c7192ee3940c71fc6d4e6d33e7a46bb2fa43e19e9abd5803688bbeee5ebb48f6

Analysis

max time kernel
118s
max time network
157s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e4c43a55d85f97981f01dc1dbe99738_JaffaCakes118.html
Size

29KB
MD5

2e4c43a55d85f97981f01dc1dbe99738
SHA1

523a7b59bb5280066fac21d66a7af67af2ce5746
SHA256

c7192ee3940c71fc6d4e6d33e7a46bb2fa43e19e9abd5803688bbeee5ebb48f6
SHA512

5d32e6c47ebe54575383b649fb3a922f2b941c094944d952283d00995b9044740f06eb0f0dca4bf599293c5edf0206fe9410ea7e9c0f4015734a84a7a07829ea
SSDEEP

384:gE0uqVyDgZmdRza70NDlxBsQuIJncryqNcND0jK:gEdZQ70nXJN0jK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002502d0b6a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000aaf019e65e6a1a211f5674d79a1b7bd2cc4b4ef9ac2f4020d5561ab808def123000000000e8000000002000020000000514780fffd8f4507e26f1b516cbdf148bb42d709d607abdec2ae6c36295f73f7900000001223ff1849e678bfaca3f340d71f6508e21c72e58c63d039395c8336563acf14ad3dfba6194a41e67ce2a2829510472670cc428d26ab4a4285021e216e9e5aa2161f7f7c8f813f075c3dbb5f7606567a4924a4bdcdcdeeb79dcbf4930fa712275f660598471e374b0b2f7b2e1e4568a85a60f4fbbde29b8f5dca89aeecb2587d19fb8a82d4121a4f06309e954b0d09fd4000000026b1df079ab8215b39c47f6dc1103a5aab3d419f3afb94df14a47977875dfde8f1fbf1f3e406db779dfe5d679a76a73647a08fc063649b4aa6325572bcdcdeaa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F841B3A1-0EA9-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b10615b055d6fc83f6421424e3e08f45017d740c39f91cc130bc778d5e9ebd34000000000e8000000002000020000000571abdc1754d24b90fdb4fd8cdcd019493482f57af82fbfcfd65c11a12e97364200000004bb3fa58aac926a42981cd995dc77b57d8f6cd3ad3e3a74967dc012718574368400000009cc374feef0bebe1188b141c02f8858e041d803d8e1995ef58b6f19708d4665a2f4e8404f64d58c52a55cfbbab44e7c5229e45edf1ae955b41e7a2a21be6a1ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421492753"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2812	2504	iexplore.exe	28
PID 2504 wrote to memory of 2812	2504	iexplore.exe	28
PID 2504 wrote to memory of 2812	2504	iexplore.exe	28
PID 2504 wrote to memory of 2812	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e4c43a55d85f97981f01dc1dbe99738_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ad790ef312611c04d0b4e301823cf8eb

SHA1
e61ab4be9a6d1fb8bae74e86a0045ffda1ecf865

SHA256
396682a3ddd8f72b48c902a7d521cbbd90260ee5f92af006be59da51dc662001

SHA512
a3538f2bc10ae64360fc44eb1d14421761fff57279e4728e58975e7c2ea65149d7c814dceaa1db84ab3ff3f27adc9e105f4e0d07b3e2c51d46608d7e6ef20622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c8daf6d7d26f175f8a631fc579ad4a

SHA1
62c883d8810ca0ec84cb4f9b71099a2f427c6192

SHA256
60cc9a2a8cde0877676a09ae9cc5a3c5ac4e8e251fa99473add6d66fed08d8bf

SHA512
aea1033ea2b59561626ce2eaddb03fbf75a0ec8f4a1391d1ac6a68a4a71a94058a99d9d06756fe2e76b67591a51cd82199bd65b46d4eff42fcf29d084aaaeccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4436c24e7690e6fd978c70a5fb96b1

SHA1
60def76919dcc567251a2cf79be472e7e13be55a

SHA256
61ce58401e36f8b795452042ef892dc486da73a6ebf43eb7c0e49923c064ab6d

SHA512
67fd19433fe4f5642b6d7aa296bc18774de5281217acc0eb4f9bcc3c1ae07ae052e97dff3cbb163082ed935e10eda4fa499819e75570f16e14f90261916e2bb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee2ab5045768467844deaeee5cf0ea4

SHA1
71b91749d9f1e4a7f1683328d8e6aa0f407b7f72

SHA256
67f1fcea4cd85fadd47851144b7bd41051f76b0fcf1e66549f183f7320902795

SHA512
a0f0ec087315111417aa70cf70261099acecaaebd5104756a73ce4d177edcf961084ad563421b5df2ccdf97e3c62056cccf68aa3bbac24dbbe8e534494927097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
623e38688bf17c927aedcf14ea54ee34

SHA1
37330e420ba89e8ac89e11afc8e63ee6f4698b2b

SHA256
a0e8b647fc2fe9edc3c6ca29caacdc7920fd0cda12f1d130c342f9d813cf4eec

SHA512
c8a752d266401ce7c1b6c6fffd5832ac5a39006ef7245a47e9ce137ae33fb7f2cb820e00a5d8c5f09f634c55d6e36d75401c3195bdb0b92a1e8aaf3bb41526a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8605907cf13fa829eb626b6193d6d7a5

SHA1
d67670101c91c0c0c53789da59583dbc5adfb6ec

SHA256
cc4fab9f9fe553bd40120de5175b1f64c2d9ae36d67281377be6509683efa310

SHA512
8f61694403c8aa12c6be759a2d1d389df035d0e3fbc1ee7a05f99e17ff586d8a29f7ea3bcde2fec488f7de30abf006c5e9ef3c69d58373a9c6b2b7a4b839b9fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be66ba60561aa9eeb1effd0797be56cc

SHA1
c29bbbaaad85b6a25f9017b3715c60d553b684ac

SHA256
22c5b9b41588915987dd70f1b93718518fce3764d104f3e6405b44a38fb295c2

SHA512
0eab430cbf540543618c4644b1c724763f6c7dd95b21036b97d32ccd608a33f274678871a9b9893ccdfcecbd7c0263a9d10690476fa4b82e80dddb8b4d4aa054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83cfbb86db7d11dab1548ae38d1a8d4b

SHA1
67d4afa7430c1046f508f9c42e62a0736d9e99fe

SHA256
d790cfa3f2d8b018454d6174a21df38e76bf715b6c188feba3b4be8e8db76086

SHA512
7df7b198c30f06aace5336766a45787310cd84336bf83976c3a9f5768533c0330185b19fb96b8251cbc475c21050bb581023442e14f8d49fe18783f89e341ecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab34fb48dcd2ed593cb6c57e9cb89cc2

SHA1
0680cea5b47d739ea9db048b2533f0864e45b7a7

SHA256
7afb08e67e730e6cb8361fdfcf3a467077447e4bbbebd45366b1c9f843685103

SHA512
42477942fdd8fedb11870379b40d1303afa7414055833e331a710fc1c604c60c43e8145bb0c3623d58400d87b21247fff376ae3a4e664d731af597c791ee5d21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3a0e6e4ccd8b04cfefc88d8de1aa85fa

SHA1
e51f037a28e51e8ffeeb74caf6409ea8cefddf39

SHA256
8976b25ed8df3a73f230712bb75a6deed1b40044de01c0e0829b43ee31d72c51

SHA512
31d02e30148869da26ee8de52a0a6efa40dd1e6e7978857301522cdb94914878bd280e95f6d63f2ef513546b6524dd44815237f695eb24e1235586844370947c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB425.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB651.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB457.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB686.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit