c1c724046c3cf96e30439e97b4588809f1fa4338042bb1551354a67c344ab4fb

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

13d7ed088a0115d6f9238ebc97ae1abc_JaffaCakes118.html
Size

308KB
MD5

13d7ed088a0115d6f9238ebc97ae1abc
SHA1

af5d28307c7011bc48d7bc1dc6bcd3daa2aaf746
SHA256

c1c724046c3cf96e30439e97b4588809f1fa4338042bb1551354a67c344ab4fb
SHA512

0ea19f42eec5c9e99c41fd719234a52b935a40f0ddb54fe273b4734c93b9bacf67b56cbf027a14421f003d0b4681d683fd10b21627407b37f13e110d8b80579f
SSDEEP

3072:ISWI6zAPRrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ/:kIJFz9VxLY7iAVLTBQJl/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421007327"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBF8BBE1-0A3F-11EF-9891-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2640	2080	iexplore.exe	28
PID 2080 wrote to memory of 2640	2080	iexplore.exe	28
PID 2080 wrote to memory of 2640	2080	iexplore.exe	28
PID 2080 wrote to memory of 2640	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13d7ed088a0115d6f9238ebc97ae1abc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b12f1c602a936cb2ad42a9590e580f77

SHA1
19936f87f17dda31efe84f27e803b29b55e358d8

SHA256
639e9c0cd7587053fe6d50c44417451f3494b2819ed452c7ec8e5683d7ea7244

SHA512
d05ded9dd9d61d8fe22e3084cdf04299c9647f394f77cebe5b56d63b389ebcb63432ba980f5497c6fee1b07965e7b49b18deb5626525a2f18203826c95a02dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85f9d9711b8631cd6dde4449bd075104

SHA1
a18800e839fe0b65cb363015cb5b5fd1cc812498

SHA256
c156c3c72125cf733f45c88f4cc61259bfbfc31341d151b4d883aa60c3368838

SHA512
aab2984adecbfa870d7a7d31c76841b606dbaa5157886ded207d261848b86d3d4030e1d6d368e8684c0bb07680f90efd8a782626779cbedcc90f9ff79d1f9d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b08937fa924dfff1fe909714fe4b9344

SHA1
6b1d531a80b6ff6d05e1ed20e6acd7b3ed297f75

SHA256
12c4a56d33cd8507ce2e0ee0fed475007159b1f6dbb029a95799216a8f992ca1

SHA512
930d76a893207fbce4d405fcb63bb961d95bdb92c50a0442127da5e480a788936ab14454b085b8548479bb7269b4a97d9588561fbccc62031402f217c1575372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f86363f9f87f7a96130075c2b3567c02

SHA1
e7e032ba0ea38c3b010b4d78ee7b748888c5567b

SHA256
3af83ff460282e6e0c1bb882489b8f8b818860f13e5e53fb89d8816ff8b43ca4

SHA512
be8f9bc4b5f99380de622b02cd695b793b6e2c1d46e4825903d7a4fc58e618494fd7e75459ddc63c5cbc30943975e05a9e7c8fd9e72c612f7168cb619713a89d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ecee999934f01613993b12eab9b51e

SHA1
f9b02cf3aac80e911bd178a35ea3c615184fe726

SHA256
9f6244be9f242a96360ef0b2545fcfa1406935842b95b372d2b968b72cc6ef7b

SHA512
c62811bf0eeb288658f11f5152182726109d1545425a37e163c50ccffd0bc992bbe7fe362552d865c5f1bd0c424940dceaa4c4b245e6a6ba9ce247636e062268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
378e219f6378aa33de7132c1a1572ea8

SHA1
a91b3735843a79d8bb3b847ca0b9998c76760493

SHA256
8e792206781f0671fa13818a262e07b322b071258c936738dbfd27df48d30fe1

SHA512
1ef4d0596027a465fd9a9b6f1f9bb6eaa742f646737927233c24971a4550b9ff0f558d19978a92ad614fec6ad971c5fd97bc68c23e02234ed5357531aa46ebc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
880e35e7d541984f7679155b636153f5

SHA1
9443ab86fb771eb29b933eb9fbef45360fbf8a95

SHA256
1002e4e7871d94d7a6be047395d8430d4b94b9780d284d9650401b7330f058dd

SHA512
2f92636ad5dfadf9cfc981ff15ebc772db6c6913c513460f676034328f676c54d46925e64cc3e9bb08481e4efbdf50be6b220258383c3206ec931c50de17c8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab1ae3c50d23358eeb29f3ab925ec6f

SHA1
1c765596f4e7c3d31b727365e7d5a4c4fd7902ca

SHA256
6e3aa034ffcd8ceaefb6e9da569a63d4123da3fc7c76a1201520c41aa1dfdea0

SHA512
c00aab3a8a21a86d8dee4902c897c7e9e9d0ff5a9ab967e42a2bcba6fa42d1db1ea7bfbc1ffda14b34677404711ae72926f8f5bf81862be2e0e190e5eac91af9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5fe90d175e0ee019d4b6f02c749b675

SHA1
298e56de6aebcd092e70ffe5e6bc0592b2a4c475

SHA256
656ce423c22fe9aab0f807affef6860014462c0fa851f55b8c4b9d2f00fb6f1c

SHA512
492e6a6b53f459599aeea1497c8910da2210fde52fca9540a06d4982bbb3137a368c67a28a163684f87438e642328f6f4bd2b8b210a9f6a0638a03ada0ed616e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
325c27149f886d7b7bcf5cc818252a2c

SHA1
78caa845f6b0e30e12c1a6f9f758187e67fa9edc

SHA256
7523fea991ad3dd4af185e3e745092ade6f22974b069b9909b54f1324043af59

SHA512
760304c49249a54a53cd422501bfa92b061ce7b41bb2c5cfb4be00fab7f6f381d98e0ba9619845f42264c11b1a6da271842086ae00d44fd0368b9f301813186f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7683e0897f4ba70a24aff36d40108190

SHA1
44a4d7b281748bc38adee633ddd07b68e9bad2bc

SHA256
ae1df8314dc45fa1c0ba0a2c9f6d7964df93818ae66a44710e3ebc7353f8ebaa

SHA512
d872b508db2edc823d78390c9e6717c67f9abd73cc41520d957b3670e7f0074b3713e547e921f897ed17d71c6587147c5a7722928f2eec49766d764bf67bb773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fed41a399d7c2781842ac8027759da00

SHA1
a7f4e861607337d4f219f7c1545ba0b34c49beff

SHA256
e93867f3071b6cf360c04b69db975374677ad6193ff5af2aaef5453bde850dec

SHA512
af96d200030d30ac607074a5efbeb3a12e7cb1eee9daa17d947960615008bb65359ed8f3b7ab426070003aa34f526accec629632a305c2bc8d682af90a11fa39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab262A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24B3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar263F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit