c27ba27a17e0ed6b0c86f1f88dd42e0256e9e16e197096eec126db35025ba790

Analysis

max time kernel
140s
max time network
156s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2f8bd27861d19fe488ba1929f3220cb5_JaffaCakes118.html
Size

6KB
MD5

2f8bd27861d19fe488ba1929f3220cb5
SHA1

9224fed757fc3e6172b7b593b53e7caf5c2890f9
SHA256

c27ba27a17e0ed6b0c86f1f88dd42e0256e9e16e197096eec126db35025ba790
SHA512

27f31c6551e4254b2b31af769d7662af55a58bb55448825ca9a722acec28babce2ae55d273ad1f0e9eb7ee76cd89b47177b15c889400dd3ac9d30d25519e2c4e
SSDEEP

96:uzVs+ux7t5LLY1k9o84d12ef7CSTUpZcEZ7ru7f:csz7t5AYS/0b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000cca70166a1bfda9982ec6939168ab3589197e2827b27af87e5067cf231f0abc0000000000e8000000002000020000000825a4a7e1d974fec9ddc9046bc5e56fdcb7a33f2e434468200aa4dc51079732e2000000078d9a7a45d46a86287f5c446c8b473c979b801fc17734da0180dcad3d34b181f4000000003d3f31d5bf64b9fd10658487f7d66baf1abca0e301948c5e71426008e3eaf9c7e8c55246e22adeda05ff9818ce49d5c79eb0370b0b8b6107fb4cb6154960093	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000004dfa8d6f8beb11c3757898f82d9c9dd756cb00b25f8fd5e7a4e8f2ec135f9cb9000000000e80000000020000200000007f33457462375d0210c941802891d33b41cce00520c295e7a93cead6c856fb56900000007138b01b48eb1d0ef8a6b4c95e1ef3d512bf62ec82da1233bc18ec7efa23fd9b99be06edc81e71a215138f7f1795bdc4974e43e2af8b279d23433e6ff2c09258383caab5851cad6df8636a684b3f9c1406fb0df099185e32c4d4dcf82a11dd678c772a902105f57e3675de9b3ab2fb895b8aa86e1c0c0eeed8e7313a8154e9932d01ec531b35ee7a2fed5d701ff3e9014000000053315d1977afc04021d3a5df62c70dee8fcc8b9e71d33812909c88bb1f15ce6ac636ff482bac46045ed611bb9d27f74e4755a6b41793b4a7fe595d947e458163	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426686707"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06561f5f3d1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FD85651-3DE7-11EF-920C-D692ACB8436A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2920	2532	iexplore.exe	29
PID 2532 wrote to memory of 2920	2532	iexplore.exe	29
PID 2532 wrote to memory of 2920	2532	iexplore.exe	29
PID 2532 wrote to memory of 2920	2532	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f8bd27861d19fe488ba1929f3220cb5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cad0e653c9e07d96859f8c81eba1df9

SHA1
9f433efddc4da0c6602a3ca8f945bdd3ddb1e406

SHA256
e613958ebe0fe20d9bce433a3124a7b3409c3d3c7a34f8611f6dfbe4c66f6dd1

SHA512
4178ec531be036ec909294f7ac19cdab8ca9200b2cbb1bf4e238af05c4d2e658130e0a1ecf58c7d6c5389066e686d41853091b07898c19ad0547571d51ba2955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af789658ca70548170db78d3f2c99e81

SHA1
645f9eec2792b9b9ce081a378e1c8f3899995156

SHA256
c2ac581d29318b07663d3fb37d8bb91dfc0bc56f0bdb51c595e2bcced50f9626

SHA512
b395c71a539df7ad33ba7e9791e90b3e79e49e6728062c881039522f34028d1e016cc9eb6766b9a036b2ec0d91ee89a1af56c456862367ed2f6ea17b6e9fa0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32f40232b82c6e13f435fd20a12cbab9

SHA1
55b527c200f2e89fbe56a64429d8bffe6a4c416b

SHA256
a408e5c65317fdef5a223b9aea6de5017cdd0f63fc8a6c84261a05002b3fa802

SHA512
10b7d6dc7eebcc94d59778c6d840f9b22484444f93ed1b914792c6e6965806e0fa00e82c7700abfc0adeb08d9bbf24bb31776d842ef9639f5e1a0475794afbbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82e81c4e57965ab48fc12b83705b3199

SHA1
a58a845f6a66c8c0ebd5d149c7056fa4df1aab70

SHA256
13498473c7a3b99582066d9d2bf1f888a9b8035a8931a3768009a47613395fd8

SHA512
c9e797deab84726e4b7c2298f2848b1c90a74a9f7767cfa54a3bce276c47530fd6f62fd33505730f58c466bb9ad5b2877460c3b3d12ce3e01a5ea32b60e5c8ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70eeddcae009857d6f2490359150b235

SHA1
171211f6b8f622b5675a3f5e31d4392dff281ccf

SHA256
cc5a36518cfcec700b78f804162a41673a1ff345c585a88adfcaa110ad96b698

SHA512
dc281a1227c98192a8bbbb792091212762d52f02aeefc77bdfc59a0511e0543cbe25e86a8f8631ea49763d413734170700e9605a6bb9332bfdd09c4f3795dbb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35ca8ceca9b383fe76fc10ec56359ad3

SHA1
73fad52fd36c05eae18bf2636f3ac25535f4e4b4

SHA256
6d4481e5a0431c6297acb58da677ab7fa8d7f2ab6dc1449919f52b939d9c0708

SHA512
3c10c92e8638a6f2aea52dbe9f5283020737df93c4ab76c51b432a256b798de715c2beda828fd3f292ba53d56d972d78f899b02479696569753d01e58cbb25ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66c0bd985ef568a04dda5f514864c425

SHA1
bba1f800f3f361429e5333e33107367e62fba4c3

SHA256
a71544587db48bb0bdec97aca062915defb6423852dc9878e3e4f93d9c3322e7

SHA512
c2a7806f03cbf4a925af1dfa77bde965d95abea76bf715cc7023cfa90fffae9c2c3eed383441c6c52b356798a633b33404f4abbb229be0c710ff33e6d98c9fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba8a4c6e1f1fc48c631020201ecc54be

SHA1
beac6793bbc7752810805d64a8fe7bb774df3dd5

SHA256
dd851f3a31e38bc58dd4fa350ef5f3cab4e567771c0b37ee46706bfec6c158a2

SHA512
453819d45e4799cab2eaf86c4cd3e8f20fc0871441fc63e4948a2dc62db786743fc6336ee5eaafc65f52b819beb4f83c33e4e18952235fbcfe5428792c348c39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f0c5c293aea954a4821a1b6c3511acb

SHA1
f5ebeff13118c04b5368b3904e95a107b36dd4f2

SHA256
9902f5aff79c254fafede7d7c9651486ea4a1c4ca55993dd24b9ce7695dc161d

SHA512
6c5193e531848328a2a93de3fbfd4c992c558c2c104d93ad47ee14f3b402ec9c63fb002fb9bd12476d74a3fbf329d7ed6e12f1630e6102ae77582037c3d402f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b3ca1f58d6121e13be1c6a60fc5633c

SHA1
2410a64329485480d9380ad0d6b5669243a36e9f

SHA256
645440fd3774ca9d3c70b5f7ef96b0e5109872537a32a5d6446d9ec812b9637d

SHA512
b9efd42be09abf8776d906c2ae2bee6b03fa167316407aefb0591d59d896a50f0c67676cc924b5da8a4969b0097c4cada3f9c4a1fdd5cf1ab95454fe498afbe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8fc9b61d4befaead2a5f87f79856df8

SHA1
9ff659ff94e1e827304f4561cb5bba6e5e78e013

SHA256
b5b0c62a7923122bee7b01308ccfb07e8611c50d9d2b3234b38304fdb420e68a

SHA512
ca926fb4d838a111361d8d6163f34d813adf022dcb748337e11c3b9148b2babe2ab214d80e7cf8b05ce6ba3e23ba4d2cb199ea75bc136de9a7bc661ab1583c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23852251345448198b515e076f4f5f86

SHA1
896eeb20a0d0b6977ee324cb0e806f3dec02647e

SHA256
67915bdd44d20f5f0abba3866f594aa89ca4181c3abcc6d4f35c147ff13e9ebb

SHA512
07548b6e22cdf9126614240838631f3239ecd55400670116f54b6ac44504f73807f17d4b45317cfada1667d8d93341c552f54d067a87e74d7889b172ab369dd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
565fa8d9a11f0f0ca3375526a4aeabdb

SHA1
0cddb32321d596d42cdaea8ed77cd70925d85fdd

SHA256
834d002197b90a02b78e587752b6f7e08e81a4b2138878dbe749efc3e0170854

SHA512
c0eee0fe7e24d0420652439e89bfd2bf82d7175ffab9d4a924c4eabeecc929d4ec4184899e7b8ccd713b45b600c075685ed0e44798b3a5568b87d2067026e0e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ea441d3f7d87dc5fc9fc69a1d3b5bcb

SHA1
8c5486650c4a5cd1314ad8129b99fb597f34e860

SHA256
9f203d824920e1a481682c12dcc27797d1d6a85d65025004959948e7aed86deb

SHA512
07ff6b8936c0c4bb94909fa21585c5f9e5b0c1dc8282d203fb911bd0061ccf30e42c4ac79c5c4aaa58ca8ba773b6b8b7bffc6d1acab2e06dab8488e0cf76b012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4c7964737174e524b196420d9724585

SHA1
8c4a32d8fbb5902d4bb7fcc82d691d0f43d6e88a

SHA256
59ab77121245f0facea590ed84ae715832959e7c681bfa68069f8552b3112ddc

SHA512
a092aca30a48805f0c8656d1fa94c610c6f8cb7021c744b6fc28d950d4d622a580a3d4f52f0d2c8f079c1592bf00540c1c2fbe30b0550dbff6b7608266f63564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e19822e3470e8400d6dddf428ebb5c3c

SHA1
bd51d8acb29d737f8c6e961ec5dddbed8bffb06e

SHA256
ffc6fcc30c49d4065d15109676696eda8eb647eb57e31395a0586b0a9927f185

SHA512
23d372b6ab1157ede4383a824d89a5e4946139b8cf77be1294c6147e1556c123cdaf2400ae2f31e363454f63c21621e4f538487d19c0e55a40c2bd3834042307

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D8C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit