7d514a0addaf31395ae1f01f64a94f4b64e29c95aa0bf1a3c3bd617c3190a4d0

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2eeddf321b9b24f8422ef555433a1dd3_JaffaCakes118.html
Size

144KB
MD5

2eeddf321b9b24f8422ef555433a1dd3
SHA1

7d66b950a81a68a7f6796421e18e509c78db2072
SHA256

7d514a0addaf31395ae1f01f64a94f4b64e29c95aa0bf1a3c3bd617c3190a4d0
SHA512

b4da78f15e8c669ac927de8892fe08a6e7fdd86f9b1101fd7abf2be081b4bf06af5dc870e0b92b53fc7605a9223519fae2a7af2ecd1cf58085a091021bba4ee7
SSDEEP

3072:SoDY2xBx7dyfkMY+BES09JXAnyrZalI+YQ:SoU2xBx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421503057"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{019BF101-0EC2-11EF-86DB-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1216	2388	iexplore.exe	28
PID 2388 wrote to memory of 1216	2388	iexplore.exe	28
PID 2388 wrote to memory of 1216	2388	iexplore.exe	28
PID 2388 wrote to memory of 1216	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2eeddf321b9b24f8422ef555433a1dd3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
452675295260c82be73e70ff2b7141e1

SHA1
b5f8bb4b101e07e6498d0939b988885a9df74d93

SHA256
7c6e1ddb0166b3dcf1454414a399708e3763c2f03223a20f701cdef220c301df

SHA512
09da87ed92492a9018e31ccf5ead109e078f45766ec419c65dd891ab80a6dbe0f0cf8783d8d0e3daa8d633143fb75a9f89fdcb42af5e9fe394b527384f2f2c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a8cfdba6769356154a2d9e212142f29

SHA1
fd8dfd67b71870ee79380a868eafaa7aba152e4e

SHA256
76ca98ce2445f991924af9ff2f22240a56e028641e5ddc1b883c435aab315b9a

SHA512
e4b77ef3d3dda878e43491820cb70d67db6e9340b1191fff91f89e0bf87321a3249e1d391317e293c437c38650859d549ab4851d1e6b203a15fa76f7b0dd01b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d1fa79bb3ba73001a60cc1d4388cf68

SHA1
d1f0a19a0d584bb8dca0df5e1246cfa090fa7324

SHA256
d0ca50991b2517551e55dfd6d2bb7c309fefd61003eb794982f6ef3f92154fd6

SHA512
af3ca2157c409e2b9e1a85a1c026253523e98e1a22cadaaf1bc9af05084ad73d1fd3b00dfb2af53c48703f16404daf03f15733b42b7f925946cabeeaf2c734b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d94f2d0008b76b8fbfbfda23d427543a

SHA1
f7c450737b438959ff79ee472e80a5a6d07dac93

SHA256
3b84a9565df70e11753b23419c6eda4b8be6892d484e2e3f02b2da11417823e7

SHA512
9ccf494e9e1b3e0cbd79d075c34db3e07123ef5a5ff3c69b36f575ef8130cc953a17b1a35f2dcf921c20b58e0a9b3b1b125ea760bb0c03128c6d0803a134dfe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
408c2e01c551299c188d08c78ed806c2

SHA1
41964ea02ee10005982f1faacdcd583341b03883

SHA256
09c2dc4e0688aa1a3355878fa2ae0aab29fcc10725a9992a14a98b04c2ee0ec2

SHA512
e243d94d2634a84279208fd3b56e07f14edd1e7d140855a4341f6db9c54b315717f08fa340f5cfb7b714944f371da3a297f669851eedd4de13b1ef948f8cdac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6950295488ddfe3771c770be9389e613

SHA1
ab1a0b35c1083ac8fd126fdea2902003cd5d2c40

SHA256
eb0e2ef7e27bad85e6e6b29db871665684e79d0b52f75e74508440a3b61ecbc1

SHA512
3375dfe92378eb94f6660289bc51213252ddc0d0312348d62749733337ff30708b3efa034a687bc48c13930c2619205231bb4e859a39cf285e578fd6863399a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c697f53e8efa5975d9a018d84b4df043

SHA1
633d5d67b59191bfe224979493b0625f7103fd10

SHA256
738399ac720aa7b1179b2c2a1871f1a7d2ebaca1aa980de3645626a5d1cbc235

SHA512
2992203bf1522952710aee2a287ae8843e266bcbf6084b5edd4e8e09f8eccf44cfc81aa0186a59c185a9880c38b77fabbf19852cbbb4fdb67791766a727ff806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
156e557f4c691419771b727d498ce60d

SHA1
4d44d0193207ea1069e846622246000fadf40bc6

SHA256
a900496ad2740250059891cd15ae789a1ce161d258852ce8588b2542fa3b9d6b

SHA512
b50bbee3bbbf76f4f2b40f4b4628a576be95d0fd8ed5f51bde8c10771126c25dac6622e3ed3ddddd287282bf69c1932e017ad7cda233edd5d63a673c52655116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dc3c7f736e6d96683464b519d002f1e

SHA1
75135b7fa2275e19ffa4e59c4ea9f595ddaa2be1

SHA256
829cd6cc016695462215458c457f54dd905d0a32cedcd1491d777299957a9aa0

SHA512
bb4a544fcf4eb3854f574b48b48c9e3826c4bdfd36fb50be77864e86b108bcd4c5fa21319a0e705bd40fd615a85f78f398fddba8dbe026fff1f28b2907de7f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b95652f79a7184c966032951c7c78baf

SHA1
2f2ea07c11025cdc7e572edb99e3be0b3cb62379

SHA256
3e945243848d5219aa674ebc8dedd417fcd63c18d8cae0b08bb021bdaaea41a8

SHA512
8ff26e046907b9c7bf957b8133ad508790af6f089da1d9ebd1cc277d078d2b2080b1fc565cf24f255f6eed7b63badf0e463bb22a59c54e2100a3b717adaf1451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
546a765bf76233fd6fbbfd9cb56f60cf

SHA1
46c2293b840707d483ea3fac294605290ac503f9

SHA256
2dac54bea72965f776e18f3435087e3bc69be1985aa8f8282d0ead08c6529d8e

SHA512
8711ce91f75d59b2d1e9965230df74894460cc60c5dbfe12df832655c7b8cb76c2ee0134585cfb46514e315d2f13cd2118aecdcb2f0d62440d157098fee07ddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
376961b4fc06b9c6ec5dbf1220cc4497

SHA1
5d47ad1ab0a5c2c1cc8d334afcc583fcacace6e3

SHA256
9353776369885c471656270909efea394e81e76501f7daeb7afc666316090da0

SHA512
752a845701bcaf923bc3d77813cb4fe5457d14f1039be6fd38d09821e68bbc578aae06ae364b9dae08e1837e4e55df8523b0429675d059a76d3131b6b0fe6267

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1b530c176cd47ebb23b0061ed075e3c

SHA1
2450692a100ccac1de67a879d8a2ffd3bb9b354d

SHA256
f3f643013ec8395386933aab10c3b627abd32d6ac3a1874007b8129e72721e4d

SHA512
f620a1312a8b13c75125f051d524123bab6dbba9516e7fd212690ea85179f6da238c4565df00eb4ab45943a465ea9df339f8491baaa6ee3785c4306a09171699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78abb3028d840e196b89160d77f5e698

SHA1
f3a19640d11265cc94e6c94b59214149a97cfcda

SHA256
9b8a42d08de53effe7c82c8f67875b064fb2db031b8db15f6c2dbfc0352fd2a9

SHA512
89f45cd4fa264fa60d11795bb8dc27776c9e16e47c2110be06897d052cb410e73a28928dc8b24752898e2ae6dcd25e3ba719ae5d90397734b16347518df946fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404667f21bc97b7eb78cf5ac89c1c319

SHA1
765130262deb277ca8edd8de0c22047c5b112c9e

SHA256
fa00b76cfd6bcba41a8b125673fc7b7b38ed9fd9efaa3b835b6e0f2331981cf9

SHA512
f500558e94357df15ee6b2a3f325a2783407e666ac15eef4ba5a7d0febeb6b030d8f9c120a9618a9bcf859299ce638208c6f97f679ac5ae84ec4b459432f8c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cb5e9199d1448740b860e1f56cecf5f

SHA1
d117118b6812748fd7a3644e00d4c8ba5897e934

SHA256
28aadc633e2f8b38a36fdbecc931599f53b3082c4af04445a3fe34ba255412b1

SHA512
ba3735058d482f9fc8461e97683f074cc2ed805afa402d3a938e223c35ae92c4094ca757de5a21e3c0041585d163596d8c0e149d528407685cf21c7fe9eab16e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
130161c6150657af951f88ae88079d50

SHA1
38295dcd145314a62c1f6f8eb65132bc4738105b

SHA256
f330e51fd73befc0440cc5cb559f71b7eed4053093e192a412a58d4334d22d82

SHA512
da7088c33d2ebda3ff6de359eed1fe38ec545e9dca87d9467fcf5d91a54ae2c9a70b682dee1b5eb5570706406adf087d7c4e9f4871f761bf2773060587ee5f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fe13b2617b3fee85bac66958e891097

SHA1
b3b7c1bc3289ae2fca42fdcc0c12978b1aae98e1

SHA256
b88952814906bbc24c34a82395b5ac66852c2c37d136b90bec257b244eba4399

SHA512
52dd206b9a368a3801e529cedb5174f378edb8d49a6cb8069a33a02445d1596746dd5931cb9770ff1283edf2288b37bb4afb62dc8f3d7672f94005bb7d7f41a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e3514235c318a981494ed3755436e36

SHA1
e0f7b2fed0b2391639c512ebb8f208f19ea66b5f

SHA256
988db9960c597d85a268b1a9535957ba6129ed2053c17ff8bb11f63ae15f0f26

SHA512
610ada9f695675a615c15260a3db4b0b8ae385d84a1e778209a04981cf4a30a04e801ddb064d3ac0c4aa6b689906e0ad00715c6eea06d62817db62c8c3a5ca00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1880.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D69.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit