b0a2317baa375cf589c64008c6160ad28ff111dc7a76a57cf73c5631dbb87236

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ff1e9aba6fa599fb93c2f995a654767_JaffaCakes118.html
Size

65KB
MD5

2ff1e9aba6fa599fb93c2f995a654767
SHA1

73b0c7eb511c7a2b1a0f587121a9ffecd5045e2c
SHA256

b0a2317baa375cf589c64008c6160ad28ff111dc7a76a57cf73c5631dbb87236
SHA512

3f10a44fe821e67399604197813c7d9f1c9facd750deeba904420eaa3aff1365e40394c461cdf69739a03f329a9abc3df2f2ee647a8639d8f6582a63b1d84efb
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcnLiHA8+XL53zbcZ2RFZ/p:s39ELtH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f49518fed1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29693C71-3DF1-11EF-B2FE-72D30ED4C808} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000007791394b95afe2b0c327cdac6fa6b72ef8465a20c8cbebee7aaef0c05c80a458000000000e8000000002000020000000c0adae21e2520677a0a47a329684615c670de16af7d0b6d115e185d000d492df200000001c2d81ee9dcf2baeffca8194426d9f5851bcfe4a95046891c08c0c9fb1161da14000000055a8ff5c024ba6afdda0a7adfc27c6cbaecd395795eb7a5abec995218e29bfd31a648b70d83684ff39866cc2b583cfffefc76ce05fd3b669620de08564fd10d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426691014"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000070865b20df9d09dd4676ad548b648c1ddffb7409a34c6863e6a313d0429a611a000000000e8000000002000020000000c9cca9d86c008da8c020e1ce018d86cff977ce1fdc9630143c5f7c84a712caf790000000e05b3b6ae964525c6a2ef14950d376ddec5c00637b9d11f6d927e3a710ed435e8a2251e850d63c802b80a251ed9bd25127c2840a21ae633d1ddb3b8e4c6ecb16ddfc085e8fe40495b25284fde57fe79bd3a38d29d8ce7abe83e7978604394171c95b6d0a5d76cdb58cee1fe51bec2c48058702944f732db0fe9721f0283375b2aaa70dbd1eaf52f0b01454e73b4680f84000000020c59de55facdf2f072976dd20b53c082d98bf4e7095da89383ddd177325a71dfacfa19a2bca2db85af609c5d02ed0e6393a56c03f48bd3067282a9aef29029f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2060	iexplore.exe
2060	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2388	2060	iexplore.exe	30
PID 2060 wrote to memory of 2388	2060	iexplore.exe	30
PID 2060 wrote to memory of 2388	2060	iexplore.exe	30
PID 2060 wrote to memory of 2388	2060	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ff1e9aba6fa599fb93c2f995a654767_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cd381ea2ecbe7adaa462485dd8997745

SHA1
562e54e55336c02ddfbb20f3b145256d25a28a53

SHA256
1127eff62617dd5bb4ee8e0ccb89f8eb26f8c57ff59827dba34a3c70d28ad85c

SHA512
a7d4fb2bc74ab583386e26af57dc9d46bfbff634dfbb0f69121756d2173b8cf94c66abb37231995d7404f24b994b7a7b477e53ad266a401f90bb385d665f6659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fb4cfb663d57b4894b1c342ae8fc8cde

SHA1
c238b91336f477a2df3ef970730984b6c3cdc9a8

SHA256
a1e653e70b176edfd5e066f3453297f5da71747b3e5c0a5d838bc40a72f18b55

SHA512
fcefff0bf726c6729235a7c6f5c1bc38e108717c1e686b63f31c0125fadd24c4ede83d208c5a6f73a02af7adbc97fafd2c599cc2acde41c0940848ad0109400a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
52e533bdc4453aee7e2a6a0915c8283e

SHA1
7fe954fc61105efab08376986bf62dbd41f28635

SHA256
16265ee56c5f440c772046a797df41bf4041e1b7143131b09f8c502bbf74687b

SHA512
8ddf5abc4ebff96a4e73b435076d1c96a695ab3068bf5cc63e89421dd453751327dfc71b3e4c04fb30025df2270bc22e3a1d89a8d3c409a79a2a9202349b309d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a305a5a389236a27ffa6d8c2033ee8eb

SHA1
f9b3375a7f20fa7444e2b22bbaed51534135eac2

SHA256
2a0e47afefd7e158d18d97d18654d931b9bf227640c952e38eccdeaeeab9d926

SHA512
6699d94da00125275474c5a2d2f75bbc344d2833e3c817a516f32523038b7a397d91f13f55468a6c7ea2f3260c55536b9b73ed9c07b8691028a2b59f02591888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5ce9867af02fda0cda96fbbab449a0ad

SHA1
ae4b478f7bfddb52c8981c7ae4b4e2e79737445b

SHA256
67a4b097dce974a7e374f9ee8e71fa3b44b5087648aa38a5ffddac336a5b34ab

SHA512
0014697390f912c62d055f30a50cfa6d9064d1295533a80db3fa0ca9af1f34690aac063d460cf2323aa7f3c8bfb7af719d5e5c05a1a3ff7fc350c23bd025641a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
de94e4258dc017785c0a9316739db697

SHA1
ec5b0295d273672d8f3286a2b32f4b8d493c8d12

SHA256
5be2791446f63c0a3d66b9c1321d67756a2feff48b384d257e12824217cc933d

SHA512
30f8cb2890b515e64eae7b34b490e95f4f398063cc18ec3b880a9cc47992bf50a1734d96915452154d55ca55c11ca225332f67191a868914fd9ad5ad563eb6dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bb4636a270c82edf536cd95fdc384b73

SHA1
32e1ad2197fc4dec44bd37322c60d4094b9311ba

SHA256
a911c34e66309652f06a8279f50d3b509569fcb672f03103b7b23dd229db50ac

SHA512
c588dde188231cc8af85f0a677028f3098fe671e2c00ca597ad4bd989bc756c483a8e960aa47bb356db0d8b4083e9177db4a1a8cbdee2774a3d8869ff1d1d184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9943603819738a963648214985cd795e

SHA1
ced8126737f48a53d8795354f51e7952a386823c

SHA256
cb26b18287d928663ed90e753f418bb3681c58a52c1eb2ff0813c9f5d7e4b204

SHA512
5be278a17cd60de5e02948a4608bd51e8d791bdd45face7dc769d44d8a8c50c3a8c287cb21f3aa7123bb3760d532291232d7ebabdc1f036ea16d2da536f190e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d264a81585e6b87ea1bbd87214006152

SHA1
7a28c9bfd112dce41519c1a0372a3584d38a21b1

SHA256
ae5787faacd72c4242a135eb3c905f6d98ec22275e828452f2981d63fa0c4b98

SHA512
3095a11e2014ab746a2b35a14e22f3e1662097199bf039fd3c2a73c785d0af9d1874282630b0c174657c5121c2390c426301db98f6601efa2e43807c458ecedf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f8a339f0c9a557a19329404788f45eac

SHA1
0944f270d433f81d5149815b74e6b8acb774837b

SHA256
3387ec737e21efc53fa8a004e92ad6380b840c18d9294912248901e3071c2122

SHA512
7a8cbbfcd8d51f4676102ca70585d6281b985afc46dd468cdc55d0121e34b19f37932dd742dfe3425b33624fe421c21dfb8ab2f26dd1f758099ad9b556184be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cd6ac2b17ccd12681a2a6d3afc221ed1

SHA1
9310eb71b3e7fbeb5053a3f7e8a2741ce69f9e35

SHA256
0a9eae49d519accc7752fd72d8a9ea9e84bb26b9eab94401fde4152bd4b889f5

SHA512
5d6ec40fad97191716b8bc89236c2292c7064e65621747acacf525af5057bc444ef538ecda7b3da704f6ae7cb1c558a3d78354e1b5f9020293029af427cf4065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
79507a1515a1455129da3a4bda521d2a

SHA1
07bd53482f05e845763967fe00015fcd2b879fa1

SHA256
0ba21fb0d140d597b4a850630d173c790df9a43d8188fcbaf7761a01b8cbf0a9

SHA512
9f403a78f9538d2f6942b6c1c149877839620be26aa9e372da0ef8b5a332fa1c218121c4c84a0e8a45de57451c689a05aefc37e3e7fe654032b78e025871977b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
03f736ff5a0d28af92197667ad600f58

SHA1
0ba27feb33ac39dbf752050b850648510e7fd9ba

SHA256
ab4e186f4d3fe89a6308ee3083e91398c754d89d249417954812712b6defa116

SHA512
01036393b8b3b4cea6916c053c7743be301eb5de521545f7eade0573b705691c2e01e501ae7dccc8886307a10c6bcc141962285a41d9e5349cd93d2e5146e1f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
24cf91be66d97323de7a651bb12d1c3e

SHA1
602ed13794ad696ea42d63e4739b2a3cc8b32984

SHA256
91bd09280c29a80fa5b42ea9d66d16d64f67c1c57159419f766068480d998910

SHA512
e929142f1e251dc925e4658e46c8dc8aa7b6258f27e38ae10581d32159ec29b1f2c2c604e732239847d17f2236712b81beba7b7f2f89bc12c24519e5a8c7a6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
37887100792bedebbc367a9d69b646c0

SHA1
4a3ee37cfe651a0470d918237a4bebf2ecba6386

SHA256
aee7655b14c922bd18e60c346572a9b32514dfe2f54bf3a27a0938547f29e6f3

SHA512
3ef1394e32e82759bfa0d5ca84bd636dfd3804a98c5b7e6ecf1ec42938dff9acc3eec5f49bbf9ae9c0090fd9d33f376d5afc406a01f8ff4dbbd43445ceb6ff43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
27b1ee9c07d8f2afd2f12d499ba2c6f6

SHA1
1034684aea6f4a0065def5a1cea694091895fb84

SHA256
4613a0cc5fa08fd38c73dad53b9009cf26c6aa10b51e5a3fb27f4f642c41aa8e

SHA512
d1bf886c0716b18ba12176893e6307353d01dab646c52e564e32a16118e87146798c344ed664d553aeab2c4bbe30fb51b88c73eedfe0439bf9ebcf54cea60ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1766fe5ad6908d4a9062e431b3c6f087

SHA1
cf7ee361bc71ebd3ddf0a90845eefa1a9af39f59

SHA256
fa94d1df50d985cc4b56bd4409276d5995ee7c09c0436cdd4a402bb710a51ece

SHA512
7ee12b9ba8073ad5688b62d22474ab50489d249514a339471cb373e751d4af6efdd75343a2aa19f3a84affe5090527e0d0e6111dabfaf465a6137029b56c6a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD136.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD148.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit