c7f5b7197dd363ffa9d629c9cde940cf9dd338b88602cb82915115974ed53eac

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2cbad001299ce9b4f91c07444d94286_JaffaCakes118.html
Size

359KB
MD5

a2cbad001299ce9b4f91c07444d94286
SHA1

6295cb6c1d4e80b1993cf95bb1eaca39a5441b99
SHA256

c7f5b7197dd363ffa9d629c9cde940cf9dd338b88602cb82915115974ed53eac
SHA512

d21610d4a76fad0b9c2ac9601fa144ca7599cc4045867473bdf0d9a5f316ac52c5f374bed7034930a790a4fb8b03e7dbc6e8f4dd1c89a51dc461c2fd01e2ed87
SSDEEP

1536:JbEM9V6fY7OLEuZmIANFY0b/9KCkcSdccttUVNiLtBErW3Etddd7NLdt9cltdBFN:9EM9V6fY7OLEuZmIANSoQg4Spwt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01c5c3b1bbdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002331d27267f2c34aa8271d661b1c2dd4000000000200000000001066000000010000200000007c951d0e59a9a4be12b2d221060d5362d3f0577a79be81d00c079022c905df9e000000000e8000000002000020000000ac7d82d748737ff7a6d9af66b518a021907256c351cf12e2ff1d64d019614fca90000000ea6b1fd90c1ed93cd04db6f677bd73f7686800c945623ef3bbaef985a2f9fb417d8f5c231f71b1da4b000a5792f7f37acfb699683b3d16c3c75993627e29d507ddb4d8d21fcea19b7ccf46713b673e8406f450206fd79b59c499b85944a35e8acc20242e5a7411e2d38de7a9687993260fb761dce4660b0024105a8bf6baa7c68ae1d2ad4e58035f786b4d524be2b4d740000000debbbd8c133c17ce84d148f4d2e2ccef34d4e8b438e1b3a0feab0d68b563388effe35e129b72ba581d09776120f6072154bc42c4a2b783658ce6f16920f84983	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65AFC611-290E-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424394598"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002331d27267f2c34aa8271d661b1c2dd400000000020000000000106600000001000020000000b220b246b04f7acefb1a66ec62b9587158131d196b142e30be4b07d23715eb06000000000e80000000020000200000003caac01eb620437ebf28546eb4c2b6df317b3c6ee41ccd109d71b66ac1b2f632200000006e9d85500eee60b058b7701d98b60590df1eb8cd7f43fc27b38c71dee45744b240000000b3b0beeb07d36cb5fa6dcfb1ab4b1fff866b825057e908059daf4261527ad1c402013fcf01afb8263596bef4dc3c43b74e9a365fcb700b7348689c389e7b132a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2180	2836	iexplore.exe	28
PID 2836 wrote to memory of 2180	2836	iexplore.exe	28
PID 2836 wrote to memory of 2180	2836	iexplore.exe	28
PID 2836 wrote to memory of 2180	2836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2cbad001299ce9b4f91c07444d94286_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d4af66c749f3aefc81f73f5597c6271b

SHA1
9ed2699bf04debcd89b89761b826d68c8ec94022

SHA256
4f9b663f88590449145a176c7cb4f1ec4869ac4337a320143baccb7ef24e067c

SHA512
8bb54021759d13b1c6a6d39cfe5f4d354ccf7837706620ea9bd38dad1e402e961aa43718179320e2a40a6cc066c8f2495a9e9bbdf4d731af19d3807542eb0fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67d462ff5d20f8e53e3c83dc925fe8e1

SHA1
064955739f02e0dd588964a71c192544e511d7c6

SHA256
88d622229693c734d660f170645a4f0353b1ae9a1f44d43e3b754583cdf7a928

SHA512
cac8be7caecc8003d366edd6b383c30ac6917d92db67d34b913bde51ca4204622b2b4fe2593334861620b7eb8e9768424b48f2721b60bfc6fc3bade6351a70b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fa2460117ca90edbd3aa6f443d6451c

SHA1
b826ad7ed3ef240f5eb15080944dcde060a77c06

SHA256
b35c602c83e6d4adbec547a594dfa5bab7859d7519f5af866032e5fa5492adb4

SHA512
03191d960c6beac05a2d3b158818f1b8e3915b15598a4a3908286ae71d7f70e59cb7a49849c5061431660d6b478c7db8d790127855b4ce16d579b02510d8a8df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ddcfcd6747c6e2445fcb61aa4940590

SHA1
1df2985ad92059b4c09a944b20cf00b9b3ef14fd

SHA256
4680ae310aad6b6e5292a742f93594dcd1463cd3082fcaf087e1188b1bd4d3f7

SHA512
e1ab461bdd5fda4dad88df687604ff69e7d88246dfd7922dab5dba77a6e31186385cee5fcafc34db94a365de3eb50be6f97f5eba1aa52b1946620856d6bd000b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d05cd3f7fff9791977483cc93ed7b6f

SHA1
5d260dae1e0515b171fec5abc530ecf0d753756d

SHA256
be1e374ab0f6a03a116cbcf1b814960e8505f202945a010e51bf6d5a7ce0286a

SHA512
b76e270cb140e335a8d708e1772156cb2b57147f23da57807fd9d0894f6f98bc90a1bd861974a68d65fcd1a6689ac721377104ff5ecf5d1bec5f4d21afcc0fea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb6be7cfeff01619e46d22e2b1d479df

SHA1
5366202a30eec9331d0b173b1198e76c7816d6e8

SHA256
d92ae8753bda9d66e6d9071ab66b903eba892c94f16427deaad46052ab2b5c24

SHA512
c9852b1e4a6564ddbbf89721bedf6ff413e377f8d88b5a04ff82f99c4a29a97a9c8a7eb8cce21ebba9304db711aa55f469d1e26f56863736306d98394e84b2c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82cb097b7d496e07690ba79552f1b59f

SHA1
9eccb2575858fba8cd05b30b1715b0b17ddc07b4

SHA256
c9fa1f29977c3d7502783025bda58657f697ca040333b434681c5cff5f0eaeb0

SHA512
5c9fc05ca1919e903b20c070f07cc105e745378c784617d8559d58ce589d8bbcafade273d5cb42be26162165e9063af42b100d0aea41aefa15b5c8fc348b7618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d67a7d9a2499acb9d107f0a8cbfa2ca

SHA1
8779e9ff91576f7b7e0ba93015a73e32c2f65810

SHA256
50e966bb55326d8a2ee5d3fa2cdc4faa214b0cf49345fbe60466a25e366558b5

SHA512
21ba2707236d60d19396d571c9d594f17ca295aeb5b5e7c5b0a62f02a3b478d056492337834473507823e7f27eeb0d45bbafc462b2e3f5cbe64c0f2d1f7e20f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f424aa527ae64b816b9c0e818a64b9c

SHA1
48c6fe05e6f622bb386b7fcee6afad8c1d1d2d73

SHA256
2a2005bbda409bc0f684696c7fa1af4b17d7c912af87b9b6cb8aa27657ce050c

SHA512
5bd5c1086222d89dbf89725be62df582141abc9c5e5c0aae6576864b60fe7d0b474233a12eef8f6c15299b1b9e16d0cac36db5bf840c12cffb03aa993750c3c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d05ff5204e29875866ded3e5a50fec24

SHA1
514527ef67d3c607d11dd626acc00f61b5b69dc5

SHA256
02423c8205c7dfce165e90aad72609096a60fea5cb3bfed6e06f9ebac33a53ca

SHA512
bcdea2f7ab9a24c95142729c864f5b44b873a23f09caeaa49166c548e390bf1dbcf1d40384a0e5828422a0df1e707a0c4de65c34602e31ee45e31a07e3c2c4b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32da62d0e4ef89252f5c23aca1cfbfd4

SHA1
29dbbfb44cc3c00ba6d0b1141e0f97891cdd5297

SHA256
b63dd36f192e1944d651fb66e1cb7095ebab97dd3fbd708b65cf10a6197230e7

SHA512
b20b873ab37bec855c816b9cfa552375fc0adad924827c9d4f81ea8aad29a79d978a1f063bf34ed84a09a8ec2b93c0b34dbfdd01957fb9d8fa7f291ec83211c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb4b8144683401b2903ace77c59c5e84

SHA1
fe88cc7e021ff398330862b25fe72ded6203b36c

SHA256
433db97af52177bf901b586ddaae5b6d39bbf8d2d27d65bb24b554a1cc42a191

SHA512
878bd489c79950ce8a80ac0e60b0830b249fa66f6a97872d9e690e9929b14285b56496a537dab4f158c6b7e00609900865ac0d7b7877062a93a22580e4aee546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
67ef9ff6e447972e5ddda47418e65c79

SHA1
43bc05d2f8e19e624d2c70764439a8a60624314a

SHA256
cfa0bd84e8d8fa9c2787e5d7ac9d38c867aa350ecb11556322eff75bb078cba1

SHA512
afed8b6e1e19cdcd567bfacb57b61c711b44415d17e74c2ce590da314054c562a5821db5e76a441215005b4c39ab68b12efe5e78961e99bacd21885825a87737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
95b89e3be0249c510352ceb0e3228bda

SHA1
d1d39a377138f326cf5b5f346d58c2f1801ed51a

SHA256
817e81690a95395fd2b047761927b80e20d42e7d1f7ecd187ee085d14fc14aaf

SHA512
ef40cd5c4ce5046089bad2f5b4ed002679c190315db62a5e1503f08ff58cde3984c12461bb95b0a6b304f4fd30811bd2ac704e548c6e297d57fee186d585d34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar244A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit