1f65640d772c8962d40075e87105b8cd5dc604573e3fe79963382758d2e74c77

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ff070a51eb2ea7b643877640aa3ca40_JaffaCakes118.html
Size

461KB
MD5

2ff070a51eb2ea7b643877640aa3ca40
SHA1

f57b31f94967103b85b267ffdfde6582153a97f7
SHA256

1f65640d772c8962d40075e87105b8cd5dc604573e3fe79963382758d2e74c77
SHA512

139d4785acfb1906dd1f3f08772a38ba95bd7ac072042322d2bb18a2dac57d9224bab4fe8371c217089cefd9d0f2feb0cc40b03df243703d938d2f4bfcc4aa6d
SSDEEP

6144:SpsMYod+X3oI+Y1QYsMYod+X3oI+YQsMYod+X3oI+YLsMYod+X3oI+YQ:O5d+X3b5d+X3M5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b091cb33f4a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B41F451-0EE7-11EF-B012-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009f2f904aeeb77bd6a43f3e8dac8bdd73d534606bf57d966d6a250158e29c63df000000000e80000000020000200000007e7a9844fac5bfee32508a4dff2a3b1cc65becd3db99b9ae239cc1f8d9c93fd220000000c2989da02d516794df787c559a23ee9255d9047beee1307b84a5e3b258f4bc9c40000000db8ea7df898395c4eaefc47a7923742313059c2d11a3983d1629bc095a656d9393a498bda5bbb7fc1d13a1a0e29a43cfead76c1fa1fc305f1b8859e68dc42b8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421519097"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b2329a97641bf89a925f3bb4bdde3f4f62ef3ec3b583820943d35bc5d65ca633000000000e800000000200002000000065d3c3e059592c0c4af7096ee99ec1ad6d7af1153770eb6d6fd24a132826aff890000000903cf5431f235ae5a4bf2138291b3a22d4484dad2e6b11b46fcdd980e7f4513ffcb570e3a26a6e8e7fd4f1837d0cb8a8043e2846167892b5930eee1aefdcb48d4252d41b1ac1f168f64b5396559c76a080578aa559877795e6633260bf477816de83a3266eea2dd6a085afd89c1e182cc4ad64f2b9e11af22b66f687aa96f018fe1c79d068844a0dbde9591ad934d56740000000e4cb728d4cbbdb9b825b4b2e43a918b51b6548223aa0c3a458da8de21966cca20ea1f05cde8be8210712de7417a70c75dc8bf1fa2053e76cfab1cdf0e073fee9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1688	1288	iexplore.exe	28
PID 1288 wrote to memory of 1688	1288	iexplore.exe	28
PID 1288 wrote to memory of 1688	1288	iexplore.exe	28
PID 1288 wrote to memory of 1688	1288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ff070a51eb2ea7b643877640aa3ca40_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9a3b538091561a86aefa44bce7cd41b

SHA1
45e16329540cf7e35e92031114417c91a6f02b0f

SHA256
29d930132b7a78007cf784e07b50a7d55181d80995c31e3ce93cc0f3887de5c3

SHA512
b261bd1590f614bd51edd62244f88dd83152372ffebe7a563bdcfa3a1433990ea2986133597fd703a9bb0788c75fd62a6b0e85cf5cfa9e75aea20ed14828f24b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f40cb476bbd9141b612da815ef18908

SHA1
2ad28ab891600befe0e20cf8298424b6a1f6019e

SHA256
189f7dfbfb789d6bc79fc4ff4f890e242955b0de0b04a82bd920df31beafeaac

SHA512
d978b7f00f21e2b9575d143d1f5108185fd08c7705379b5ac0206c2d5ab0d6199c4b84d237c3470dc8795538112ac6678fe6edb310196c485ccf6f2c2196a972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
737e1924351955ecb82d918516707362

SHA1
79c176ebbc7b552735a7376c7e772152dbde0a4a

SHA256
674e933a36869f7ebd7eb7ca407336114c307aa1ddc00cba77fda6c8c8663122

SHA512
a2e993ac587badf44264a3cb189ccda00b8e451d6f17356a022df27aad923b442a0cd0bc5aebd72aa3f1149dd58a7c872050eddbf622e0bfc4b6b79eeb02b205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98417063d49ce3aea60d59d95ceada8e

SHA1
e56f350ea06e20abf4aefbb29c0c34ba8981c9f6

SHA256
184f747f5ea4c05690a399567cce89b4688902fde6e228554cd1dea1be91b538

SHA512
95c9d4ef790d75a5c8b19e6fd51a4f59d452575020efc7451c42c090ad5e2771585b03dd38da3ab2be9d668c05aec34fee4c33304c1b1c890e96255db063ae42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7f374ee2d1d05b6f7f3209c946bdcce

SHA1
265fc57fdc64a5f735dd0495cb0b026802ae73ef

SHA256
af67f56751631e148393b64f400bc01d066e916c5d86de3ddb5132954b70492d

SHA512
e86ef389853bbcf382398f0050facf760731120202168ce4a2b278341f24115b8262a613d16d4ca7f295a71d18f533b379ab1ec8ebfe6fd5649985d39514b2da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4478ce615f7370767987f092930a846

SHA1
889faf9c097923288b7a4449693fea3ecab177ec

SHA256
c8930979b8c5f5767499aa60c2f2afd27d8cda161e3919ba6f40630909e43aff

SHA512
770b7bd595bc26af6922671336c3e73417026d0a07cf96ff373bae02b725ca7ab0fa389b8cc6a32b6b9c59411848ed1e2b6e2bf875d40c73e8a038a1ffc2217c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1273bec54d94140a665d049f7db11385

SHA1
c7d802c0b5a9f60ba6ee571dfc2040b9e95c4e0d

SHA256
b0536d08d31f0afc02bb269c497ddc70ab10587278ac9502fab3120a4c6d6ed7

SHA512
e5787911fd1aa35b710a1996db87ead6ab4dd9268385565561983a715a16c1b07a00fb3bda86a28f569d26abd4a73409f4e7bdff23c8780573d02caa5f6eb21f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c5c94e72f6258af1233d567b1e588d0

SHA1
85505a19f22e4e08d160b3f509da88677d93f15e

SHA256
0fc011b8bef105cd9f6620102186aaa62aa39089ab3dd440ca03e7bb9d8faa7a

SHA512
ceb36537cb06394e7a1e1c2951212dd4dfbe606229efc885dc084656ad6773af944cd4ba7ed1d6805c9e46c932d8db05b5eef25981e51b41ceeb03f9e1f1d214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1f01e8a811f127b54d2b66e5153d56c

SHA1
ad164d3b1e260728003f361da442387f9b766515

SHA256
eb5e8b748f807be4b47596c1774cbd3aa21a257b2c30e0471122e0777fef169f

SHA512
0bc29dcce7b8f837288dd14c92e4321b15bb3eeb63def99c83295a29c91af2c4c9f147296aa22b7c7a2388eb92cdfcf2dcfae227c104777da8367e88ebf58048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b63050ce15defac51034b3d6186d0cac

SHA1
c150a62477f07823ff938893cfd8d19fab8928fb

SHA256
0c2e73a36b6956b283597135bba8d1e4aedb977e03eb942fb421ff335fa4d813

SHA512
3f05e85840d7f7f682e27a43bb81e2ee232ff5b230d56c06c122d2d20ae60912070815300aa7bc193d0ff9da9123e412da6fb1bb40dba64bcb7532ec0e21671c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93a9922f11b55b82678205e2ae69b682

SHA1
20c8cd320c40e9e61481fb9f453420c9e5c73c6d

SHA256
3292302e97892dfe4dad422a533cfb838928aabbc1313226fd4f6bd4821753af

SHA512
863082dc9d6aac35bf14236b2c506e6ac50a66118b11faf25f89776ac218c04c2851a030d949819b884ec0e5b0e35235211a1c14f732762f6efa1d1ea76bc5ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ded4ec4e66dae4cf6c5e6b963c959f88

SHA1
7348d4f6135c99ea11b3bc138681723f26c5ff0e

SHA256
9a6716c0c038d957db95f59eb0914cad56175e6870c23835a395a2f1dbc39eac

SHA512
07d26eae8491a7c1572454ee479567372fda938f7ce84cb1fe92ccd79e8f183447434ef2300f0344d43337abe277ec8407110f2da5f06db4e4ddee1d23d3ca62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7a4a610a8049d77eedcc3d0362e424f

SHA1
1481940d880efbd8e74aa8816b6d88166d7573d8

SHA256
672a21b634adb3f845bfd64544b7d8ff4477e8a4d24bfabb94cb7107dbeb9287

SHA512
323f7fe4f989f37e639410937c0de463935e4e9f8e0cdc09c64b3bee797bf87e4b4cf149dc19c632a20026a467949cb277a04865fd117ea1ffb36ee96b4a2f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
014175b3f8618719451b3026af61200d

SHA1
6a780064f7404bea07485b90991d126b269ec9dc

SHA256
9e4ad51da86c2d3920e4df1167b8e02737f8a0d924cb5c3a4c0ecc9ee8a1cc80

SHA512
0286219eb0729e0e0ab25977200eb4be38494a48099c940c11f3fff43c921f874359d9447d8c6cb48e4bcf16fdc806619d2c3dfae2e478a9607652fba28af9de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4128.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4370.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit