a2b68edc1d9848da999f8744c00802171a6617561dc4b194d0b9e5ae17370de6

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a0e61384b3424443627dcbd1e65ee3b_JaffaCakes118.html
Size

1KB
MD5

2a0e61384b3424443627dcbd1e65ee3b
SHA1

ce505cba9046e9cc0cab054930c2d62711c40ff0
SHA256

a2b68edc1d9848da999f8744c00802171a6617561dc4b194d0b9e5ae17370de6
SHA512

08f84c702065e555b91790c4669deddf30dd8bdcafbcc9e1f8a6b6536483d200d684b28fa980f63046c1a0835d6d29f598802b121704f23d20e571589e3ce6dc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000f2d6b9d8b9d773aa1589cca2bee619b183a80a395f9c2e3be0b16425bab44db8000000000e8000000002000020000000eda0c28931cb24042dfc35fab1a0272c8820b429bc16fe39bd8d23abddee7b80200000003c9f1f283af89922dc0ae442e59236a2634fccb6b7e92b896e118ba45cfed6a340000000cfff7fd15e639e58cc577807c9e3e8d17d4b10503ae790ccce992447a2b44f224a9a93ed2b818c71ad68994496db150c7ee3373a02369878df2dd7b8afe4f078	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{022222C1-3CB7-11EF-9A38-5E92D6109A20} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000021ca0a766fd5720bad28ca4a47f8375a03a16aecd04fd2b76e894753fb4afa1e000000000e8000000002000020000000f6ef0e06fcde46b8d8bb17222422deda7adf1881bff0f35249d5d13008acb45090000000fecc62a6c0c1a086e81870c7447538671bd7d2785ea075221590ff10fb9a122800d7e51de9431010e6fa1f33ce1e3acbc6b7459711f4f4d47307a2aed44efd29d9f87ba581b4d9bc8564bb9ca580a6dd6c11717c586b9bc5439cffefb5fb604edc675f5ccbdc53191aa6b09f92c71605802d64b4b2521c04bbe556f91fd4de133468f3f6d8374cc85d3287a999691b4340000000cee80d97ced4771eba7322a9c1dbca8726692d0999eca32f795276a8e36e2846570dc1baaa92fc161a9465b9f807cc6524270a8a58108d05797ffd65fde9fe8c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501147d7c3d0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426556095"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2984	3040	iexplore.exe	29
PID 3040 wrote to memory of 2984	3040	iexplore.exe	29
PID 3040 wrote to memory of 2984	3040	iexplore.exe	29
PID 3040 wrote to memory of 2984	3040	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a0e61384b3424443627dcbd1e65ee3b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b388d894162de0eb0e0378f301606e6e

SHA1
a0e58e9bdce32830597231d73e744f824fb58e40

SHA256
95ab0c00013e89ddcc7ba0012f3b7ce3fe592621ace5841c884b87cdec755498

SHA512
ff033517c1a5b5733d00a4b11c6dd4c702ff4a98319c5058d6c74616378411f271254ff7f6700fca9d182397b7ac5865138bc402b9f741bafdd0518a00982bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e156d54a9e4f3022364846a8eebbfff1

SHA1
94ed23b38f5756aa5c2fd8997aa443934e1011e2

SHA256
b578ee7fa8c69f4f5b4e90210442bd75154c706918770d1223a3c9ff2a81b88e

SHA512
036b2dd07f05537e7411e2cbdd5136eecb335e1a61042bd7dc6ecf3272d99fc08d1de8cf3b1a8e54835fb47230c44a8fd0151b0a147c46cd463c4a7c574b01ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67e124551277525265a85aec96a4759d

SHA1
1b99d3f485ce9aee6a225ecdad1e4ea15977f8c8

SHA256
760429ecdf7092efa2418ae13954f68e94ba76c0041d00dcd85c3f878c9f2424

SHA512
f1f7d85eb48d1e871722092afe701f85ea83e9b180a1c4e1972b0e449187c666863bf9c1c741b0fd67c098eda4054634ac90bd5eeab705100c7a8bd07f35fb15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80fbb32cd5ce6bfdde5995e745901b0e

SHA1
8bdd5ea0616407c667a11dea200c3f165f540d8d

SHA256
0ab595ea63b5a5ac4ff7ba8107306f7b2682409dcff25b51b3fa115e1c5bbb35

SHA512
5e41246fdbe88cd79faef18d41111d7b400e7a5cb54a1770036380b01c067de988344c7911fe83f34dd834359127b33941e2ec4e96599688d170f8d9c05bc57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d564dc74ec52e66129f804ce2fd1da

SHA1
3624af19afecbb743f73cc9221f1560a3310af78

SHA256
1fa21b4f7644a31c20c6124c75b4a5c804f294bf7b44c987fdd53a2991074641

SHA512
94c37e40bc4d28d50c5aa871cb0a33846e2b33e4f4a5eca48c16cfc9266d94cf8047c0ee42da244d409f5bdcf383302890ff3a9e09862704338919be45fa6f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb7274a38a4df3f17d87ac0768653642

SHA1
d3e62eb7b70339ff2da93b5ec7c787a656e858e9

SHA256
14a554e584120ddf303d058d79f1a9bccb74eb1ad5aace9693dfcf77d85648de

SHA512
19a15b9adaeb22c37e75577aeff77565b2a261b531adbf9e10306843a06c54517c73731d994f4e03112f7818f8e003def9a69781583c1b6621d50ef77f5bee68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
741447d4517c4a2e07e4a36051042b5e

SHA1
865e85ecc0afd0c9f229b54e9d0d3a04bc2cbde0

SHA256
9367dc003a9911ea3c6e03262babf579544d92e0cf5d19ce889ba9ce92a0a0bc

SHA512
5ab54866233bd974a9565ac8f502efd96206f2b6e80467c01a622060da311f69c9665e95040aaff3b2b5706a114f52f6390cc3394826fd7965bafee3ee426a0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcb2b9ff58f478c2e34d7eb1c2137c9b

SHA1
b16369fcca940b9a4a530bc85ca2c41568b57287

SHA256
f0ba3abaad04bfbafddd0acdcf78e2b1f1a32081907288d2c7402e56121fecb2

SHA512
3d37c3b4c4a465589d5bd275efe5a1274c4d1f3271b76ac0fc90c040ac45aa0f3ff2843a7ffd79b02f54a37b52bb88c31a763b800fb0e9c1c0a421e5242ce63e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fb800589ebc8b77f73cf3a277975091

SHA1
6747d2ef2c99a35909ceaf43da1242ab76c6064e

SHA256
c1c7b45877fa22132cbbb1e9084c1d7c1898003c3a759cae46d01876022ecf3f

SHA512
deae93754da8f38904868b3a598fecab2e4fba4a94d95c5dd49a807835627923ed3f67c4db4de05cb38db934192b67d5e6acbc5cfca3e38a3aef1f7c39ba0fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd576fc35cc024dfc5d116b9b4196421

SHA1
50658343a1bf398fed5b824062968f0157d92816

SHA256
a1f149bdb148a3749968d3f9bdb873fe71ce38bf9f357cf1ca39ae59a10255b9

SHA512
a88d0bb3f1e00d02ebe39363fff8a0c71ad8cabb65b814f234bf1db4b0a0b310e104894a085ab6a0f69dcbb8f787ab7f58498ecdf42b88b756438849d0064045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ebd5cc6ccb584f84a3218089c18c0f6

SHA1
838a4603a957de366bbd088ce58fa51ed5774e96

SHA256
9080fee9c0f54fe766d1d4c4148a584c1efb118c4827a82559ebf25bcafba902

SHA512
9b3609606c60d48a96b5cbeea4709b02760fe114f481a8a924679decfd187a0b9c5f00dd25fafe9a0c15f46392695d3fbe090b3e66adeddf8623af12b3e91888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0257747954d96062adce94a8c3b02d1a

SHA1
8e06667a2cfae2a6d5a7c2a29e30da8f10c2ac60

SHA256
dbc19fdee8a28492786a8e0fb2f2276fd664b12409b827925ebf0dcd006dff2e

SHA512
e7e662bca782cd5c8881501a3b2c3d49618387bb75cd46aa055501e6c6cf7abe7e9842d2db0df3ede73b20c31719aa8029e4ed61dac25fba92ea8e9323383b61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25776b4550eb410b2eacf22d86bfad30

SHA1
627c8de4f289581460fba51f588a5f54a5df6820

SHA256
d46598a14aef5a3f346970d7dc7ff6714ede25dc51f6ea0f0df8d5dc2a697385

SHA512
7c302bec962f7af043fe5d801fbc9f6dfc718632fc0a8365dc57fe547bf9d8635634f0f17acd8a57bd9d4a2da0c726340f62b46ce12159fc5d68afba0a6c86b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
784401a049903fcf11c705f535f7103e

SHA1
d94915ef61aa9d718dd3859e76ed50cc0f32d7d7

SHA256
c47db2ffa79e2e670cf6bafe7cd965a09b9d0c5cb1b467fa51cc4860ed49781e

SHA512
997a14db1485093679bfceb71c3c3dc93f04c33626dc2deda2cf3ada594e2cd6fe1f3d39770b073cd68355fe439471f25b9a0a3166c933823db30dd2ff03b409

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab372A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar379A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit