cdb7c92010e0c48c29d2f95929f6

SHA512
ecaac91c73995f88ea4016a6559720b12dade9d9a181ea694352cd6224377981e477b34d648228c5400785dfbdb0709d4487e5526a8ee4862fc7c1aae174c2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6b88674e9ada5d0849cd8b1cea54d8e

SHA1
0dc99476af8c95da6beee7486e49332f15a9f1d0

SHA256
11aa6a15ee8877164f5147af7359b925c924c06394f1922caa704e7a42006db8

SHA512
3e439a84a5107b46279f659230a225090d25934ac592dab6dd025143a83688df8852cea332b6f83ddd90e6f3d34c2fab6b8c92d795c27534a7cd01476bf86df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DC5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DC8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit