bbdbcaec525bb6ffc8bc5dd52bbb7b81e0b5e6ddb0e48dd89c5759c1873880ab

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2fe12c83dbd84231406e32f8cb884cf0_JaffaCakes118.html
Size

460KB
MD5

2fe12c83dbd84231406e32f8cb884cf0
SHA1

363121ab5919f52918cb7940438e518f71273ec0
SHA256

bbdbcaec525bb6ffc8bc5dd52bbb7b81e0b5e6ddb0e48dd89c5759c1873880ab
SHA512

096f94aec0dcd75aaeac6319174303823076c460c96baa49be6881223161fad64d3fc1198cb8e9870b0e65c951a3c2f2b16d5e9e4fa5bf0a73d0ecff57416e9d
SSDEEP

6144:S0sMYod+X3oI+YzsMYod+X3oI+Y2KsMYod+X3oI+YLsMYod+X3oI+YQ:z5d+X3F5d+X3z5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008a88a216bc75187ebf4df42ecdde9cb10dcdc8b914cf301a10834874ff56487a000000000e8000000002000020000000a0281866df45670ca03759f11eaf1da9fdbab18f78e61bbddad9c0fa4115a31320000000815b66e8e13f0267eda64338b79bea28ee497952d9306becb1aec3c3e53ac9b940000000e1efa9d6ea155b88d689f917a2198f2e43bc941c35dfc655347adf0505292892e15fb1d874f4092fb7ba31149e559c25e5cfe26f7a6596d5d2bf083f3bf20e19	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000dadff7b38fad53f069eb61f7aa61efa2d8a3032e66a2d3caa0784d8211d0a1f8000000000e80000000020000200000007f6952cf14526bb18c7b1316fa9d5f6ebc3a3db8e1b2c1c66e0af3c17152c7cd9000000018ad8b7935c128114373a73f5cfc0ad0f40a0743a14d1566198d1b549e1b9dd99dcaf49f24cf218b7a17a3c678e0c80f9228474b26dfaa3e80a64563cc271fad9d958766e43db214db1580602d3e32a4f318921713456364a3d43cb2d35663065dd0d36a6cbecd2308b50f111237ffeaeb72467a81fb47cdc409ed829c8baea6954067816aaaef44c07fd37fa83c38d7400000003665b2e9683ab76bcee986d4f5c88ee0e22fb9d311afbfbb0cef315419a3ac2a3fbd0b4ffb531ed9ee199070868639eabfcf29f4e7aeac0ab5c0a7553f17b057	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{410C27B1-0EE5-11EF-ADBF-FA30248A334C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a79619f2a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421518195"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2396	iexplore.exe
2396	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2752	2396	iexplore.exe	28
PID 2396 wrote to memory of 2752	2396	iexplore.exe	28
PID 2396 wrote to memory of 2752	2396	iexplore.exe	28
PID 2396 wrote to memory of 2752	2396	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2fe12c83dbd84231406e32f8cb884cf0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf9ec65cbe49a648cfd8b23939e012bb

SHA1
a53c470d79e0e2153786544fbd699dcd456573f4

SHA256
b543e60299ee73e327d155e515eb01c93e53be24cca98b22b09cbfc7becff294

SHA512
2e641660d60e7b7bdbd1b5c9eb7d3b99648246c0a5b18295fff9b16f3c17d31accea185beda55b3f821445174420b897e1143b3b13809ae951eff6245d110675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd77aaf062f823451a1c3626ab1f0577

SHA1
8a42bd665a38115cc2ed95c7516e72bd436f286d

SHA256
c27f286b6e3d8bdc3866db4452f1bad09e3e5fb4a2f16542b62191e4fa5a1ef4

SHA512
acd2a1903101537d077ebe0a4e2bbc9ffaff15d89988ca66d77b83179be73d065bf05ffc54eebf64c107173dbee46d9ef26e1400a531e7580271fbb1f8aa1c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa857b314bd3650821073fdddaba7493

SHA1
b8149196c60b1dba2f0aa494cd23ac667d00fab1

SHA256
a074b55b1582e23f6b1813fb01f64273e5a4f566d15dc8c5273e6900f6034ff3

SHA512
6a3653bfd968ab8f5cdc68ce5cec060b25c4dc89ab1b9c9b25b370cadb4c7d58e674d4d6696411f46cfe79659333b04fd037a75654b9a7890285d69ea0c775fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6640c3164fc18a4440afe7966fe44ccb

SHA1
fdd33af01dfd8ac2d8264ee0185d87f3c6e1e1be

SHA256
7ed2a3aa024249cf44165906f2b164a37e452bbb0c5d98e39e0ff59aefa19dfa

SHA512
e82c46fbd4935085be965aaac4c59852153cd2dc093eeb326d4b2b8e9e47d526e27ec9cee96b344dee1649d6de3b0936c3d26f85d95aad7dd8adb69e77039e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
786664adbd0fd1d686115742596a57d9

SHA1
a4487fc8f6cecbdcbfffc35429998faa76614aad

SHA256
c6f2b374927c8070407edd1007460e8bea9cf1b325e6988085ece913b3ef74c1

SHA512
574afe4a8265e56976ca359e8aa3d5793a031e500366bf057aa26f6b96f61e1fa8279799f2b35c0e0b49fa4e98844b8805bdd432eb97f445f0a309beaa24bd87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1e79e756e2d3843c68176549293f133

SHA1
d8aa1cd1ff656b9ba32b5102c28f2e829d9b6d0a

SHA256
29aa0eeb3c7b596edb8a3640d2fb0c378d1f8ed5dbc4a268eaf6404964b96e92

SHA512
be7777994ab65df7aa4293c7fd3b9ef0b4684e4476104daf1662f312a159c4e27b434c4dd8d171ba16e709511e1b34238a20f6c48fcdcf2e81b69e0468d1f291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d5b577820933e7313d0f6228e01b303

SHA1
ca5efb8ba06a2181b71880790aab4ca307b8adaa

SHA256
80b4a7ef8fdb6e58c60ea7ca511a969b4aed1b25532d01118a9896becf7f2dad

SHA512
f66c84653a029bff103b01301abbb68dc88ead7b7f4b61d7c7a0fa796be221cbd4885c2f14b187c9b4b0b9c74d6b002328a6302a1c3d510a93e5f1ac0f719cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf9d063eed2cd3ccd868f0fb4c05330b

SHA1
9ded08421217cf96fae98a1e46ae481dcbeddc65

SHA256
e58e1cfcfc82262f2996f407cf9a1aa482942f8ab9a683168ce6ff3e13b49f26

SHA512
cf52ed4cb3dbfd820be4e686bb14c7389718a09d062e78cfdd78ccc628a5ac7b5ca46d7503a4adbe1577a6b21c8c29d111112a346fb7b236bdb901c75adc8f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
364f377b91cec4efb65692431683dfc4

SHA1
ccb0fdf93920f288e84d7cfb7324ad4de4e3483c

SHA256
15298aa42d2b9f61ad79651eb58f307f96e470fa05fffdff7f90bfc2e92ad788

SHA512
b753f9cca6533e8a2b6969120c294f9d2e5597756af5fbbba3e13c84b4fced11fd0cbd392d7b775eb7b2b345f4966b51bf35ac6fc6076f27ba7a63d9a61938ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee982034f0107444c76f015d2bddf3f

SHA1
6c99fff56ff4a0a2550ca1c1a4e711f7de06d912

SHA256
4def1fc4244578089d669f987d15c8d899bd8c2724dff60d3ac3d16b0aa06120

SHA512
d5134acc2af2e5e6a414186e85c2bd70bcec45a8a5a3045b1d4ce3134495e063d407e38138aeaaeca5debd54b8bef09a62bc505a14f6fb42250bed82e5d877b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3825549772ab095b52921f2078e948f8

SHA1
b338de895465a2ecc5ff668b7c56eb77f115afaa

SHA256
98e9748c583b26e78b67037b5baf9e51b89f7aa72fb610c741f28f5bcb28b8bb

SHA512
6fa1af550a2dff9699945e4b186e5dbbd6ea29d2b8d97b2f7c94effed3f3c54a632e8082ff5e918ec23702722b4343b4309a0c592924170ee53898faf7d182d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3ffa77e231bc53a0c5ee042076113b8

SHA1
9fb7f4ee42068a8bc3ebed2ba7a29f8dbb103a8a

SHA256
d173d912dbff3cf7593816df5a6bd5fa15dbf2ab4e96a1de6645b99f61163839

SHA512
bf8d82bb2681ecadf373ee2098207a244d0769580297d5e531a568575441ee5a520a52403a57e62561487bb77dcc7229684f95b0f9fa61674cf03fbf5ba337a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
796532c112d9afbc769dbac60e6a536f

SHA1
89bdef9c8d515adab729a75ac576fc3b47efe34b

SHA256
3013620efb004a9184151d53a0908bf803c486e3c5852062310eaae656911def

SHA512
ed1517048ef9abcdecf41149ed4e1d54d0064f51f7502019790d9cce4a72ecfb41dcb393de85049fba11e07ba85e6e8e79bdb36a2b77bb2260a9006f66be1699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf27adb89be714d93d13ee9940c33027

SHA1
11a751557dad941f16f15fb63c1686fab291b03b

SHA256
7e57fc9611e50a21cda8467c3988d3d49e4fe9a8d881b197e21cec14d229f152

SHA512
3a40c3ab3bff393c242f68bf6f3186fd117fe062db99211faec9a06f41a6d0432d72be9f31abced120d4f8c0e268b2324f1a2820b7ea7db46fbb611e92dcb0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb8badcd740091dba19af60ea745d13

SHA1
53c0fbb2accc6cfa99b10be75e25cbe30d6e64e3

SHA256
0461cf025fd41e89a00dedd2a270588a697baad8dad4091f570522e1203d9c28

SHA512
eafa1d5a7d650eed486b50dfa4dd741f3ef026810ff70633be62c8bf884d0a535e1571d0f1b140577d8c2c22e8ab251a85b10838cc574f243e2a18d46bf7e5d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DBF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E8B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3EA0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit