c2866df71cf13a4cd754dc48271dba80b16d92590e3b928a95099605b344b6f7

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fc46b310682161003052e5229acf589_JaffaCakes118.html
Size

460KB
MD5

2fc46b310682161003052e5229acf589
SHA1

d81a0516ce0c593f70b0cfd96e4852c33633d09b
SHA256

c2866df71cf13a4cd754dc48271dba80b16d92590e3b928a95099605b344b6f7
SHA512

b9b62acabbe524e326d53f0ed8765e15449c8a394f2a602e83437746c4f28acf5026e51720d777d8d41adf3dbaa4e6445dea744da8efcbb8e67a196ef7d191eb
SSDEEP

6144:SLsMYod+X3oI+YRsMYod+X3oI+YnsMYod+X3oI+YLsMYod+X3oI+YQ:G5d+X3D5d+X3J5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4B9E771-0EE0-11EF-965F-FA9381F5F0AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000070a99435bcb3c3558523da64f6ad8d570755519ed855f957110a180b8d9cb994000000000e8000000002000020000000e43662b39c2226cb968807b5d053606b27e5a7ffbb73ea452d919a4f9d867cf3900000007b482a5ff78b580257cd45bdd23022daeb05a725e05e965bbce6ff28abee38265eb54e1b91b6f1d9c12b3bdafb12f90066fa89432bb4af6e2a4ab72250839bfd0674f6594fca73d82d54ef01c8fbdbedfcbbcaa79a3ba1d30d0628edbfb2c694fdcfb2af376d59028df8d16ea144a36d13736a4793007cda1a045f530f056d675f09ace6672b1ce53621947763a31e5d40000000461e51c86b69c6caf7bfd9aa32f4d51293b2b69bbd63a2dfbb84b475c962af018a8814ab3f6faa7fe36133181e3e210d72ee54dff5d5d55490cecaf87cc75b54	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421516349"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503446cdeda2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000917f093d8b562e04c06fb20208b13fdcd4395913749d06af1987617a38056f6e000000000e8000000002000020000000bc1dd7036e2e25c724cd4074e5344a3681ab0f81890c5947e2c3a24e25adb12a20000000946ee6c66c43822f3d57933aa0763e5d02c6e0633c1240cde31902e62dce5a5d400000009097e425debc977be79a9ab84c3ffd616a534abe1153870b801f043abb63de5fd2e200e1caf6f6fffe386d764c0714d55389dde3815cef59d76825524298b9b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1264	iexplore.exe
1264	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2216	1264	iexplore.exe	28
PID 1264 wrote to memory of 2216	1264	iexplore.exe	28
PID 1264 wrote to memory of 2216	1264	iexplore.exe	28
PID 1264 wrote to memory of 2216	1264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2fc46b310682161003052e5229acf589_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f651bc656b700cdd887f343c6b73db1

SHA1
3aed3f598442e606a367d5469d83d1e142043721

SHA256
97e46931bb02140179fce402f3a344e11a2976a94126e4c6bf2cb7d3fdc58042

SHA512
5f29c2dd429cdfcf2c87048a0eda38e92253387b64f3db85bf3f99d892164d2da41531a425b34adb6be9d109495e98f8640710b2352599385ebef3c82f2a6586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95b195f10975aba96a6bda7fe0398e1a

SHA1
0792db332f69061c7d6fb1559144d1d20ab10ffd

SHA256
082f7cf425887e756939c4fd3654c75b059d5cd06c88d624d987e5d017c5af25

SHA512
ea12c6b2e7b8a318b04a5bf07fd8d3511ae3c63e89650603fc45606af1cf3c8246bcf6ae581e4da27cd104acc2fdcfc81061ea3c2c7bb71d40731ce682d0903b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cdda9ee5b483b6e6722d5659473e419

SHA1
9921f986f6818c8978ba6bb8e70400ba0a353231

SHA256
21b0a742859f72ade7de654b88a3e458631137464b8fd2b80c69dbfa26ba11e9

SHA512
888479f59c7c442781a6ccc57e8e52dcfac4765d75574f8ae201d0e9e97b0effd743961a5a311bc50c15c801a493a451c3cfef42192f2b461129c255a9b14af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
342819bee7f05146ae9c5948bffcbe9d

SHA1
19d3930715db64a7d3038312f60d399b8fd94710

SHA256
e641263ace9f05886b1ecd568d79ece6e5694c83f251c87b54cb0be54cd7da85

SHA512
64e7d1f9189af2347ed3b29628b59e5754c1b7bd5d020b0bca6db785ca2c2f82d6b4f71c6b5a8834198c683da423ecc75461585988656149e8650b326afd67fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73ea1aa44e18dd8bb20856577395ceef

SHA1
52dbc95767233beee0c73d9c8079ce7838ae639e

SHA256
ad1b9d4fd0e6ce173f2c77f3889fe07844abb14ab70c32cdde6581f83808dbdc

SHA512
6850aae412767d654e5b0efa7b9a95c9a1da93f4743ef11dec4b30486bca11ce4d95fcbc6fe97ed7da65185f7f10f62cee6e41485f1e7a0ea8abc7975c59595a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d68ab3a1b7b3ad00f18ec5ab73d41610

SHA1
cb783c1b2cf169c3835ed2cd3e6264d4e97b9705

SHA256
d435fc3c9cf86b733c1084219910d20a888b48f5b932d4f9f387bfa1b0fdf16e

SHA512
4c0c0523a551b3b3aeed66054816f89796af3a4247fdfe140a10e03e614683ac976d483faefbc0b277525884fbe128a7b7c276fdb0e62244bb2598b97df26a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a001c8a983b4d383f66e516073ea845

SHA1
dc8c66d4a3633447cf76212858179a16df34752d

SHA256
93cb021398487d2f284f53115e79d6b0211a3ef2b5df171f05de9d81b73149bb

SHA512
3d807db09df1046e11bbe6255db5df1785044bcdf699cc8b63b74114c05edb9fac8d86d36b881227deece3494bb5a22567507378ad7334de2f54ba939735f448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc6d7ee5a6a286ef3f8c8246492e9cb4

SHA1
dacdb89d9bd3aa8bab8bb356e828dfa97025027b

SHA256
0be14ed3f653ad0f4837971e9198c1884e87cbc9ffe07e0d7539414175a8644b

SHA512
42c27c7323067956045ca5b6fed3db67e18e36a6f4d8afc4a5f98a3ce58a2fd19fe7e6c5d69ce9bd1e7f7f9510fbd9db2ea821e2b3b928f4ff1aae6d9a222c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a84e9010b5d7f3b6e0e1dd79c0c55cd

SHA1
cc52c4ad672e87d242aeea3f1519ed373b9ef93c

SHA256
0b2a242a37b9baed07a7a401148354ca6748c12ee8b7117e141e9cb5e222ace1

SHA512
7c04fc0357105ffb540a7f69b7aa3c155307bf3e265b867579fe18390702525637cd58db929538aed8b0657b9e0a19ef3b21d6a01ed724178b5a9221739b4fe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf38def724c8d986bcc54b9925ba16b8

SHA1
c447f62d21a7e9ff94ac111e529b7a01cb2d2a5a

SHA256
ac9137f798a95986651ab66315741973186061eb3d1cfcedceeff8d5dc161ee4

SHA512
a767e7a86d26be603b8fe7f848132af45561c29db2b8652ec0feec2b85e574a6eb9bcc70fdca2356159257df5078479fa72b75a3b4d2850107acb2df3eb5ed24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b6b92804b038c0b1ce8f12dc853ea9

SHA1
911cb0d44ea065dd60a61fb07f329a9c6667f877

SHA256
bb3bf6b3f6dd72230d5624d859469364236f2f8f9e6722aa46200c0982113b5f

SHA512
ad9de008c21f1bc07142b566d362b2daf0c41ff73209d88b7f2d1f6b3c09660c165153766f9c592f803375f31283192086622759653ee1d5a9c281fef38987ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06e7c16751ceb1e5354646df660d0e7a

SHA1
356393a99cd98bc68a4c51ee9e854d2bb74d9f9b

SHA256
5b537add72e736240e1f52fdde749405bfbdefdcabb59a6b27164d6514b4247a

SHA512
4efdd7848f68815ce4ceb7d4a0c95c7700defb5c6da990809c3cd25d1a46b739f6bc235586cb51265473aff6db68d107b74fb94b9f812a75ac5f3af3bbbde9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ffa176c3c29c37bf501fda2e4096039

SHA1
58463c78e298c3ff435fdd14b3294cd855554764

SHA256
90e4c68e8df091bda4b6089856a1996d72d252eb6b95f3e150ce8a2faf491964

SHA512
be9651339279bd3ca51e3abcf12f6aecab2f9152fc702c3b5c0c535e47d6268f476c01c9d406219314cdff8a3e87556315bbf45c2a749d75cf9a2f77dd283529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef274d4fea9b992f98784d975c7bf8eb

SHA1
2daf99495c6daf04791455d0b1e8a41bd396e402

SHA256
550abbac392efdffe62911d664c988f925ceda6666c166cb4c448e4f2daa7fd1

SHA512
bed6e601b40b53875222b231918f3daada224ca130826e47de1ca78fd36355bbe684e767212f32dde8dfbb8bfc3444bcb45ac30b3012af49fafcb347abf16c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca28f0b51e28620901dfaaad7a638cca

SHA1
7e59b393a1d70d3e901c259d2fc57f33d0fc6704

SHA256
c3739836ce8721915a8f95bc06f9b09c364730c4141c09d859c9836efaf1bfea

SHA512
e10d578fd95f1777ae262e82d5bac9ccc53cd1e67f27f7ed2d57f5d941ebad1997cd6bdcbb27fdd0999ef4cc6103904b1bfadeb5aecf8f8fa8aba1c694f73132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dc1888e8f7c70a2e2f504cc494244c6

SHA1
771bb85ed1336f7a498936d1c69957a2b510e588

SHA256
d6f8437ceeb8be7f052504edb0062b08af71c5ccae5400a6205e9f538292f0db

SHA512
8bd7abf7931de37ba2e86a2ae8bca21a36945a9925df0ccc2fadc4b67b5acbcc4c39d770ce513a025f0f492fdc7e97f509f919ef18026c9836643e4538dcfbbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22759e29dd1193037ebd24ebc544a7a5

SHA1
ccd11d38ad55164d29b3ab70596800a576ed8655

SHA256
e3ce6fd31440493047dbaeccefa649d194a0fa7dbeafa2c7e604fefac260bba6

SHA512
b0413db34d25bba0f802ae5cefd758bbe3e16e720e1ec89a83e851560a0fa21ef50ee0e9796ecd668458134cee7d1b4db7cb0ef5d853d47ff6d61971bb2547bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C27.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C88.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit