ffb9ee12ab51a09d91c734482e191c0c147a8d98b56c891f7fa059b4b9d469c0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13e93214a008c2695638910269efb2d5_JaffaCakes118.html
Size

56KB
MD5

13e93214a008c2695638910269efb2d5
SHA1

bf6bb7548f384de3544b9917eb4b44764f451e00
SHA256

ffb9ee12ab51a09d91c734482e191c0c147a8d98b56c891f7fa059b4b9d469c0
SHA512

fa8c95d8077ba88be81d88638d67aae318130dd74e5ddb6acfa946a5eadd271f9a3969e5a7f1526ddcb3983ef85a9cc5d6547eb54d639737355dec142f29a3d1
SSDEEP

1536:mV7pPUO8AicBG5iZo+s/0g6uJo756sLjwPf80YPYS78DvJGmUQuOt71UmUKjRYEp:mV7p1NNsIOhcaEh/W0ZQU4hGmUQuE7aw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421008569"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B03F9921-0A42-11EF-A140-5ABF6C2465D5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1696	2212	iexplore.exe	28
PID 2212 wrote to memory of 1696	2212	iexplore.exe	28
PID 2212 wrote to memory of 1696	2212	iexplore.exe	28
PID 2212 wrote to memory of 1696	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13e93214a008c2695638910269efb2d5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
57399888e128bd6e2a4ada5a681fa29e

SHA1
61bb10995584b5662fa9fae621af71fb2c1a9121

SHA256
9e0dcdb671a9b076fd66ffdf032565b7762b4db641982b95840d7ee7c9a5ff88

SHA512
005bcca589e9cc14b4528872d74a9c4e3ac6b3d26b2bcc9d1c6afee0815dff7fab38d70fcc546f5642542f3057725d695cac07a30118816026715f459d74fb03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e216877ba5f2ef116dcf0dab499b804f

SHA1
bbb0ebdad219409579b45d89fa00177a5bbbe12c

SHA256
9ce2602b47ce8fbea335142e22369bbfbd46e5d4e50a2feb2690203fb1de84b5

SHA512
d5211acd7b6bf0c50d44d9ee9fe9293dfc1a388ca4dd36dc54e2d5496d9aebd087577cb1f994b71e68afdcafe9e5cba0a532f9a1359e1757bf8cb50011b5d999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33cf7b31775a6aaf27bcaaa480bb042d

SHA1
20853a725feee05bc937b760a854147a2aaea321

SHA256
64acf0804f08fcc5072778d787198fed5d16be7a538cc777915de21b9490d63d

SHA512
40c413ed0f33e6fb06a350727c8e4294993de0487032459f7903a3fa6ce2e46eccecbdea07b5f20800bbbdccad04497806a7a1e24272a01be5647edba6b003c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be6b31b8789007df6fde864fa2489b1c

SHA1
7ab9af3030db54759ad7226f7161fa158ed640fa

SHA256
211cc23ba035e688d1621eecc03c74770bd1c03d56c22cfda87f270f5d8b8830

SHA512
f7898d1dfc8e1a09882ba2efb7eeb6a7ba3b4184f76ca7e00ac28fd54abb4ed768fe0aa38d4bc674d76a69ee1e3fbc0d0ab567ebfab459a6ac2ada1fb96cfb43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d38d6e6c572136a947115c1c015ebc

SHA1
e1b9145d1d4251b6d2ffafc5bce72f530d866ef5

SHA256
c39461fb119ea80c80f920b45351c4aedfbb3c88a2d8047d0bb2d0f5f5d61207

SHA512
5b64b19ad01feb3195a01739c7247b80ecc4bc98c8af7f1facc0fbf8aae15e1ac8fdf1935404679ee9919995f7485d4f1918c8c4bbab14022b1cd56bc2859792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0a8ebe04136c0c7fbc064f57340eae4

SHA1
54d481c4eb18b178ca599ad67cd8dedeccf28796

SHA256
6f0c4f10a643d64778f966e99986c475559b33beed62a2c6190ce1a22ef8524b

SHA512
19bcbf2e5e39d45e1a44a8279ab49d292f1992aafa6c7995595b3bc420182ebca78d9ad7c3c3df62ac7871b5538dfe458e29707e971139864e43d297247694ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe077fffb2cba42d0bc6427a71a5bd02

SHA1
1ae22dbc1735747ba3bbd337a1a7b232d3445d8b

SHA256
8a1a48eaed669c19232c50423dc9e01856bae6d08b2677cd92c2c5ff4d6e1f99

SHA512
0b4c3874c02fd5f94a090e45ffeb58159f633863b7b68df8631891441d8437743e0ca431a2ab2e284cc616efa5c4b3d4800cb9568d147968ee859f6aa7befb8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f82766d64e7365b75e9bc0e743fa933

SHA1
706dcac3be7a8507398402d60a240b7b7f21a594

SHA256
051117dcc48d33f22391d9d995f9844228eee65b1514afdb50be36925ff35013

SHA512
d3f70481afbba14170e6d397699a30b25de2591a38e713c6183bd0a9fe5f03451d41d307e69055d280dc69edd6b8b8f4ba509b0bbe04a45e4eaea990fd280fdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c61f98f749ef5eeb2893b91f45563176

SHA1
1f18c80767840b03d625f91ac3a06aa57aebc9f1

SHA256
1f353e39e90a9a5e4eb1a3790adb8e74b36ea2063adce811ff53f62b096da7fd

SHA512
497116571804c67412f66be070d92fa6360b24000ee30ce6c300833762aa0aeea0879da439ade7406bcdf3f818b5704e71693c976852807e65f44a42c206188e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0950500d18e7bc7f5e202847914c592

SHA1
ad8cfea17626fa51bd30969c2070919a826766f6

SHA256
5f549675a95911bc0b13e7485f2e780334659db398154ff8fd52e90c46efd5f8

SHA512
f0f76cbdc658f6bb99ab1d9a38dd45f30114b19295a75d98b81324b34e80af765cdd6cf1c43ebee8eba9d51bb03298aa59871eb71312c17aec4dd1074370ef7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a4b64b6d3a451fdf803fd7ee493436e

SHA1
1ebe7c9df01090599652451728b66de9ad3b132d

SHA256
22594e4964db360d2a163010d1cffc9910f1fb5545c395c08ff4777c2e698662

SHA512
12813e9f672dc46a3ab7717ce66b2fea52c8dfb1ce4752798528ca711dd3041a454d41df4960ee98d0e42b45b3b397ee09a6523ac678858a03a78c7b81b76673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
cd187e4142c4f4c015893d66c54b24d0

SHA1
61ea31d8c3d8912412e13c21b6841962995e0960

SHA256
e150f01b1e65d9e3fb1985621a27e5978f6b0a7a7ca70ebffd836f06775ee878

SHA512
97fc2f013225e195bf02d460495333daa0a2d0c4f6217876b6a2d71559f561a1eac6eb47f1071c15c8671ffcb77e6252b463c0e00a6d9929358d0888a95dbc95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar258F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit