644d58ddc74b462c0bb2b70947a443f08957af4d25650bd2c5e0815eaede1241

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e775ddada85d7d0460c9de15e0ecff3_JaffaCakes118.html
Size

12KB
MD5

2e775ddada85d7d0460c9de15e0ecff3
SHA1

8ea567e257f04bb9df0c514c9796922ee7ee846d
SHA256

644d58ddc74b462c0bb2b70947a443f08957af4d25650bd2c5e0815eaede1241
SHA512

2782cbe61e1caf3472af730c97004614b63f8baa821700bc764a20b8f86b03ec9ae070f39b7f32ea0218d30490715dfbbd6ef7cd4f25d96e3cefa88b806904b3
SSDEEP

192:Mwl4FqlpLelXaMgmi+B8xQ+wm+ItBTApBZZvlRGE8p3ZZI3Tus78y:M84OLGwY/l/B

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a5ecb5675e8b9497c466f53d82f9e955958b08c60cf35e17f65a78cc5176bd78000000000e80000000020000200000008f5bd0b71b370c9bbb5880d5252be824bf6b69185c06948acc32396b4768153c200000008bd0a3eba4f0b4c44d7efd64ed9a567334fee491184a85c1938491a483e3579740000000cd34db55e27a7b6a478bf4e67f76b25803da7c7e01bcc6b703f9712b55d19b1f8e8ba1620b0c111a2532448e0ba19fa654bc4bd5ac0832dfcbfa736cf7e42c0b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E876E391-0EAF-11EF-BD6B-4E7248FDA7F2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ceb4bfbca2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002a0fc3f90056ccfc1b81d611f26219e95a93bede2106be801107aa0a4ed5cff0000000000e800000000200002000000065309347ec11270cfb7cbc50688d1fd71d8a1d949cc7dc2aaafe72d89a6d5f4490000000de5bfc467bd5d1bd869305625f53993a11b6d50adc657a6ff1c6a25742e268286bfe1d8ab7fdbc390d3316daf4743b566785091c8a1bad4df4e849cfca11649e769585d23d3cb1a9f53124b03ec2891ddcd33bb1a18d149130f1233336f5ecc55d1ba85c90debf92c6232d8b035d95308eeeae6d9f3f2b8fb5d4de47270bef314ed5c937b88fff2ff7079c6c86867df740000000382915109222b3e041ef8c289c0685aaa6d9a7f82e9458ddfea79b20ace3ce10f69db954e5772398a031b48269d235161dea798f7a12aa69fce3646846128778	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421495282"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2152	2100	iexplore.exe	28
PID 2100 wrote to memory of 2152	2100	iexplore.exe	28
PID 2100 wrote to memory of 2152	2100	iexplore.exe	28
PID 2100 wrote to memory of 2152	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e775ddada85d7d0460c9de15e0ecff3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1871d89cf72b51751e30f73bc4d7f6e6

SHA1
43c943a5148a12af4188aa3b2a96c18e7a50c31e

SHA256
a827a9f33a2a7c6f689cece5d956661910315a71f6cf823573589c69b3e07600

SHA512
87d7b303d1611893dcbafce23539a356fdf4e6de397ed7b114f1372a7119d0f3f0e38201e3a20c97303b39730dbb542d86cb6fbb8ad2483997f0ab58910df518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bd555d3fea5c88db2453c9edc25e316

SHA1
18456b1a0330c6b7dbb9139d5dd54ccafef3a8a0

SHA256
76e78c132d190215aa887b77e0becb77ecf953c0727af0559898d067192c6ba9

SHA512
8a0a6ee8dfe39b86120a9d35739217cb00fbab9f4b7fa226b19a04c5eee1e54394e8b8f9be1376e807275125dd0ae7df691daa2e1a20f39f61c552a6cf027b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cfff5ef8671d705b0e493688502b36a

SHA1
5bff49b8612086d6aba960c724d6612aeda10fe9

SHA256
3b945b644005680bf272cfbc89b8f72781eb9ff03d82f7a8ea1ef53c427e1bdc

SHA512
64e7e70f6d91ce89f6954b2e3477832b169478c084b6e236669203c967e79047bcd30f4eff7e71392b90ba088540411903bca9c6c16e49009e6fbe1d935339b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7b5af79b6a8ec41c5bbe748d20b95aa

SHA1
898988f835acd4c9234246a0adf306cdfc38d13e

SHA256
5e39b13fe33862ad5e473f2a315397268f7750381beaa96a5815f54be4ed481b

SHA512
c600d53276ddee213d0a9b349fafd6d4926bd8c4eafc9d546f3d33d2a6f9bf08f2609c4cd03ab81196d16e351b0964614001b8e6e2a0d65181c1723c9e553155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d63fdd8928a0b5aaa8236a3a286b7ba

SHA1
b2b452b8e2cdd55c36930ad42e130bcb5cbb458a

SHA256
a8f980dd6b4538838cf33694c548b7a842dc72ce0c4f650ef0acac903dd50cf3

SHA512
1ef2a06143ded6072de3edd7ad15a1c86ceaa34d8d229d21e55244f5e319e66394bd0c338dea24c8140df5be99fd739a3e611541fe7ccf429074bd96f80e142c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f8c609ab12c2adb61b6b04f959735a6

SHA1
f581df822e48a02ecf3285abe89f1e7e34e77754

SHA256
d985e961aa6599c39f2fedca5642e5e24e9027f119557d5189fcb456d08af2d3

SHA512
df5e275bb267bc79586026f869f29b84f6508d8e35d6d731793bd554a920b35a1f99e459578bb51cbed830f1685f89118422736427fd795fdeea726647c1d780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5497b30ebbfbd35f3e0ed0780a6b5e5c

SHA1
c20a5224ecd009fb081f7e2edcd563cd787cf9c4

SHA256
66f3c8fb13c5ffbd2db88c85f17589785656aed8faac8b734b1e259f11128550

SHA512
91285ca857e4464dd96ae6de5597290247fd7f48e60a66809e0381c1262b4013943df15e05e480183f4a2a3b0d3ba1642b4682a4fa28a36c5601d74531300f60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
071c54961ff5edc4cb6de05b5c4faf67

SHA1
6f8be1b4d9b111d6433b0025cc13ca0d1d2bba72

SHA256
0a7de1acfc5403ee8d2a1865cfc5f1813aefd7f3c455c9c317a51ce6a929eeed

SHA512
9a52fe5ef391e3641e1d4a910aca24a4b2ee8107ed4dd5011b31abb5222ebffbd227f428a6f355ec7c5a5e59b807959e84e74dd165d5338290d9a71bd20b69c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70ee9e7ccb7128ac1de804b7fd24c84a

SHA1
188e9e7e72b12eb416a416668241dd3d3c446429

SHA256
fcfd61a0633ea9933d56416672dee41eb1f38d6e17fb2f848b8ee1fdd6f8a3d3

SHA512
5642bd8855ba8eb1387205bf1c3f71631fa925835ab782420d42e3907aea1d21185e90e63e1af93075f90b4290dd733f93b5be7f40b9e64fcf7c05e4a7b0007a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96db991b1be8dfda9747bb0d18213589

SHA1
9dc9c9ee8b9d047eedaa3f48d982388d0bb2ef50

SHA256
aeccc4275f2d25e6a7467ac1fb8f3d82d0c060f0614be228bed2396d25817345

SHA512
5bcf0e18c42d9aa7dca1d273cfd8d09dea020ab2d380721bf5e26ed94b70eeeecd9387777507d16854ab0a07c1e767e3e3a614f1aefde512082430b1d2b8ac9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e7e067d42721d492a0c53fc2aef578e

SHA1
cfeaa77a5f36822f28a220e7da40a549285fd4b7

SHA256
78a6af452e2527236ccb8114389fe4f4c476c83bb2b0e749a72f300e1629bfe3

SHA512
24e1a2a77d47133aabebca7f7ed41bb12549f0fb32b2282f0c422545cabf5e71e7d5344479e801ab137e82e2639ddc732b6e7dc9a36e7a1ca06122633526a1b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E78.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E7B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit