774964843fb5b0862cf8f6d3d5e66a24b30fc34bf6a6a3bdd715299a0d0f6e95

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c6abeb2754a0524a167c4f7a317b948_JaffaCakes118.html
Size

213KB
MD5

0c6abeb2754a0524a167c4f7a317b948
SHA1

b6cf991182a0ca74b64bbf133365aa2d5b10d18e
SHA256

774964843fb5b0862cf8f6d3d5e66a24b30fc34bf6a6a3bdd715299a0d0f6e95
SHA512

58e89b2285747bacaf515f5f8fc48099ea2176089b02475f17b3bd19e5a85633e9f32430f49edfbd0484654c9821ee8ab4363b1cf9b788dec7f98f99a67a014a
SSDEEP

3072:Sc6ZY5JUHGtyfkMY+BES09JXAnyrZalI+YQ:Scdx4sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{467ABE61-07E1-11EF-A293-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420746828"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c6abeb2754a0524a167c4f7a317b948_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8000bdfb264831ff57450ed287f529a8

SHA1
6f7f5d919f5b32687e3f8c64f11de7e255632bd7

SHA256
b04076bca0aa50f198d25a5da89e3332c83a4eeeec6cdcfa2fbe1a819a324a82

SHA512
64165709ea6ee25b8610aeaa972a3ace0ab5e5b31b440b9841651e43110fd5682e9a0259132e78d2afa95211ea561e84d256790c217362a4288d58233447b006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fe1e5be906999832ffa4d255529c46c

SHA1
3dfe5a1c667db59a1d6bf792cfd19e4e2f7d65c2

SHA256
2fbb7f1831324141ade4ba8aaf2d55600343aed3281c1e03cdca60a4153e3e9f

SHA512
eb976972d1e7ad5e1445f5827b356c1e1fe7076dd569dc23c6044557dc68608300611ee99f1e08a8ede11a726e1613d8ba479de00ae5e98fcd2c43c4174fbd0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b01de2dd51563687cc6983035fd15b5

SHA1
39e11955311f3d5083ff31f24b0a1112b831372e

SHA256
81e848191f48b6cc43ac9256be37d7fb24737c06026ea34f76f7955a3251c818

SHA512
6da0b25ca8b1d6bf8ee8e9ce96723641595f5f4f58f35f18c5bc466d0fbc0afd4ef5ec37fe69f72e2f14d440cada42423a45daab418c3e1e3f16ab4bd30967c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2be89a320c207fe9f1e573e920c7713d

SHA1
40e4c8c7b5b168ecf93d45eb9fe62cd69b1b4563

SHA256
9a94e86603b214cd0f993308dd24f272e51165bad19ffa5dad98fbc9e1ed63fc

SHA512
d0943804f862b70be2df3e7261a2be5e530da6d222f659fb7749c813468023191fc183f36cb707787c040cbeec6f73305e9eee9deca03ad179b5884445da1589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b9ca4d3fa014b2ab782f1c98ef0a391

SHA1
c8c4236e7d5798a4df62aadfeeadc02f178448e6

SHA256
2c1d4a2239f02624e853a3ed1d0656df21a1efa9ec1a4684286d298c057363af

SHA512
766d412abedb111b0b83b0d47f65d4561e5914f6df278ead5c3eda313bed7db8d69f53c460ec685ea5b03a2b26625427e4cf66b70ac1348fbe52390f41aaffc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c75dce0fb9984cce36fc02ec5d0977d2

SHA1
8bc05fc5fd85776e918c993b7b6360ecfd56c8ac

SHA256
440833599a20eaf79feaa77f693f68979cb95a7c1a6d02542a0e5dfd411bc344

SHA512
fcdee0ac18ee5ea871722adced53d1b4cb8089d8efc2c3348354bdabca00315760a56f64acea422b4f9a3f871b24d0686afa01fc420e17e4c1feba0ad5952740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4392d8f2dab5d921d0cda2cc8e53494

SHA1
ef935304cca39fee463f3227be27e531a52320f7

SHA256
a796700e1e459b05c5effb8d1e054482588b34816042d8669d45f77b183fda42

SHA512
6e3929df284cc04d435647b5ea2e38293b42a23e8ce64a41fe46444aa5b360d5ad988dedd44817e5a20e869c9d61aa2887522ee850729d4183ac3fd529acfb05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86985065ccd136629282ac6f375adc94

SHA1
cce44636bf4a32dbbbfef43f4b6e7ddac17fa747

SHA256
9df186f8f26c960d1574ce290829a812a9f39fcab2ca26b850c4c5ee8e891ce4

SHA512
58bbf35fd79aa8946f5d68b219fada1181370f70d6cf78a75041627ed007b2ba000334da180b4ee108d380821326a980b352b27d8fe0cdf9c4df12f4199f8c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b374a7a60f1528732fba5857ec277b22

SHA1
28f66f8fbb80166bc5d2a2df05e5ed542d3f4fe8

SHA256
4d4d67ec76d3198aa3f5f3ef722eeddcded61fa3d1fd967ae631ffa07624a4d1

SHA512
de31e85cc303f16283ea92d72b302587998020fe2dd6c02be20432064a75e670e50ac9f0ed99eb06acd4c35b055ab5f92538aea18b4d22d0357552c34f2b2847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
375f6455e30feb813e4521467ed039aa

SHA1
9f51c0678d1ab53006615f57275d65aee964df7f

SHA256
c6791e38607e77a3a8dabedfb209c0b2b71322b370e37c4f22e678cfaf12c218

SHA512
853c7c6d07dd9fc9252983c73fa4e6d36fa44e5a982b8035f600924ed84f60c79281c994c3e087ab115651547be149e08bb6556c681c347ef80c77d297e167be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8aaeba3f27001d3cd32703eec41f4bc7

SHA1
08081564879b66ea9c36962c2ff3afa6ff66e187

SHA256
4d27b6b6d265243b30df770a2bb2a08ba1caa516dc4c247571cc9e0f1c67a19a

SHA512
1410540f84ca6dbc46eb872be950882b50e08112b95a27c8452d08f5cc103c7bd3fb7f33fd66ed0810e7d40fa0cb98907a940e1cc49e20489e79663ae46d3ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52cb4670e3e5ea9283cf1787d1169b02

SHA1
bd4c919ce65cfbcccc60f2d66e0b68cc2987a405

SHA256
ba2b63eb85d680e3b1e26189ca1ddf121f8f10a71bcee46623aa79e3ca759b12

SHA512
df887d4a19d40bd2b9df76415b9583f5de62c6b960b5ac78545b33e53db87b08a9e05e3b2f99b83ef418627ebe5b8a2e4d6fdba2215c995a153cab098268d82c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53fa55439a9091b7c2ea66a1841ee8d

SHA1
00bf1cd6902ac4719094b79d7fc356e292f6e773

SHA256
5d6df21340eb0236fe56c0253346cefaceed61176290a13f027a9fac1cd01259

SHA512
51ac0951b6eb932e9c9b6adf5e74bb3762d82de4e6ba1f5b9d297a99a7b9790c767c9728e0a7ba33e8285af87d265f0803bd478ff373609500062e52a88520ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0437fabeac93026d94bfa490caf3bc1

SHA1
c321308fdbd210137f184c5894746a9c0ee74b73

SHA256
d25c47af6d57530be02db94c1ef8bebbf6947544d696618040b950e4ef51a831

SHA512
437c4068fc97d85f212ee716d3f442cf1ffd0d4f0f1bc3581f0b0301a4f3d6dd1bc1e35fe2f5b6494ad9cf420c0fe379980780d5299a775145e081fa0e2fa97c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bf052e87178260fe3b1c50ed7405b44

SHA1
eeec987e5cd3dc0839b523a52d3aebd5ff229be1

SHA256
1c1bd8b6ce3f2f7f24ddbf2adb08c1c3011350960845997f10e4545eecafda21

SHA512
2d0e7e8afcd51af359a0f87c93f4d279c3a29c793f00b6e95f21c5bcb5ef425d5be61347c9ff73704248fddab8f3b14b8219aac4a94580c7b8e907cf17fdc0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb5aff1a8810c01186ceb05d06362085

SHA1
09d7ec71ba2a8c2dd33aa498218dce7726941246

SHA256
b5e3aed9f9c112bc1d4e87a5804da941803a0aad9fc6ed1dd94c6329f0541d20

SHA512
bdfea91762d4b34a1ec34e0c461744bd502f4098a5b1815609fbdcc6b6f196ab47ef8dda3571fa512e1444f27c49ec75f33ec64c19ef888df8752b5298c694f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6703123897a099a34b69792a28143dba

SHA1
c62233aaf2d307ed3322a47dbc920b2717f164ee

SHA256
c03a83db9d533377de6680e5ee64f0585e11bf2ec52feb3bc4306099984010b3

SHA512
61de4ef15fc967b54ce407aebbb17cd45e0103d82af3e1b29d3f131a8c056e1f40df4bf8f7f5af9cfb0141b6a354d9a45c50bf5ada009daeb6518ae759d92b28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
791ced5d1b147098ba95e891d6000936

SHA1
60737740dfc347d41b1dc3201015d3eee95d3ca8

SHA256
29da92efb94c3be2c7d9ab884161134c9055877570a84cfeb2097cb9115100f3

SHA512
5e952475592ab5daa121a3a9155158a7bfdc1a43482cede33232136186423ab045289538ad39d2562b46255fe275fb9e97e3c2168bee71b58285e4a371e71eda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13D1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14B2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit