f39f4548c9b1595de1a40655702d5e9040281e2b9550ca2c780afe53e9cd4c29

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ecfcc5bf3913fa2203a1ad0c5695f73_JaffaCakes118.html
Size

221KB
MD5

2ecfcc5bf3913fa2203a1ad0c5695f73
SHA1

f1c3b9f07f9ce8d2a6ae70809fff9635df63ef77
SHA256

f39f4548c9b1595de1a40655702d5e9040281e2b9550ca2c780afe53e9cd4c29
SHA512

79312b94cf9b06a470487cf1df0162aa42d491cf3cb26b1a7e07a1e1078076d9968bc3f53220ec4e71250b50318e86dde6c7fcf9fa2485ab4df62b7e5a4da125
SSDEEP

3072:Saghi+8PdXpZyfkMY+BES09JXAnyrZalI+YQ:Sa+E+sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B238A801-0EBD-11EF-BF51-4E559C6B32B6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421501204"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2992	iexplore.exe
2992	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2924	2992	iexplore.exe	28
PID 2992 wrote to memory of 2924	2992	iexplore.exe	28
PID 2992 wrote to memory of 2924	2992	iexplore.exe	28
PID 2992 wrote to memory of 2924	2992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ecfcc5bf3913fa2203a1ad0c5695f73_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f24bb86a348667c5385c55d01783ec4c

SHA1
2640d781954154aa428c0afdfad72ae56e19ccd4

SHA256
30e888fd0fec7f5f7252994d0fd07e34d8a8bb9ad3ca65b27541344394c7137b

SHA512
a8ae51805dd3dad3169d90f845f46f577fa8e1f238ad782553e8fc91e5e17f9df628a246cf5ef120c38fc4edfcf7d370434df5f5aa9b0ee7433c131954f42f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a565149da4c876621a1e9c80d47ef2

SHA1
946bb57caf0d462639b41f3e4e918f6059c1b928

SHA256
7d8e7ede884532bd750b283954fcf8c40ee2681afbd30b4ea6fa36b68cff971f

SHA512
fdb3d5dcaa7674a07828f2bdff6d3fd63116efbf59583e3de5154a4551b3cbb004a9877ff564c04d32c333a27ccf0674140e44b14d379cf866bdce02c1d51373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad50b04b5b4bea871e2ff7dbb8e02ff9

SHA1
62ee8f078680bd02456ae4d5c272843cb36916f1

SHA256
54bc90d3a7e51a91c07fdf70be9156d055e6570998615be3e8a6ceda049dc518

SHA512
cf756795e085e4904e191554240a70951d2603796e193820f2bbe23ee805f745555fc7024e33be7e37925f2133d6838607318a571998e652de9d03465a12ba19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12a3621da018a11af6d0e9dee7dda896

SHA1
e2d9e833463c7f27405b39888f33159e3f7daca2

SHA256
b5e3a8bcfc75d3daa1bcaade389661f71a334a8ee2f855ad5413b5696664337a

SHA512
d882ea10149f2988d27b33306b8f859b4d9e2d6a437d5f722b9474f7915ae92a6735e193101251761cfe9e39c9c895049ab3c0be94d8ec6356fadad940577122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95f326250db7e68d7b5f859e707fa61e

SHA1
81044d105af3a83d92b83641c7c741f510f0de7f

SHA256
b0b165063493a056a6b083f4e200bb92b0473d93c4bbd344e5be1736afe2aeae

SHA512
fca3e5b8a98af3cbff6d3eb875e6121e6416c308a855aeeb0b8b352cfb1b93e4a1024e996ffce9c3ca3b273c53f5ff32035ea9493ae66887c4bd8a2fc659f6b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13e18d5177af4681a8f5ae97bf8dbaeb

SHA1
ea76675a4d59a0032c19a6590b0103e0accc4c99

SHA256
68e577b99f3aec54371f1fa429a4703526b069e61f56c18b22c46beaf3d5c594

SHA512
fab58de345a1bf11107da9b2cbabadeed56fe2b9ba5038b76307c2945a0a1e75480bfe451dcf14897186e6dadb91fa21f3cc03e61fc59ec6be0facdf28946114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9800cff127be76880eb70ad55b0a86d

SHA1
3a0c9965c1784dba1218a44f3b3570e9fd1ba40d

SHA256
211b82c4784bc9cd51dde3348a3a0e5750b6b4fbe4fd081804b8e4e1788f3b8b

SHA512
fa9fd2103cb86209e5af7d06fcfc6acefe937dc8b24a784be67e73b1783c1ac54c75a90543d8f81ecd5d9c54a4d45aa4e3874b0303879653eec31dd5e23ff9c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee2a02608aced79e73341ecc07668ad

SHA1
8dddd54c1efd344ec69d78e8625e71fca7a679ce

SHA256
cabc24bae889a42da329c8f6d38515743546ae174b4a412f83d157d35c3ea5c8

SHA512
7204c98f15688588634361beee8543bec63934df0ca5b1f2df833151ced480ce44a99a468358bcfb50b24291d226ec2fa790ec51043357c54443a00c8714efeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bf07bc1e66b4e4c79570b009c128310

SHA1
84bc8a05be51c4720bdd64a7c1edade1673b19b8

SHA256
a6b09e2de2746d083fda7a1cd0ab83e2179f3940fda07ca75496805699f565c8

SHA512
91dbbe81831ed3dd8e0acd6d5096ff1fe07abbe94a6b2142b33a77b41ec3de9a2976251000f9d6990f99c46c2ba93219b26797d9e5b700bc5026205421e5f46b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93e8862b2e92032101e124d83c3f4094

SHA1
d525a7b0a3b8aa1e0d80383514639ba89aa8d9c3

SHA256
6e87522f4e92ec5c2fcd8fbe539e91d0bff8297bf5f8938271ffececbd0270bb

SHA512
7e842f1b44f8514a5ff63c5b1db82925c666ddedcf6b62802a52d771ac3e5f65d08884b42bffb4f698b6b631d66fe1d358de3743d80dc613070c85af7da42cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b8a7dc690a4377940898fec5266ced1

SHA1
c7bef807c8543fa92ad09a3069bf606387ac617b

SHA256
d02961fe85cf38b3f597997029b92d73aca28bcae8e756b86d264bff658a7e69

SHA512
58fc8dafd60f8bd9f08344dd87e3995acc3e98aec9ffe799c9674b1c3acf6a1508387a8d149875fb97111014d45730ecaf1d95fd3eaddb0568f72b32f820ff32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a8ba3c20901f44a9ce84c7190fb1aaf

SHA1
1fce2c3f498a7925c8b6bc3a23398ed0b96d162c

SHA256
993cec39d3245d1b235648edf25188ee721ff82461033353a74556853292d909

SHA512
c9638c2791bd69a23cf53162a1d30c26b990429907e03f06aec9b48fb0e1e1ec470e4a854a5bffec9e86be8c5a872fd0de0c1b259e37d7bee053d397da6abea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b703c4c98b46616f12d94aa48ed74d60

SHA1
a85e8466ce6a7735c6141f48f360f1f9cbebbfc1

SHA256
cd2149bd19923c5bdfafd4c1e59fdfbb17c712aa5ff0bbfe87bc60e4f594b7cc

SHA512
c024bafa9165ff7ab0c809301c035353ffe3da431bc6047a3b552c8ddfbfd34c83f843a11a7f855ec16b9bb45c7b150157750388e4206c81562719011e9c7c18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee28aad326a5316a4f04ab9032d7396a

SHA1
8d881994b185c37b6e1f72cb99c3406d637101ec

SHA256
b0ad597423e5dbecf3a026c0337c295a178f01144dad642e38f1fe67d37e9466

SHA512
20f169df309a2a87bffae8191f155b6d31fad874286ec5166f9e697952c7144e8824c5eb87bf5dda369b3ed9d9ca904a7df3fc2c96275dfb8b6e6f3e813781a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a3ed4712561254c52b971dae9e557ac

SHA1
5eff362dbed1ea1d4fdb630f6d80bc5fa49fde6a

SHA256
4b61c85e5a8483863ecce063d9bdb01b283000a500ffd89b963e62860d49bd72

SHA512
fb3d56c5313afc0d90ac7db920e55fe79122d4711acef0aa8e3b52f53c49d2f11147def6c3d571c53707c74b1b8edf18774b1f1a97d250edd180354d3977cacc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
080a07297fe751ea4589c448b2e4728e

SHA1
c9df7e80ee6848add217f3d6cfa137dd1bbf3003

SHA256
4e4179fa53c7401b7fbe0f4ad686eb2cb4977e52110bc58da7dc63fcc3b6f75d

SHA512
72a92d159e6184e6050677712de6e364e0ff0469e542852c093f5a7a24ef26740110cc322c38100bef508813be4ecdb1be7b71ec8b5d868309b24ba12f7adc16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
796dec9a1038c7500cc5ab4a909518c5

SHA1
99eade74691afc385fa50e87ce80988bbaebe0e5

SHA256
e8339cff5d422d190fb7840851de86e0bcf45c528f57780a4e8d1dcb3b38f31f

SHA512
80d9ca881821c51a6a12b8c0346c875ac749dcfa4b1bf1e0853fd70a83e4276d7c2f77b070d7e6f033f681b32b82303f8dbfb2f6589e11a0e615ff8d65f47701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c97e35cd1b74f2382a1e20d4b868d47

SHA1
e8b2feb35f3544a68a1b47f792419c3f63688aa3

SHA256
cc165eebc6774d6a25ed00076b326a95ba0877a83d4a9022a7489acbe3cda4cb

SHA512
b27ba62572bc76be62bf2ac5421df599474b93302ebbe7079c841709adc809352de61075d7374c4269ede94bea540947ddc4bfd2534253c124f7a349603673b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2158.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21B9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit