c45229487d5980b8804f224f04f940e9c824b12afaddc92662c3b736bf871a87

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c44cbda09ebb1292b1d068bce111952_JaffaCakes118.html
Size

23KB
MD5

2c44cbda09ebb1292b1d068bce111952
SHA1

74ba3c181182e99b8ce29ff950cfd0bd695d41f6
SHA256

c45229487d5980b8804f224f04f940e9c824b12afaddc92662c3b736bf871a87
SHA512

55d03db8f9874a29da0badfdfbef94fe3b02206a5d411a4128e6abc0a695b6b8a81ef059a573d38e5f504f29a90bc29698d71d3f43703d15881da03d7d8f66f4
SSDEEP

384:SIfxLTucc5sPoagdXbbec5Q1H5hataEL/J4kKxjNZ6zKe44kZ/lqzRoMy1ncxKek:SyLTucc5sPoagdXbCbZtkzYGHg5ew

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000a3b9e33bedbb24e20e4aa99b20a80794af57c9577207ab1bf3986819a53b7da1000000000e8000000002000020000000cc4a3b9ee2e02b9dc92ec8cf81132e8a5fd3f3fe5a8e186ceace13757f9698e5200000004044a6b82786aa1797b5898438ad281da00eb3bd0041da159a31a503cff33ba740000000f88d9a606444dce8819b7c5bfa6c13e8c87620d492f1eeb062a78bd3b05aee5733e938a6af45f18465b1ca5984490822be4da02327795c7391b3ba356a24ca37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8369111-3D5F-11EF-8ED3-72D3501DAA0F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426628549"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8088858e6cd1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000008be80d91069ff15137993a415f6629524302d96fd04902495c05bb80c9c0d2ce000000000e80000000020000200000005192e3e825b9ce3deae46a8be3fe9bc681676761ec02f5930ae69e280652fa83900000006012415ac5bebf0075553b7ed34057ab7ea9bd00e5b9da9e903b09e2c35ef8b511569632e63215dc2655da676ac086ac179f004b4156a4eabc77e38505994c37d259179c4173b0080ca315b840512e5b79f21c5545521c58116f3b9c90a060b0a3f73ecfc14dfe5d8e5676856a92a2d26c54be43ca6525cb18d9eb2967134a1ad49375b7237549ccb2f5c793619abca640000000462b3d56789478e31e4c043c5ddea9a8787bce439041833688081438b6b7427e5b35ced819ff8d6ad7b366385daab77ecc422f3a2cedc66876f362b3e063fd9c	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1860	2164	iexplore.exe	31
PID 2164 wrote to memory of 1860	2164	iexplore.exe	31
PID 2164 wrote to memory of 1860	2164	iexplore.exe	31
PID 2164 wrote to memory of 1860	2164	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c44cbda09ebb1292b1d068bce111952_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ab3e20ee3df20cc173e7c47958d8dee

SHA1
b7da0614e96f0a39939856047f6d1f472beeac8b

SHA256
3dc46309b8642a822044ab3bf9fb6bf339a6d3f3b5f12762ef4591e932b5c8e5

SHA512
491fcda314b064e9cca346c57dd11bd4bba2443e624f9e3def101e60f5a415c2178d3831cbb132ff8522894d25159c8f1a688dc583a904f40a2ffff985fd5bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c55d0ec94a57c97cf9d22a6d9ab1dbc9

SHA1
867688509ddd8041ac5d13fcf2bb802c377db45c

SHA256
afa51691d50fe401e7f572fa427a96bf3b325887e4600056a8f850bb8928db90

SHA512
5dc6bebb23ddf99344a41314203de716123424b62c71fe5fa55196a7acb716cd908dbdcdbca77e403966ece3557954b417a756233a3d3163027980b549384fe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b14028b93361c3ca96e7440a34b853

SHA1
d44ddbd81dce3674730d055a93c74224fbc241f6

SHA256
549a96a97748ab850873a285a7574fa1c64e6da4730bc36edf554c5495876607

SHA512
2400d1655f037f3241d4b99d6142f7d5ae0e537ac256a0e7f21f3f5e86256ecc7651d53dd94e91a69766579f6cc17f1f33e07906d393e5fcc5fcda3570f40ea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
486084692c72e0319b6b10ef83853cdf

SHA1
aa771ad5eaee0031f7b82fecb8de25e7e9f8b1cc

SHA256
291ca251dd4618d060b58c5690dea5ab9551948b3a7fda0f1d1d714c1b4c5b7e

SHA512
7f21075d44bd5b14d92d4a10523a395dbc9ddadcf7a421bdf9a58b3c6be7a4842cbf1a47128cab713316e117caf034ea9a8dff8e1b7e168a86e7c529f88ff663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ffd8a09471ae1ff8edb59d6b3924860

SHA1
268be5b820f28b5d121a482d2eae4ade1d951592

SHA256
d9ccd55d3ede79db20fa91b085a232ab2ccb5c0ed716d005cafe1c797357238a

SHA512
06aeaa0a34d463990cea05e913686e99140a52e41e5b91299f10ab74c0044ec73d9e1528b33d35703d2169f2fbcac5898b4a3eca3395a47bb1bcf8b59697a99a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12bc2ddf623188d98ec6554018b2b16d

SHA1
293317742867089c5edbb800bfb7028f78585290

SHA256
ddae44af009d20603c5419ad4ac46e7f7f4c13211dac024f3fc9870c3881d7c4

SHA512
52648ff1e8006d41258466c8a8235f3944a9a8cddfc6749c829b84696d43251a472f411a0f2e30822df90926ce66fc3529fa8312908471c0914f4649f306785a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
621a5f581d773a084fdebb8ffaa34263

SHA1
fdef958c2dc5eba4ce53508684d7b00a4f28f684

SHA256
cd3ca2dd3e59050c8ec4da6959c750df9ff29bd52808d7c27223b0922ae24e11

SHA512
f3434bb40c30312dde17c72ce6f7f97e3de3ff913b91071d2795b227b089340c38deb02cd6841617e19b282e3b8f9443ca11c721be48f2e4b894b4282ac0f16b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49bd0b4607211715aaae2a84b88c14d0

SHA1
9d0e5d91d642ea956693d96c0fd7f6d7fa206075

SHA256
71c5e9ddcea1372a070628c53e4f114d9eeac635de5124ecb91e9ee957fda649

SHA512
3df8ba0a0804bc337861e7966d121adbf7890bf7da04125b78d15b6c1a56274cc349929beaed9fc9277d61df0ee559a46e8a37619989b0fba03ecb159bbde286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e544954193c6feebf7b47b73544d5fe4

SHA1
70fa6dd4d534b7a50548eb25eaebdb4acd6c49ea

SHA256
9037a06c9b122acde12ffe4d68db1f5c916b633db42fe513dd72ae4c7ade6c1a

SHA512
379c94606c2482efb0d46d5d048a9a716e992cfbebe3590f2693992c4f5498383a260313097b3295e5ecef833355df831e6dd897f924c71025b30e1de7868d98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a0d190af4c75f73c7c45b71e71ad4c7

SHA1
262db1d839a9fe6115e81f228192bb1d8d364ff1

SHA256
ff6795218d755bcd4e4daa13f552b83e540ee27cf6d99eb171562ce61f9c23cb

SHA512
0f69fe402a90d7385bd9367b48abbf0c3879f632a7bd0b229e193182830ec8ca50d1686bea81e6b9814d2ed7752270c00dac47fcc551ac4184b90ec99d6eb3e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d9858f1bfdc24324d831a251ac61d3b

SHA1
265b64569ed8fbdfda169311e1a77f78b75bff8d

SHA256
1156ff049eae0ca54ee22923989d0ce916cc082df5df9851be29b9275adb0dd8

SHA512
345fe7766a6a3ade47e78ccccf79b9ce76613ea237a1ea9bb977e344d346aea077b8b393c0837b837c4b44ae2a8671dc347d752971f8f07882065ee66d41aab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
008b38f78e07598f7e6866c6bbce9328

SHA1
69b5eddfae59d471fa45adbd8e29dff2b576bd9d

SHA256
7ba07b09e7b683151eb5a5d1083512f4377aaaa83106e07053b14d3da73ebbae

SHA512
e3acd94d0d000ecc306f8f2817242d6eda39849ecbe6b4c5b925bb3ca88a1689bd9aa9eec64756ad280ef08d787d6f5eeb3fb0907f673b49140436f63f6997e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2f904f547ff105cfa8aa7f088e16504

SHA1
5b8d45ef808da6f7890f0f0c8a3256383dbf2134

SHA256
3edb5492c55f38a6c9f61c156b24890f911070db98188ea6df4510d7d86e72a1

SHA512
be902c32108861fb9abe6740b6ff06f6e7574223397b4fd01a8692448faf224dadac12c82517ff09d8c8704b56e22417bfc0700e7ea8bcc7d3db68b6ac1a8580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EC8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F88.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit