df1bf1fd1482e5299facc2502a239538b3d0d26f93146e816b22f4121a630461

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e52e18231d0a7daf0cfab1f569edf3c_JaffaCakes118.html
Size

461KB
MD5

2e52e18231d0a7daf0cfab1f569edf3c
SHA1

eeb980deba76cd10281bfc2aea83ebc956897f60
SHA256

df1bf1fd1482e5299facc2502a239538b3d0d26f93146e816b22f4121a630461
SHA512

e3fc7a3cc671ca170845d72e62b74c07c86aa42abf53b05791f7f58b1c17197fbddd24851fdb6566c51fec58942e033bccf03cdd009b805e3dcadab54d017256
SSDEEP

6144:SCsMYod+X3oI+YNsMYod+X3oI+YvsMYod+X3oI+YLsMYod+X3oI+YQ:P5d+X335d+X3l5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000006d216eccb973e105020e6e13e9a2d1e368f0c7f8a689f6214b65b7295dcad0e2000000000e80000000020000200000002d3ce35ccd96d99630dba5e16a70f1ac09c353190a41f006cb86ec3da9900216200000005ab1eada307855bf21805ef719b3eb655854dc8b3f9431b52c7238f4c9a3d99840000000c931b7309c73184836b0806a01642b61a665f1527b976e0e2b1388287abe9c0f5c2de7f5ae7b93a91952fab331a49c0de04fdf6c69ede74f57824a20eb211aab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000507a79f505e5764c2b7e8a83c879cedb7fec558ae3ae19fd4b313b68b81a9d40000000000e80000000020000200000004feefdda483181c8a1a06a4db15e5ef81544eb21fbc83bf68385ed5191c4789090000000d631058b92eb6952267171f9d3483ebdd3c3ab32615cfc309d11a57aa666ad53bfed57d9140bade2aaa1e5d0417fcc9041d49363e4680de3bae9a004e4151e7748f6ada2b1d5632993ac2b9317d6c50a98ae6e160ea24b6f50342548c93afae3a6cc9ecbfe81742e9678516ee818e107d92aa6d7c9b50c70b8a6e9753fe3fecdcba165d373a13f0a83ecc9cdf767d8a7400000008e8702c55eeb20eff35ea7bb4038a0f2cc352b4c151df5a863a23daed65432a45330cb583395d6647b439a5b701b0e3c1a63af38533bd66e97b81851028d7747	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421493144"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED76D581-0EAA-11EF-8F92-565622222C98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10940ec6b7a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2492	2912	iexplore.exe	28
PID 2912 wrote to memory of 2492	2912	iexplore.exe	28
PID 2912 wrote to memory of 2492	2912	iexplore.exe	28
PID 2912 wrote to memory of 2492	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e52e18231d0a7daf0cfab1f569edf3c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fef18eb2ebe5d1af2ac427dbd0ac1ec1

SHA1
e074be10afb0f8820abc9eb3f6db5e94194dd0ff

SHA256
5c01b94bad07463afeacf07a9540ea1262b91f9abe74fdc4357132d4bb9636d0

SHA512
f966576a3596fbb0a963e9afcf4b8bf23657671d6b403c08ceb5a8e5ecf4866ddd836486819046ba2e7914e58e4af53f932157db88ff5ff34d20db9203eff010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afd0ec79840fdf2e4d9663f630e35e50

SHA1
c6df2ea0d7cbf27786f09d852ee5366b556cad1d

SHA256
d46536e04674e26cd307a7d6d880ecde312e193356ef2a3352451ff98712a287

SHA512
53b1d79f4ed1b1bc07acc3204e89242a40e6f163a094d4ca35f4763868f89f1de4a32cd2defc5bddd8f66d87e4aeea2eba653f7ed867496aa176539b99dd5f3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7bec6964960f8eb5a6daec9fdddface

SHA1
09ef8d340dcaf65e2388bed8c2e827e8b052bb58

SHA256
4b343bf94441d34280b16dc8bed92331c82c6d03d120affb303b2a2f90d2406e

SHA512
3b3800e8fd364474fc475555ef4f561c6155c98c447fb18de48c1999bbf1af92fee841333470d7b6382a5ef62b2c2f005321852f6f44cc1067f72887aaa88338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a984af5dd088f67d489e04826e7fc04

SHA1
762ba27b8f99162db0dd31f8e9e278378b7e0795

SHA256
60ea5a9e44896e4509006c5aa05b72d398095c3104f09e6d9039b276db7030a3

SHA512
ba706f281b2da71bab551bd6c393dbddd0f054add3f9078b86200807efb87f6168cdfacbcafd985462ebc15d5eada278e23655a704585fdd396729ebb9180da2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3155468b9a72f85abc49197bc68d529f

SHA1
75684fc2552c74441fd968e3133379fa2960b86c

SHA256
c0a2ac079941d375b8550a78d0b73b2a412a7f3ceea229371507ac0ec6c104e7

SHA512
f5aaa1d3322e42b2a3739b908ff90b719f126a83dca9962799aad2fd9c8d579c056283f80967f249e0898a81d1fcbf04b4f4f8843446a84fa2bb622c7f6972fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
212666e3bb42234ccdcb61c58f130a31

SHA1
3862697b8121436948461687b25405091ad38412

SHA256
743af32a9b77bdd263e72639db717ae452dcc186a6732b2e83fdfee9dab24219

SHA512
eac17e82bd341bdb1d3d4df994e9b14cd85977ece8f8decbb302dbd3621bc49d6740a4c7f75de473d0619b69918cf1b268855c5da21dacb830504643562f8d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9223709a1725bb45db0e5dfd910cd551

SHA1
f08dc32a574cd13dbc9e9c84dd3d3a94d4d077f5

SHA256
3c3b2b952528f8cb13806f6d86ce1bf74e751fa20378b00c97abd7d1843dda1d

SHA512
a1d7c1a0a1119a4dff0f1e4ed5cb3033806f7adef0b7b8b69643b9095180819d3a3b3f3331789c170b81a7bcc09ce73c7df53c69e5c5a79e4c2f925fbb705886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d01abcfb4571c99b4addfc7ee697c3b7

SHA1
880a0e4e4fb63aab5763c895371a2b3ed7aac625

SHA256
92ec46826757eca1ad40f0a76b51caa40102f0b8f1293f69a8fa7ba4e3dcd45a

SHA512
9f266a7d524be6fa9fb91aebc5116955240ef7f4cf3a227dbdbfad778c899af14c2da5b7b26972bd17b206ea147cf98a4b5d04b83ba8ef51bc8e5af0c24e6ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
407db3f230d17cf82c70bfe50163c19a

SHA1
4aebd316491483760ff4eea16928fa668239c30c

SHA256
6800c9a6a03d92485ae7ab8a189e1d481bb76ce5e2cc93b28d9a8013c67230ef

SHA512
15975d481f8ed6794940b84591838463718e5d768d9f39e39d97b15feacbe13c9c1e4fe226a06063b50d788155f5c00165171d135b93a04c2455db2f4175a202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
965bc3a23b2ecdff50a6c270e98844fe

SHA1
b7c926570ced30ad1125c60d2b48d24249be8615

SHA256
a554c5f9542c5f70b4ec5245f0d1f9ffed008dd4b433ca81c6e82b241de20fcd

SHA512
7ab49bc530b9aa2697dc8274fd9e26f3c47af4ca6d141016838ef878448add05cdf120c93486357b68f46c42d7f23fa0ea5aba926093709d348e10e2e4c270b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c85a9d970a336293eb49e4d75015328

SHA1
ff3cdc21a477781a56ebba5e75ef07f2dc6b84b0

SHA256
b95b4f2d259a85c9d43b1780356cf1cc96310abb3393f8484856bc222d6398fa

SHA512
6bb4ea271a21f813965ede67ed1bb7a53ef2a462ac9650fb50be381b1760beb3f16d8e21c553fe1e5e57c94d06ee92f2f20f025a1f1ee8be2c2f39fdc5f8ce70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cca4a76ac9533c1603a552734150ea8

SHA1
f60af73662626cb5ee6310252cbb97f094835d90

SHA256
595ae39caf7a99ffea7f5e4117fe27b4f9441040a23f4491ffdcf8b3808deb5c

SHA512
6096cb17d7f32c9ae49a5adf2e74c9b6a6122fb52873ec29770fa2dc2d22aaf1cba974471a5e416b5366db7047e9bc8f82d134ecb85823e01477766e43142e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0e5058581b11358de662827ba8c8ab9

SHA1
4bce72017c52bbf236b3240fb963e41dfb926a38

SHA256
033d0d07c5971c58bfa40cfae9d4c8c0c99c25b9b819e5be22c067a404f8a3b5

SHA512
4bb44dab9740c82faa96c4f84380d229f7bfe0754918065fbd4b8f23ea86f7c35a4e393b42e80f0dfe1d1c2cc7d1c258658e20408e6cd4c1f6fc99547ea0181b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e55c68dacc1acd73f8ce537b760d9bbf

SHA1
eb9c726ee4ff8c432b20b1375588511cbefa54b7

SHA256
f4a4e2eeb73d49f45d3415dd218826e64a9754bb858b46fcfdc6256a8813f1f8

SHA512
e6be5be92fd625068e2f25293e9eb1004157090ab107c7bc897596459d6fd4a7173e50f62ec6e8745b18ffc76e87927db24f933228cf816404c87d61f005ba69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce0fb562caa706e527daccd75afc4ff4

SHA1
6632f30b31e67491b2d39ad55871d8511f4759a4

SHA256
4b6d7b4eac7934b28c3090df6802ffc8db8a08e4b222e6a8b308ed8e56c744cb

SHA512
b74bea766b38fd8afabb6a05669e94987c28f92b27fd92aa961c37fe2a723f1bfef90eb021ade70ae55c9d4823bb69488e52e32ff056ce1ec76ffb94ca875e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
010b9b7be88e82eca301a3713e56a718

SHA1
51620bcd6d521e2d57b26632bbe515bb32969233

SHA256
d3d4bd73291b2a664b2f95e4c2319f27276d647d6a941c25d0c6bd3453ef58c5

SHA512
36d8721f561870a30a2008a583fbc24612d8251b78c172768f66f9f36a1c63c2de0a2a6f20bf49f5580c3157245bdcf8865fa6bd3b1639bfa88c3d2218121928

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E41.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F14.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit