513170bb880a2edfc3840adffcf83b5bc2d3e99f06527b1cc3381fd61b757b54

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c450ef0b9de3d06ced8dcf5787dfed8_JaffaCakes118.html
Size

14KB
MD5

2c450ef0b9de3d06ced8dcf5787dfed8
SHA1

c287d0347f4c16d48991247903e00f6854c874f7
SHA256

513170bb880a2edfc3840adffcf83b5bc2d3e99f06527b1cc3381fd61b757b54
SHA512

bd807cd024442f8424ece761d0ebcc3e83190ee6d997e2f33242db1c275e7674cc0fb9d3c92f259eecd56909e5a1f6ee697e478eb897db4c2d587c523d9316ed
SSDEEP

192:rDkTffv5gUfFS8VmFFmnrAD5rnrf1SGU6qCC9i1KYYY5:rDyfX5gU9raKr61rf1SGU6qCWCKYYY5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000b274854a53497067ef030ee0a2f0966a3d451928c3311bd68e65b31ba56ba88c000000000e8000000002000020000000168ba9abe47ce9bf2bb5b4bb0383a9169c7f28e900a58c1ecfe575d43f9c9df590000000c46b5292122ac9d9773adfd20176e129d4a27c4fa29c9024983d1685c6375c4d0ae0ff11b41a23242d19dd9713f92d2ef5e78d315693f43ead8894a9cbdefea381bedf3c663950b547b5bcebad0f44007a4681256cc5cf712728dcb0e0281ff7109f47bcfd5cc8f5c2b1444752e1fa6d887e096823b977d1a8fc0473796744dddd7e52f61e40517e1d12e1b6c384f3d540000000fa0ec3b538407494f805a6e42bb1a0cd16b5c60af93396a87d2851725b06c1dc88fcbae0d0345402d54579cd68ac4cdfcbdf4e152e0e34b89468530d690b6ea4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426628640"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFA564A1-3D5F-11EF-8912-C644C3EA32BD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0af3dc86cd1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000a2296195e6768abcd105f79b20623d2ed22964063669dcb25d09e16dfc0ef237000000000e8000000002000020000000fd42a6cde36683b253585b832ba285e72af4ee7b88d3968d07ad1cee1a3a2ecc2000000028ae8c4d304e94fbb5d07236d67cbca900880be7cbd5fac3679d82876af9a039400000007adb3d28559fbec7a77b2689c4ade4432c8b6ad23ee8df38548fe08346bfc4cfef28d438aa7245bb5d472732c92e094b8cfe46f5828a51d82a198f8df390f158	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2888	2296	iexplore.exe	30
PID 2296 wrote to memory of 2888	2296	iexplore.exe	30
PID 2296 wrote to memory of 2888	2296	iexplore.exe	30
PID 2296 wrote to memory of 2888	2296	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c450ef0b9de3d06ced8dcf5787dfed8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a6d139dd791a29433747a84910869d1

SHA1
316d930536c215af4a2e862faa70e36f71e07d36

SHA256
7dd4d3ce8d3044623942e2e5a91b2f10920b823d1daef3ad1ff48af17009fb9a

SHA512
0fdc89c0b76430b30dc1a49f029e96c5194c534fddbfe2dccc9c802a620f8a46f376aae5bfd6f97e0ba018bb58ab10c5d027172dd12470b3b6cecd1b295a7e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca711b57174503258c4f5105e903f0f7

SHA1
90b765ee092b594a052ec28d6b79383655c5f75d

SHA256
dac073fc1684b40ddf6edd64331ec973abe6e488fd44d769f1c971adc125beea

SHA512
af9e3a2579da070c55b7d7f3b759fec2b419231a0717f5435397d9240b11ca628acb81831c271fb2a9b5b153f48838a0803db7b7b0cdf8a6f02e7f121873a8b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d5ef0b5787b2de463845022a551ca74

SHA1
2979f149731f83dd67b7bd1ed24ae2562fc63e95

SHA256
4f06bf0354ca9ad67c81e8ee4c1cd41cb312e27211167da5a0f0ca1f0c50e0a9

SHA512
a4d60a958aead67c6b69b1a3647f3bc2fc5173e288476a5f7bb6142246a3c8687a457f4d0ae4b4a9c1148b155414c7610b6464fbcf9d9872f3a7107a6db5c170

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c94e4e609a59d6c50f7f657e4d41bea

SHA1
f4f9c29ed5993b7b379ea4f6387045c3787760d4

SHA256
23c5dc22ad470f42506031e33f9637bef01234bc4b77e597daf902a865717e54

SHA512
f1916c4073503677459d81a02d113851aec56ed45232e6d112bc096d0de99d5e52a535d98a859d5441d5c9c02040d6adb312d8c39589380be3c0c2438a85a789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b4a2fc222d7857d08a79a320002872a

SHA1
a9015fda830615c2a2ebb13f003989e50ef7d0ec

SHA256
dfae6326da2590a1eecaac0781e78910f4194f252054a0de151ca3081ba48781

SHA512
fbfb5b641222d865864ef032c1300baed3e8dbd6b6ddffd2e076514b827a96e0808c891cc685b63576695e93306c93af033f9f6571edab2a1cf0d831893de83b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dad5e04e11c36941f659c72657fe6485

SHA1
b7373b25361efd27d24228443cc4b3a9123946ee

SHA256
19b844073726e72a6dcba46d3d65f126cd61a2d094be9b795b8f7791fee96c6d

SHA512
43e3f455a264aaccbbb1b051d812eedbc54e28bd7f0c22bb595ca8e2d1efa3a9a8de9d1cfe566aa73075d035d72fe2375abe9a2cf6137b5cdf36e6dd69294625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f551f601c1e5cad9a73a54f6672e8b2e

SHA1
63c42511ecd9ea2138fa1cfb4399312f1797ca55

SHA256
e3cd4c076b135cc2c8f861883933ae245e6e51c8af2f5ff3f192cf9daeaa7772

SHA512
1fc2931d1fd048936a48e1d8e8d4dea8acbb20ad84c894a34bf6da931863d81c34fdfbe00eb7229672456c01682c2bf5513354e50a16b960d96d7361bbe7034e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f80ec2dcfba9b6c7462c001e2e46c80

SHA1
f763081691080540cdc81cf977cb217fd58695db

SHA256
9d9659b449d6307bba7ff440406abbedb7c01b3838fbbefbbacea90706b15895

SHA512
086f2a2342568ecb06359927933422c232dfb12fb1f837ca1b5156b56ae0b7dd6c6eac8733b759d3640076fa967b3f345628ff4e247a5d1da6bb330fc3f91460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a32f26f533c6b95b99fc60c88f34fde7

SHA1
3a48b46c2ed8efaed16c47c02f68ceb15de06ce4

SHA256
e5120a265e7a8187df07c44d7d26dfcdf069950434f7b0d7df787f45598ac440

SHA512
ed517fa4b65e0093850b5313c65a53faaf625985f92f6c712ee0809b78799881e12771fcd17de668786e58a55fdb3e9f0f91e58f584e93a92f1f12fdeaf8d432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
177555abbaa045a024958760f298ac39

SHA1
76a7ca50f7d2ecd0bd1ea0cbfeb2cf9b8d3d44f1

SHA256
e99681d86bcf3a0bb156a6de1d07818d56227805d0a30db7dc8c60e031d75905

SHA512
f39be5237dbecf823e578713506dd2cf4496574fface94d594bc148356ab2d5877b4510c1291680931a77245dbee7dad44558008a403605b52d84cac4a9bf9e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5975b67341b6253ed3307615e69de8d0

SHA1
3ef000d8ce6f91e9306c291d60b900ded27d5942

SHA256
6ece17b1200a51cc5659d5f5b374fdb21f27a5cb801e752d0d438ab15015606d

SHA512
f2ac4e3ccd8001b98f28dc95481856a5da63b12a787ecee721d1b9351bceb41b56446eb97e6f0817f194c03e512d79ef14bc9ea49a16d984ee157ba0e42b6c96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ccaa7d5df264220f13740776d058567

SHA1
1e70772fd8c022ad8730c55a80cdc129c16602d6

SHA256
a6c3418e230b5275c218cbe0c4cab41ab7f00cc5cef6d5461354c82d8291fc85

SHA512
a7fc59fc93550dd0ff2bcd4ab3fd7052ecb01c51d005050bd8439a3784c87b683e0970458ea4f5478b5068bc2230797bfe77e14bf687a8976c9d0bd3babc54cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
583c20f5224c1097e35bb6d488887026

SHA1
a5139d409750b29cc6889363def4439ba8e88803

SHA256
131dc416206be3936f8cd375b9b6a8524cd9c578b18b2438030696502347f88c

SHA512
3a085b251836d56cd9842efb4c74f68bc5a0125ee5fa4c5463081332e8b7915104cf8b8aedbe078590cc4f9e5c6f34945910eaeebc24320e8d88be12e57b21db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f072e9d6f679e20a9677a284645cd447

SHA1
12c61023503a620c7061ed5df8439b4cd678b42e

SHA256
1aa18bf5b4795347ee614023ceacff371e29cc16874caed6fceb11dba686e70b

SHA512
c4c4673b1a000423419e32fbea0a6bb8756795efabcdda426a1756a51f9bbb90a5300e606bd38661509827dda1a9ba1d36b6909b387aa358af3958fdd31611cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d120514e4b74e6c093d8465d1d926b94

SHA1
14fa94f1c979639bddd6b20a28627b07d7bdf923

SHA256
ddc9620f54db2d8b49f51e775f4d2a5fdf2f7fe87724cc18d115ea4ddfa3da46

SHA512
ac7fbc0f40313c2e374aa7823c4df30ab88656cb4e98d486843557d6d4d493c2bcd58b86a0b4cb470c304a8da853e51d8cb7d4e05186c1f29a7af2bcb16cdedb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
455832e4cdeca83c2a4f123bbfd353eb

SHA1
242498fc43056e280254fa2b45d1873f8345234a

SHA256
d6d240b1c71fdf4f668d9aa871e653d49a7b11ab3b2bb2664ae4a63c9cbc7339

SHA512
907ee4ef60a0184baa2a321af290217189b3cf52b573799841bb30725c08040bb3863cbf21298ab3caad69e60f6c832e2d9575b38b8ef4437dd53d73e552def1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ecbf59df9079bec2db14335fdf16ca7

SHA1
6c7fd1a87a5a002c16bd34b16584c2dd6d4fceef

SHA256
ef0fda4cca35f2748f4c5263f730a845f16610cc30461e40c748912030bf17f3

SHA512
e1409c6fd4a9060537ca307c0b32a166e4b70e726729f0fd047fe59c8414cc5d23dab6deb58550800bef66a826df72e011fca3ba176417e088308ab327979010

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4FC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF5AB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit