2ec2b8587ced27d4a9ab0c69826567a83c842a6315b26cc77239d733e6e4f976

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

367e45a0fba6c863dbcee083eebaa4d7_JaffaCakes118.html
Size

58KB
MD5

367e45a0fba6c863dbcee083eebaa4d7
SHA1

df85dc4d926c014deeb08fc1e000ea682c820b7d
SHA256

2ec2b8587ced27d4a9ab0c69826567a83c842a6315b26cc77239d733e6e4f976
SHA512

db70ebebfdba046d8ec0e26dee9195d2f224fc511c5bf55bd87b5159480a693951c55644e6aa78fabe0a4c0bfeeaf01fbb055dfce9bf01a41a687dace85049fb
SSDEEP

1536:gQZBCCOdL0IxCDxVSf0f6f+fmfSf6fuflfbfRf/fSfufrfJfXfhf0fsfDf11f+fZ:gk2F0Ixl8Cm+6SmNjJXKWzB/pskbXWoE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426809442"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E611B551-3F04-11EF-9BD3-424588269AE0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000026326fb7ee6e26897c4a1351a13fa6774b4a97b96b7406e955ab4f6ebb3e8ccd000000000e800000000200002000000086e5327498f45c08f167ca941e72353a9c43bd42f8c57dd158a4a0938c5154be20000000a06431f485c888b467ccb9ac6e547a9f26f90e3e23ce27c672fa50be68dc313340000000b41435208e2ec8c362bce6ec515d3c3a602af76dccc6f3349bc98cc9017f357d574422a64adaed8fe7713dd77c8e370247320f540e0bf5f963c714130955b60c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f073f4bd11d3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000063b5e2ecfed5bc8a7652a651ae6552eabac2c3217803fde584b4ca36c08c4b5b000000000e80000000020000200000007d3d9d6e8ed1f416e3d6424ff1b547dc326415493c2885ab64f5c7853a5df39c900000006635643559c39861a7078984f6b27166f3ab7297d0a641e16f674e56151132a96a403a23d367dc3f4adcb648781f833391a2d58491090c85f611a3d110da0d3956a84e7ed80aab01872e3a4b5817676f01a5b04070322f5c6653f876fee298d48b0052b3dc9ff19494306b0a334ee60905e2674608e54afc3e8f32aa55fb0d123f7de842fc9ae9b4941f4deaf096737640000000d32fe9d47132764f4de60f10f342c6701baf7d91d4d14074e7ba03e1425a6163ac09b3acc4c03f0827d6077f13f0bf8369283a04063b389f976da856a4bd634a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2552	3032	iexplore.exe	30
PID 3032 wrote to memory of 2552	3032	iexplore.exe	30
PID 3032 wrote to memory of 2552	3032	iexplore.exe	30
PID 3032 wrote to memory of 2552	3032	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\367e45a0fba6c863dbcee083eebaa4d7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1713e5264667a4acfa66506e7ae3f0a0

SHA1
5f8fe7af9792a127f987e7494a8cbb96d16fd264

SHA256
b00027db54b77344347b72ea7eb9b1cc07b4252379daab7bfaf848b275f138e1

SHA512
8fd59bb6e70ed1af017ba2cff5580250a06b6f0f83a5b300c21cb68d81927a6fcf55dd09e95d51aac7a354c1d63037dfc7f307a3144e84b7b456563737aae17d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1680a115a0d05887968086d65e654194

SHA1
12de8019460d498f8cd1c60872a276b0dc7b9d3b

SHA256
8e698ded6f6c965deb17085d81cd1e34d73f4b2a4e7e676bfcf0121f969777b4

SHA512
93aff62e0383c1e1d49055c5ea125404d99bacb2b6bb3314d62a8d10b11467a5155e1a573852c77bc8704be62ec15cd394b7f3db8d9df88c051af8e7c99979a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c7ae1041bcace19be32c5d271fcaf4

SHA1
93a72c73a7301480872bc6b56a2817a9c79a12d3

SHA256
6fbe19447401968a8ac92bea3df9bfa53f1feca0e0ee210b82a002c5543c0779

SHA512
06c63409690f509a844de60e56f7e821b1f61007d5c327722e00e2e98092156d813ea80ec80160e32617d671b5a91e323a9d82d71cc2c368b80b1b527a447689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1be54a441e37b93507508d394755e27c

SHA1
378cdd53041eed799142370c97450493eabb9b22

SHA256
9531a6ec788935554c271a8caba84d1ca0f28ff7d09d7ddee64a8a44cc824ca2

SHA512
e4b1272647934df5f50e38f057726d32b5ad57dd10591a35e954c485a238f2c5e3aeb259001a2793c1619de2ce4541100a559c77393b47527d48f82aecdd90df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d624fef7b00d40903c49c118618140e

SHA1
4b9b5244758d750568460ebc78fda9e45b0d54dd

SHA256
87749f1f154f34cf503b2889afa3a9abedde85788aaf0e2762f02cbc7bb024fa

SHA512
c46e564b2a5878d8a53943b467081396136ef144f199919733702f6c4231ed71945e7d0d4aa45c52e20661c9042cb5552583ebbc7430b84df1dd7e60752e72ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07fef9bd3a619d4d6402874f7fdb5fba

SHA1
eb9bedd7de3ccc893f32ce4eba950b283133a277

SHA256
cc75dcacc00efce929c686d98646485d74fad04aeda9ed5086c8931f9bbbd841

SHA512
992af2bfe83180c33bee0986c99749587d9118338428c10b8762df06689d503326c845349292e0b638c70eb6b23c32c864b20ef817998fe12d1a438cad490e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc7e590b569b1ce273520ba7bb891afc

SHA1
1537ba2cea26dd70bcd6424502027deaed442d0f

SHA256
8d45d10ed7b84fd07dcd4bb9176daf033622eec90752f189f1111a58b3424ee8

SHA512
5b931622a0b1f8cc93abcb941377544f04dd3cab05c0f799ebce23b978c1cd6908308aba51dc8ac7710910232a6a4d8f1d60423b5f389b22261960be2740790c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
284b3983831f75308845141e1c14c6cb

SHA1
2c19f7e84e4bf5d535ef6bdf77cd03c215f2e304

SHA256
2ff586d0fd784b3e0ff641bef328c06788c78afb6afcaf36915bc668fcd28cda

SHA512
937106687db7936e666e2972144cf62e2a279ee3e418b63ab2890ca7d9260aa518bf37a6492c2e9e6c08c8680fef030d1c821211527d9c0d50752a651b08b184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48092ffd59b255d506acaa435971cb32

SHA1
f3d0a7757ed7b4852b82d22b138aba37a8ef8174

SHA256
538534b834dc44d91c2437da5553644933758c1f7cf5aabc8c87e78299923f0b

SHA512
987f394da104a223e295e4cf2ae4314ed4a40fa8d7aefe5663f7b5b6e08e67787f0aa3b552e5f0b59d0c0f444676a1dcc3d09bf83b235e0864c8e5936042bfe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1185302d9abdeb08003126eda85be27e

SHA1
ac23e8f756016a183a343f3bcd9e0ec8c535d59d

SHA256
29a7860fbdfa3041ef0d8bdef1c4e2d68d7213444417a6af70da672a1b2b00e0

SHA512
47d9dcea3c2c962c301f3b4d42ba889be4887ae872967a0c1aab07d0558cbca3e54e6573015c2bf67b721d8fcf765f32e5ba1871bc8c1339c5bcb76f50de8257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b367c203727d92a88ff8d59cb445665

SHA1
caf8c2ece3f81ee9b06c40fd92265c3fea196d31

SHA256
7960fdb473e15634ba54ac674dcd18a6f1763c5d1f7abbef1afc43ed389aa8cb

SHA512
3b144f1f159a771a585a69ece11c6855e43044d0525e4a5ceb95f7431962253d19ca2c4387e1de07905d5bc0bf46c2c842150e9a42d431b9e9f31cd028ce4136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5802f07f7c7bd174d540e4bf72204473

SHA1
8aec8acfa01123050c97ecee21757aad4e0385ca

SHA256
1126130d736ba9962de36381388ad290a34a82fb8bd095911c0ef7f3a797d05c

SHA512
0765d6e1aeb51484c33df06f46160de5079abf8536109fca8441149838a1306ac05f0ab261eb25cbd9d984f1978064be12f333b028664badc915cafedf717cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e048948b6ea0da7311bfb66e4e7b713a

SHA1
1db9134e9d5da38fd4282b013a090b0f8c38f542

SHA256
dccd5ea0cbe4bcf1a10b40b61361c928e99bee56ac727a38f0a336d401d132ff

SHA512
42de54a6eb11aa44a0c6b8db455ea08ae175fda7da098910718a7aacd6980cb6c50ffb97bef9ddc0f7b52e3f40d73587e8bc1f1127f67c744ec8cde6e6376364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d922f92c3f23da6bbad385cef77d649d

SHA1
7806308325d90a9e34b121e9c1138ba55178f060

SHA256
08deb2b215ca1591073067825bf2afebbd056e2f08f570db87e807f04b80a895

SHA512
10babe321cb3fed14a18e179b94988fc491b18017527a3e96288b252b6bbaf224b251668f1f751f87cca7838828874514ff7cc213072c90bc7f0af9b3e964ecf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bdd2801b2b5bf007debea217959224b

SHA1
9debfc129b1c9d15f2a83ec97b5963ae7bf06d4c

SHA256
bf2128fcf76ff8522f40b8f3d17c297bb894aeb106965b1d3aaafcb501a38b8d

SHA512
a62e84d881eefbf04e2043a134be1c7646eb52e32cab6039fcf40f1d92af20142ab204d9acaf98dcb8eba2af10b3194f09216048773735b05a669d6d024cee9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1352ce235975811fcac392b432edaf9a

SHA1
dc3aa24fa8603c5b1db6d7ab793463636f12d675

SHA256
fe27292bfbe0621fa8a26548d2ab76e513fb6aa8525c2392716e195642cb4bdd

SHA512
423f731c92b0ea4dbd20decf6a25a489d938f023f2c04606149af62dfad2c318ec3b0dc92832e6f8149f30fea80ed65ff34c8f5c8afe03fce8e3a8f2edda18e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dd2807292a5965aa085e1567d623ef8

SHA1
bbfef8b2eb3d26c7e3fe8cafbec1c3736600be57

SHA256
335d8491e852390e166fbe86636da7b53299b26d526fd807570af88b84e2ab39

SHA512
c6fcd11e5d054608e1f92ae0fc1c73efa324f1d07761ce50766d7c8eaf66c82e398e7a4c2aa3d08c6362b03ca5788c16bc5ec30947d07badc018ba63bbfed1ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA31.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA34.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit