2ebbf861085b47e75d975f10bc4b5ba6e77c532bd83d4730a5ad55570c9d2c98

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

399eb14f505f372999cfcc39924f1451_JaffaCakes118.html
Size

57KB
MD5

399eb14f505f372999cfcc39924f1451
SHA1

a94a470cb8da36c43eaf6bf3e104e354d9396523
SHA256

2ebbf861085b47e75d975f10bc4b5ba6e77c532bd83d4730a5ad55570c9d2c98
SHA512

148d2e302414ba920aad6cdd2484e82ac8889f024a057d0d358ed1d5c3e6e8aba2c2126d90779501a29354c165ce269f3ded670af453ef2407450ab0831338c0
SSDEEP

1536:ijEQvK8OPHdFAHo2vgyHJv0owbd6zKD6CDK2RVrozywpDK2RVy:ijnOPHdFT2vgyHJutDK2RVrozywpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000003b22faa46182d99d4d0ae5efa229ea82ee533af7ff29b5022a3faee57dfdf35f000000000e8000000002000020000000366a5a673cc3ef3bea9422914f44074ce82742fbf635cac928c1535249eedaee900000007a57498f8e33d15c4bd6a63b417a95a9a7960680e5f6e1dbc25f68fa06e1c605021959b9523f9dcf05c74963bdc265f9c1693eaa97f53f48c7640d6c1c6c1267301a795d198135c13a247fc12e6c455e3dbeac18cf5b71535521a2f8dac6239d606d1f17d1ddfa65f9878100ce991c1a59226df1e08b60b5d9c8f3207b31a9137ebad09e6a153a20d1b43e6d50026ed44000000023086ff36a2f4f49e486e8b403484c3052ed63facf25514ffabcd24ba80c56fc58d3d36be5dfd552afe6a6962ad4c7ee07898b3841d028e4fa3f423bb244b163	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426872102"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000029babca80c471d9d1a2abc07198b5b3509d4a4c79418fcf9a7ee5e1d9f3e65b000000000e80000000020000200000003fd2451495c162050c0bd523790dce08183dede9951b6d7da80c3ee3513d5e1a200000008363819af17b4c00e884710572e973a53b369badea271128893e6412a9ee1e3940000000a950518e21efa63630c79e269e2d0662aac8c4f93f143aaafab2a3edf686666d0090b4580377e650027dc0efcd2f1dbfcb5747d666f47f226ffaa5896b7797de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA45F791-3F96-11EF-B166-DA486F9A72E4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01d82a1a3d3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2780	2144	iexplore.exe	30
PID 2144 wrote to memory of 2780	2144	iexplore.exe	30
PID 2144 wrote to memory of 2780	2144	iexplore.exe	30
PID 2144 wrote to memory of 2780	2144	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\399eb14f505f372999cfcc39924f1451_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e19aeab2ab520c8968584fd5412dd7d8

SHA1
48153382864ff388da9adabddf3ad0749e4b2c79

SHA256
1a879fa28bc2c1521559948d15c0f6cf8a61475136f5348f7236dc986861c51e

SHA512
37d538e1790cb5e672803d7c3034276df0f5a9c5adfd6b68b5ee0c34df9760bba69867cc2acdcb54b15bbc60702653d18cbaa77d8262e79d3c56316f7b8d3b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f748ca901249bf91ffa72dcf6d33ca2c

SHA1
5e57ddbbab2d270b2be7d3accd7d78fe4fef671b

SHA256
9e19669b9b64d5f824128d5d9f181518aeef4ed3f85fddbfc752dd67bf90e97f

SHA512
39e4076c4b376f4bc1ecc207f21a591814f57f582a22a3d552f2dd99b83955c0916eacbc37b91ec71ea33bed8e81f1bc1ae06445ed88c759b547efcd164b3e22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c279a27dfae6043c7dd37313003b334

SHA1
557b8a2daf42832f6d97f29e1a3efb8a575ededf

SHA256
911c15f082d5c7484dbb6ebf87abd314c5e77fd816297637fc85567715d78e0b

SHA512
bb13db6518f7d631c278347eee4a9001c90285bc22ac1b48573c51b6b94bdfdb0067e6616b5572e9669ffd6e9a5a20acf0f0bef9879d203a9b0439ba6381d2d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
765f343b403fcb8574354fbd22baee84

SHA1
6e1a14c872984e25147d2b3fe3646bdcc04de0ba

SHA256
d18ecb8fdcd0821eb3c53b596e3f3ff4b8a03fa848b8e70c8de7d629eaf3c736

SHA512
01380c98c15add98f922e1e90695a600a1c656c6ac0f4bf460ec09d860ed6fef2d4b82aada320c26133b12b69309f76f3596250966c91cf480082ecfdb39f0e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93ab49a17cf4b8d4d32534b5ac8364fa

SHA1
71c8943ee247f97f16ae81c2faab491aed3c1d0f

SHA256
52b5d2195e0a51fc4ba0dfeba02104fdb521cd4ac46294563cf0426f185fa64a

SHA512
14a69c95ad289cec8052298e9e2042f7fbe456682b91c600718075edbf1d5cc05279abc9c8e9032e1f9af1126716b23a759c4312722a9eccbe6db2f7cb1e24cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
385011f8f585c3c6de88475fbd25c0e9

SHA1
c81abc2c173a2d0fa458e08f93f14b505f6766a8

SHA256
b605229d1bd4a61ebeec8fb007e1f945a674b0e214f8a346ad587882e1171c57

SHA512
b77d409a03b95b36e2eca16d67958ff83724716f0a1d65aeaf7c5cf374f15d5a1bd39eddf2a390f52d95056de2d63874745f602c7088a5aa31927d3f17c5c0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abb957440a6c8687ca7f76f21d9ade00

SHA1
15de195d373d9ebd267963cb1aa0d201b4f5950c

SHA256
025fc638f88e295dd953cd987d4cfbfbc5b2bed639562664265175b82ba87bf6

SHA512
efa916d7392618789541c95b37d801a9c9fe5b1a37ae1dac21726ae5f437875185dcc0b52c8c14f7c313ea277f6227b4182340d027e6efea4af3ccdfe2d524b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de1a16dd9e51793d85bc7c0ed5895bd0

SHA1
2be73021a785b47a55e47f0527fea8e2e391ff12

SHA256
92d5ce7f6c41abe42a743bb778c14822422a37f3b937fd9d8b5795a57f4a8428

SHA512
f764264d65f8c0839f40fda7db3369b0608a89650423265d5c086492dda7a5d93f37c4c1e0fa21fba81a9ed59ac3afb8efa61f8bdf9ad6e4560b73f18068cad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4000020923b53973c9717839213c169b

SHA1
61ab8b5c82f4227e593acfb31381a36c7d2a7616

SHA256
8cc0ccdb63f7f97807178c17aa1615eca50b6fef28005ed991396e0ef79a1591

SHA512
8e2f3a5dd24b62f240cc7dd741bb074e58c89eca5beb7ac86c59ce558cc1d0ca8b769f26ae4e744abca254ecf1a9cbcf72ebf4f33431bf2456a896a2043ed313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d086fd924d5665090d16610abed687de

SHA1
5b50960774a0f4f40405608743a5c095104f2b70

SHA256
2570a8dd6b0234a388707cab026544bc1241e2c1c42c6b7c3a06f17f18c6aebc

SHA512
b35a3d5d0c8292196e6f1d9975daec769464111efa7212a015eb4450e3c6d67a6bee4eceab8cc457e16464b2da9db25b44aee6d426025504741164be2d79d7d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5d15ab0dae5118bd9d1ac8eaf7031e1

SHA1
5e491ddfa91dcdd157611877bef0a8a539282317

SHA256
95c90d37539db3bd4aa7a0d0d50548764e654feba79d9935a040db89a4a82b78

SHA512
c125deccf4540e3f4812a1fa5338382d015fdff2af52f991a75aafdbb316f7f38e0dce48a73670046eed35ec5d092f64c6bd451c8a4ea614d4d948d7825f5ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb3dc70adbfa81be246d23d713e3fed7

SHA1
5780a80af8bea99eef03a3ec0afe0cc9ef094a73

SHA256
9ee1cf2bd7bdeefe0755a1549fc263e76e0643e8b77d39b1b8c0c2823bde60ac

SHA512
c1f32854b3ce482f07260a20e0ec310e84144622988f6963a65d04235611373a7d4eeb7ce4c39f2783fb87ad2eb239c421eb0cf8d2369c91ca94aebcffc46016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a75c69076f378daf183eb8bcf7e991db

SHA1
8a3f8c4f33d05cff1c68398711d5107486508b5e

SHA256
d744d20842d9128a6cd1af7c37f1fcd3d18a2cd4f3159cafad8dc0c5f6138a51

SHA512
b1ad89440eae84825c0f238c4cc90185b0d60bfad169bacfb61e469ff6540fdd55b8e24d734e1b613b58b5bc1cc147d5b1480592b022f69499c55106d8a5e13d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e93a9ff59249e2e14ea2e8043ff272e

SHA1
c1361b5fd7923877173149c5bceb28424cdfea07

SHA256
446415e23fada8be12b9ffb5a4b800631d344422d8e1328e2b7002df6d1fb392

SHA512
8f1a8ecfa3fe2cebf4b324be812efa20c9cb14b5757717a59e892099654ded4f109d9caa32615ff95ca40c46cd795038a8885d9c03b09005f9f6da56455f41a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98be8bd7abd8640cb37be04431c6b0f3

SHA1
81542eb2891349711488f1546ad7d49cf4b27fe6

SHA256
091e9a102cdd8bb36e68e1c3dd979fe8f7def49efaada766abc3672167fa919e

SHA512
90a671bc2ce72ab4a4c19c08d304d4d95814399906fe88c833463990150fb99c137c8964d62d14dae7e048926350f31431d5c48b73da57faef1ee97152010369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d905d2a6ed110456f68021ca7d157da3

SHA1
faac2fdbe76d64bf1d5ae2f494525ae64068de38

SHA256
e05d568a6e64dfc5ada382d4aefc3cdf55b0573bb4a494c86b6578fbe0c7b016

SHA512
0bfc4de4784534d6b159bd8afe0cab8229868dd224357eedfad8dcc3930bf65d1165f77796476cfe6c81726b2833fa7047c582ef3acb1606f16aa05d1ba4dde9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KJ834MBR\f[1].txt

Filesize
40KB

MD5
ddad3aa066eb8b57d23a255262072a7a

SHA1
21a7a31a96b9170582a005207ae458425f0e2418

SHA256
0bbec5235e834de63d78490b49ec41fff5f0308248cc2e00ad210f8ea8097219

SHA512
ea7b25ad4327f3523f1a336bcddd6ab78a07b0fed720de4240d423448425d755c470b4606891a83c4e3952b95a08d0335698aa6ca8515474b3647600822c4860

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1557.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15C7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit