6f54ddcd688a10d216064c60d84c790eecab2d71a2ebb4dbbc896e02d6952362

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fb59802e7094f220b7020ad642bcc14_JaffaCakes118.html
Size

119KB
MD5

2fb59802e7094f220b7020ad642bcc14
SHA1

bf94e3d4efdc7661893d7d8e9f9c670de1dbff3b
SHA256

6f54ddcd688a10d216064c60d84c790eecab2d71a2ebb4dbbc896e02d6952362
SHA512

daffbe12f3afb775ec2163cd0a78452a2b33513d69d0d6fb4b666b023cdf431ff8b40ef623e03adcd5fe75029366c91c567dfaca672f108ed083121309fbd3dc
SSDEEP

1536:H+7MyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:e4yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f835a6eba2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421515431"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000002c668014e65a0cf0a82f98b72b6e92cd24380fd56156b634c1f8810cb2e96d3c000000000e80000000020000200000009bc2020f94f8649d02298a162691eeb6e4b0344473b13c38fdb5ca626e6d76bb20000000d95a26a7a66e3819c975a65a8b0bf3ef125119d76156951eb69fb62269f00e8340000000252337df6ddecd710f87420bd7a555f3b860bd838753ddc59baa66147393ed2cb77c1331683b171092c69188e4d74636120b6640774107e8d56262496549865a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000fd3eb3f9249222a9121047f61fa96a440a38496b64a03570767aeba91af88ca000000000e8000000002000020000000d3801caab281bf6c57df027fe7148a33974b1e39a4a8a8e93c7d5b5f720c93dd90000000aea2462c60badb4eabf1bbf228810b87a988e160bf9547e92995abeba080bb0c34480a87e096cdb0f05624fc30314eda0ccd83824f0490318f16789a14ce58a0db4dfe00293987fcb9025972c30db94bd513bb873585cb89f2302babff25765529351f7bdeb03a3b29213883dae1caf6eaff6ef896a647fc8fdd435f01225f849cb2f0f18c743eae9391e568f19ea7164000000099ff2f62495ec7213d84ed46fb39a6d1d8df863a759ba9a2429f9fa7e9332d976efcc8cd113f444aba2ab08f89cfb1ccde81afd9f4adac04ef635d7b1350ca1b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1900561-0EDE-11EF-A5A7-5A32F786089A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2848	2912	iexplore.exe	28
PID 2912 wrote to memory of 2848	2912	iexplore.exe	28
PID 2912 wrote to memory of 2848	2912	iexplore.exe	28
PID 2912 wrote to memory of 2848	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2fb59802e7094f220b7020ad642bcc14_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73abccba3e8a52063cb9630dfed5dfef

SHA1
338efd10994f6a4bb3cf3fea880507ac47e4db50

SHA256
80972d3431e7ed4fee1e44e08f47b30a42682019c82efbba0be4c65020d4ceb5

SHA512
85f82feed5b6a509716b68cee19744a958d1689fe5bd90e7805575cdc214ee2e7254d26ccdbdc5ef2a8fca6393576d719803bd1a135890f7ae5f10d7d4b8c7f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7d207268d50967fc4c3275c145a1a33

SHA1
62182672c7ece4bcaf8878a15b7ae898586017b0

SHA256
3e955bb1f9feeb7a5bb5a1539677c40ed810ae4bcf67ce1270c62eee27c49902

SHA512
5861503319d505ea23c47bfb816feadfeb4ac85deaf0a850aed422cd5c76629a27211f1383471634dac2a46bb0a61109350f731fafc93f82fd076f95e42f010d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef6b57ffe094177c6fff199c395ff230

SHA1
9a1c9e5166ee35fec51b510de084f296c5a90c72

SHA256
d6659f042e601736d8a3bc008cbea29b899030dd909cd6fa445b6ab8d6cb7d0b

SHA512
8d508a87afd139ead175d7602a365f0b9281981fd2067f5971fa0bcef30caed3c34a350be3ea0c6b69b6c3cdfbf3f6050baacb36ad04662b5572de538a10f6e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3788546fcdd26e334024f2a3984410c3

SHA1
8c08eec30c206dcf87f2d4384c23dc8ad47304c7

SHA256
46cc85dc0cd49004ce1cf46dceec8a848d4dc7024ed6e5d81cea64413a3fdf4c

SHA512
b9311a50399ce2dcb224f72daa22b3b3851f3488e6d27936145520bf98015a5160576bd64609ccfcd6b0d6b0b1dc1edb117704da782eb891ba4b92c25efde8f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfb9104dfabaeaea071cb2b25d2eb089

SHA1
403dab6cac7cc2ca24b6a7748a65481a3efc6c91

SHA256
d06cbfdc5d2048d3b1e319a6509227cfc222251a428e1c00ef31b9703b92e1f6

SHA512
af8e14df63eed885851ab01651878adc070e110f348fcf8d0a75b21c1395f176ec8033f53bb35137e4f3e911c190988bdaeee8d36c30dd4157db1ddd7a690b55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
263d1c882f25e04c5b78c145f697c7a4

SHA1
87d6e0651a8e988c405d6311b076c66acc4362de

SHA256
272697eb9bc746768d64251bce724a1b2c1290d34066a4616127aa89cfd829f2

SHA512
5392880bcfda7e131cdaacc9b358b60dcd346d809139b441c3915cb1454145e78efaa84bdf6f033e68e78f0533a1a4e951f0f10ddb677a4d688fb3c014917dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4cfc852e40416b97169ca8832bd068

SHA1
ce4134bada9776fb7bee50e8fbe2155eb948d6ea

SHA256
1f39a08da0d5c8a9993e5b365b942fea98f4b886c026521c01ecdbad88e36fc1

SHA512
1eec7ac489274ec1acc00812d7fdac3a61e104ae9359a7c24f923c577a564b7f6983e1811d619b36e79319253691487bca91336fc281497c26442f78af6cd329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99179e4fe1e3f5612e2e89fecd13c3b

SHA1
c6e7bb90dc340edb558b089db0e753d07e38cfbc

SHA256
8ecabce55e140c409f185aa6836c370af150152dfcd920ee6c145d3944789a50

SHA512
25823f0c3558b19f5025dd1d463eb3c7f38b4b0739f56bbc62ecc9d2c2c0879b5c53824f7a36d1ca449178326e97d750271838f21afcf1d73faa0390b998f9ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3783b7775eb59ee99e593215f5be9d19

SHA1
736f36a718c243542717f118e9c1850e299a027e

SHA256
e86a4d36714696b99b2e546fe3d625f0cd8ff82b4c83e4d75e192b513fe7b207

SHA512
0e953acf400150692996381c22f76450d13cd17be48f3de0e425e53995c15de2b1f3e2de5f4a48f672f7691ea6cd2544ce3cf6004a81eeaca180d4bd0ab5bcde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
792a11ab3d606ff3f7b6a85b000bee88

SHA1
2d35e33386e386f2c48b578353066d9b5fc4ca2e

SHA256
cc38bf307f5e1fb3ad95a8a167f1b2d47ba9b386235c41a1322042e782c52a02

SHA512
edaa754e0ff373defec9f693d1224e241f2d61a51a666557a1efbd8fa0ae084d55f979e285764568a70669189324e02ae8f9932842e1f5a65fdd5d89c0ee04a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8557387bd2bd412326e4a39e1658282f

SHA1
79bbde0ee22c43d77a5d0e246511f3327da1f5f0

SHA256
7641cd5a06b0d81c60fac22d94cf86f96b5d27ec247be9c8a08c8b4da26f4409

SHA512
d8086b2c103a00ea3bde0fce87d8b2797547816d15794a2e6164151ae0d6a4b5dcf0c675bcdaee65447218e2bfc93d830a4fe45f5ac3dfdac094fd2464f48c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
121e18414b9d8adf69604a6bad17b30d

SHA1
90e44b4d85322815dfae010ab42ccc32d7bb0fb4

SHA256
c30c8f76a0ba03d9a90648d75a96f02bb5d370206a72e7968a78b4f0e29446e9

SHA512
548a093c73aa1254d639b58fa245c9ad931d00621526a0d6f7da7c6b05962ff0bdc3e1b6f5b2f9cf1c34acf5d4284197a6544f55fee4ee1ff8dbd536004b0458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a4189cdad49aa4b7c086209a211101

SHA1
72714cde66eda46db21eeb1381a8116f707b40c0

SHA256
f0ebdd31b269efb4d40ec6a7fc5233f739b9286a70495d6a47925bf3c7539a94

SHA512
f1eb924132bd0fa5780ff041102b3537d9baa774ebcd2f688d17aa963c4456d6f328341290b425d885d90384440daa672764ad575a7b4c2f9f00f1c0f551f096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119fa16dde16a18bbc2960a2d32e8d3b

SHA1
8c9b1aa8ff34441e427f3fe519d738955077eef6

SHA256
42148483d126c6356e7a16feadc2e4240e67166defa5c2fd2e2c2621c9a5890a

SHA512
681db374ac48d92a62a5ed0a6748a4a04f3b58ebe9327fc1b30629471a94f7dc96351f6e3af49a6cc527f559bf449cc56380d1402e280ae1f5450d4e67d46164

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26D4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27B6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit