cd068288602d4e0d67f89391fa14e13c96e1e97cfc7840e0a2ea59674b8db26c

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f174ef3151b25831bc495e8b569fb5b_JaffaCakes118.html
Size

142KB
MD5

2f174ef3151b25831bc495e8b569fb5b
SHA1

3e29632991a2b39d20486abba07508a20b938042
SHA256

cd068288602d4e0d67f89391fa14e13c96e1e97cfc7840e0a2ea59674b8db26c
SHA512

3e9e0159c1bd2544697df67fd5231922c577fdac6b4df4241fce673a055244cb64cef88c9350c0d614b2ca11892ad39a7522d0e5cca968670c47584bb962b459
SSDEEP

3072:SFmqgPMDXDzx7dyfkMY+BES09JXAnyrZalI+YQ:SFmqgP8x7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421505885"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97BCC691-0EC8-11EF-BAF4-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2872	iexplore.exe
2872	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 3012	2872	iexplore.exe	28
PID 2872 wrote to memory of 3012	2872	iexplore.exe	28
PID 2872 wrote to memory of 3012	2872	iexplore.exe	28
PID 2872 wrote to memory of 3012	2872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f174ef3151b25831bc495e8b569fb5b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c411352309329716f2350b10f4a1a83

SHA1
aa2e9f9500cc5759f110ac316807b326d02ed44a

SHA256
2a8046f10745d33dd1f01a6c352381a1c76b8e91e25dc10efd641f4f1ae42c4f

SHA512
0096fa9cdbdd3e564adff6dcb0946b91b105c81a2d6192997f2a92c7f10638825ed75eb6c05985a4097c681d77fee62a9f593509c6cc93bfa9033570da4f066e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87b3364c6c30fa5cc1e16f75da88317b

SHA1
3c70655cc8c6154d03a1cfb5fd5a74ff364cbced

SHA256
620f5841b335c5a9f00fedaae993b7ed1ab443501f3bc9a05c518777b83f1be0

SHA512
7f8b088304e34ede17c6e20beba6ba72ea1d6fb7aba1b850ab23068cb418bca32019e2bf3e1d88146b4c4e6cafd29d65636bd1311fcceb16b5fd4a992e1c3023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fff066a124ed5c10721f3877c8811826

SHA1
4c17f59fb82a93f97442c752ed940400ff5df326

SHA256
b6837e736ae44a87e262a42ffda1ebb224982760b5858307600234e7120f26b0

SHA512
27b20a5846444a8a26a8b7195d3a52e4367aa650b2e41f04bd6a06204e307b6a07ef16845a4df9cdb65827a00917fa59f9500c458b01a9565fd07e8d016e5471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e47b65059a8666fe6a365b21b21589d4

SHA1
74d49cde3a7ec6ae79b0fd51d9de498397a39a84

SHA256
4c8a38fbd4016f1022a7310228f960fd57bb1bf06911d9a8e742a300849ee52e

SHA512
2f4dbc3fcd43b113b751d8b4d38a8b2942ae31b982e5fd7e3aa7ef89160c87b4b4c1c649b782c21f5d7af4658be8c290432257ab2f5190a71e5ce9cc3b3c0a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab3265cf2b4632932e0c7fb515413fc1

SHA1
e95977ac9909b7e08fcb736ba8b82b380c6a9616

SHA256
97ef455022b72a2c2a72851fd78c46b3466be9ad8731980c0abdf67e345ee848

SHA512
e1498c3e91a33ab39e436ae51927be7a93a9856a65cfccd87d98e84703bda4d5ecfbc1523005b0a99367fce9f6d6132fd02a4a8ad30bcf2ace9cfbb3ae9c6e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3faef7ea1f22593935ebaadea97509ce

SHA1
d65c4c9cb7a42c54ca2a0e949c6e24f400f62366

SHA256
da13b2c00bc86f08f9d4d3c2c45e2062fe53c0fa8d8d72096462bcd6ad38859e

SHA512
3b45e00cc1d719742c625765a3744a077012808f9c8c110423549a58853793a7cb3a62843c7b1eaf7e2939494082839c76fcf72642945321548ec03d55bd893d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e0de677c0eb2399078144ef6fff3dd5

SHA1
de527f646b8418030f15003197b35302cadf79fd

SHA256
43be5bbc1dc5a06f50249697dde2f878ba971b32ebbf6103d82321f363f2187f

SHA512
4f8c41531e3b336497c3f09d47036515a4f05584c4f08c15f5383d0c3e7c6ed31b99ae86d680f2bcc835c3595a43b3cdaa83f8150a626a22ff8e80213ae74538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a64b1ffbd4403337e86650b15a783fa

SHA1
a71231be65b64ccdfed413a3c962c8827af7e792

SHA256
40d7d239c9cc4a904dbc05524737f82fb10d108c224cfad119167d1557f30275

SHA512
4b5c2a0d956a78dc073d887db91cf5b18182628ec33964bc37a033a62fb019316b7f8236643e31d4ec33818a9ee287251a1adbc4f8d284ddbea84a42c95b30c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01ca3e14c0efecb7eab1b2e1d342c563

SHA1
5f5a4fbfebc6112a67194142fc902af097e69b1e

SHA256
0244944b9552cb08a30611a9fa79e80bdca7a640dae1245ddffff2c5375b3237

SHA512
036d098846ed740a0ba9d94addf19e7e42f163ca625b8d21798ea2f8dc3673e5ac36dee4316193418d1faf013d1c9ba4adf0f0d7c85b2986c5cf631f62381da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3428d001caf7450123249204224271f3

SHA1
7560374fad65cd580560b47dc2b9d29988b1dd62

SHA256
fd0bc9e6292f20a347bd3dac10cb6789c7ba1b63f7f18310e64bcb42cb53f0de

SHA512
245dcb0889761097c6ec958de8e9f519190e4830562cfab16143d6d29e45868c09d4d313797e5d8956621fa30f1fb502398f53a14406698b3e20f4b89cfea55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1412b6775624b1e3970b16cd56b2b782

SHA1
f3073ae0355fcbc48c6645f33d21a01704e57bcb

SHA256
f9fd3aab0aa8e6594be6819ca854f45c9bcee3abe04d15569e8e69894a494d8b

SHA512
1a1787f7ad6e29f0642e7023ee95e865f646c86e55926d03048a7c8e2d9cb0322c20f9288e328e6f7992ae40ea5f1e6375c940720667e3b5b11b11f99a8213e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c482a3e97ef259375b98dd7cb36eccf

SHA1
00e5c50dc1341097dfee84797e745a00328a453e

SHA256
78834643b7c5d8d39d82d934134046ba637c83824269b968c01bc69cb5cf3124

SHA512
411b0e57bfa8c08bc9bc3513000247719989393ddb58b38adab15b25ee9bac04db1fb11ca4a5eb150cad747e90361f9597b208aaebd275956a16d9154810a672

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24F0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25D2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit