c56db829e6efb0ef47de90000253ba6e2db870f590155d90d40affde3788dd22

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24a8492a092345a15ff552fee86cd61d_JaffaCakes118.html
Size

139KB
MD5

24a8492a092345a15ff552fee86cd61d
SHA1

3b6b11671d41c3f169efcaf1114b73d41c8fd1b6
SHA256

c56db829e6efb0ef47de90000253ba6e2db870f590155d90d40affde3788dd22
SHA512

79e5eaeedd0eb354a25c9b2177d0ca59dddebd64b22255845d2fd22573781697eab198739b6877c01f8c4fe3265c6e18b4e3585536d2fcb7e9efb7467ecf350b
SSDEEP

1536:S7iXZPzX2NlMyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SGlyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1814111-0D2E-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421329809"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1760	1928	iexplore.exe	28
PID 1928 wrote to memory of 1760	1928	iexplore.exe	28
PID 1928 wrote to memory of 1760	1928	iexplore.exe	28
PID 1928 wrote to memory of 1760	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24a8492a092345a15ff552fee86cd61d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e28ae804bf7a9108bd24b609f276a2ed

SHA1
e0919ff2dfb5fe027a681cf29a1a64d826aa314f

SHA256
1c1cf5907f275281ae857fdcfa9beca89ccdfbe6a329e5cfec4edfab8a978d83

SHA512
14e4d0996ac3e3b3918bdbf068cecc1b720c82bdb45b0baa478e91388c58f5c4216fcd5274c3a3aad0455e636852192a049c085491eb30b1c0aba96252b56a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f95b2007208783c7907ba1c58539a14b

SHA1
55f26d567c377386905c4befa59dd66b6212f47b

SHA256
51a4f8e5802afb64a97111b0d9209906881bc8dc956e41956636ceb7bde0104c

SHA512
d237f678a1509f250348b10a850546d43c5fcb12f1296559b6ffe6b6f646bc82ddffb01529677bd6d74dde71080d28dda75877b6b95c976e5876c8762dda2c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b06ebf553cf47c8b6a92786f2dfd5aa1

SHA1
281059e1ad5a04de347ac2d8b169aa2912b42155

SHA256
7d38609b4e39f04a1b594a95184537233358bc832891680b367f3d280cd32c76

SHA512
bea162be06d1bb932a32099e633f34b2a0bad4f0bfee900462d0e7b0d6c92d827b4aa7b94009cf1f0c7399f9cbbfdb64226c109b78090f9c14ad5044d8cd91d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2618da93fc4c595ef99b2e4ccb8a57f9

SHA1
9016bb1ac5e3a398765c2ea0241c5209910af958

SHA256
fc2997b3830c1771d7fa524ff200945633a1ea99dd31886cfb8e8948415fc150

SHA512
4c5e5e2810e1de1ba3e610d2f74a415a55327dca22c0260638cef19d5b6d9f929c8c468dba5a688e2bbd850ec9a3f4871feead9e346ad7981bb8e8ad4a3cec5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7daf1d3f499d9134d437d4dbb687b9e4

SHA1
43a0306a52fbb76803f3234cf62d001b8a6907a7

SHA256
826a6dac1bc844c40001080317ad92d862b41ccf92d89a57011cdd27552f1d7e

SHA512
1c0ea1efd909fb535117d5517c84e4e47854f64aac19cb329ecd0951ec1ec3045a5689e937b059dc793d93946f7d79c6cd951cd9bc5362afcd14f7d9677ff29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c116f2152fe93d862f2eddc61f00346

SHA1
9cae406c0afb64f86c99517cb06e7717a76a4181

SHA256
343f18b6f9af2b5b718a0caa6ca7eb0b44dd2d9635cd81ed439bce72d2d40526

SHA512
d08f25ddc85ba327e6a0dcde3a669fe1ea2b9d24b7b1f44b4e26c026c59a5b282ba0b233dee1c4e0aa65cdd64b1e3fe35a7e25024c7855031a3de2118f2662ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c35501a3f9a6d31ad7b2c0faf315da28

SHA1
0cc3951fb519b7a337b63df4bcb9db6cd189ad86

SHA256
ca381ece9460d05750a9075015f0d3b739b0b5606c4b0526c1dfe12807b550c1

SHA512
62065ed248ac9f3b29e960f9e280acc7b95511c1d53a4b04fd69091604486e72eea8f4ac9bab01bb68c2c34493f6cc1637fff706164f7175e6c934de94fe14d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9419ba0b82b00242f9a145721bbd453

SHA1
d1acffc0742450e42d8ced426b26d3e9c4832dc7

SHA256
aee70f2718595ba4f7c9fcbb4fee08afcde96cd2eb8b8175c19c5b6712884cdb

SHA512
01e059dc7948ce9e35accfa4f53b4c6e0010e1e4a23c0a34fa740c3bc8714ccbde4c8dee0b270d272da8b4c79e01c89f4d29f840260a16e354883aaa95b68449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16066152a275dbeca09e72d5e63e9c3d

SHA1
b87d1c21e9af1a0d7052b47e1e17bc37c0b920d3

SHA256
2d4c381b176f79250417e366265ed6ad475102d90d643439dca7e0e6088d1d04

SHA512
f4eff13ea02868c71e97f2c86f06ac1df04a3e67df55df411938aa8a3edd275e21d1635082e5aca6472ab53d7dc5e4bd4da3ad048b89c5cbec1334e906bc0016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe41ea0949d3c185e24f29f0fcc7ca6d

SHA1
84034d96b97da9312f259c6bf34afce6c9cd35d3

SHA256
a9661b899054381577341f83e12456fed285eff9175d06e5d16810b79efbd6da

SHA512
d3532d1f0090d6daf92b268d7f731e2ec4177f7441f348c1be0d62f55555481531be812cf60b826b04afd791c71c2fd33dfd00abd5437c748595458e8534bfc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac0891a8682be63e99481e2323443159

SHA1
26125ecf72c3b1a97832ca212b8ec57214769787

SHA256
67f047cb433403374414b7c91b24092e6b195dcfa754822b6795673030515a16

SHA512
cf45860c30885bd72435a64760e0fc30e1ed175a4f3eecdf48569491d92f34f21307e1393879917b67e94a8f986195035e2c3ec702a39435af9320f8ece6f187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eb4d66f3e734d4d01272bf3bde4a436

SHA1
7a5b097612a8d702dcd9b27139813cc3aaa92c4c

SHA256
ab4dd9fc1d2dc7cf82b3d8d2a02676b493bbc8f6193607b7fc171c9d905f7829

SHA512
2437b8c304c4eb20a04f2f24f0bda2c94f32507e5cbe1d7c6a25d7eee8f99b87628cc0ccaca19c8d9e5d48ae3282de5f9dd1e9546ec611322460804b78344601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29c1e20a0d3f62ded27baad23a201ddf

SHA1
a068fb22eeebc1cf1f4cc621ccabb8a4006b31d7

SHA256
cfbd9ae16c5ee3625f3e8ea63ef47970409b65d65ea8d2e938bd6cb0268c63d7

SHA512
819888fe4d104d637ca7401b1dfc2a4e6a9c0f520a13c00a80b68d68b49e87edebc56e3d5776e393af5e8140d2bb1fde36568af992a7f2add064af380aa2b314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ed6cc0af23be47a48134a63f393f3b8

SHA1
479a277a8d36b93b689c6c745fad858e92a8ccd4

SHA256
3c12751d5927c5ddc4abecedda0d1525bd0559824ba07ad52a901128b8912ff6

SHA512
e0aa4f65191777b0398c76c5dfda3c7cc1ff8e884fb005e58d8813a05d364c24720c32820a9a24ecaeaa12df2e0fdd3b001e580d94b332239b11a4efc5d944ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02cf872409878aefae20541b1c58d2aa

SHA1
1d521ccb1856e03533bb90659f0ad0e7caf23adc

SHA256
2163015cb367be72cb4611c1a535235faf956811440a8bd64f3340bd2ee34ea3

SHA512
20ccf25c9895daf086c13d3733a9d2b86814c1c3eca46be4d841b3d038a7c914a755286ace64d92b7e45803eb062292ecf9e70029d9b256beabf6fa14bcbdfb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1abcc8cca1b03140cc9db90c763e7d9e

SHA1
a094c602228d5ad3dada2522b2504a2f27edab5c

SHA256
483b6ba6bcfc312fc4110a52972cc6cc89cdfa9cf73bed3af4f94b4b6f7b7702

SHA512
b9835ca228aae8cc080e9344a6a583454a410877e81728da9a5ca24daf60ba41bb70d7df66500a3241474afabd3182f1449b5813e91c07309674476fe6993a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05ecb03b88e07bd6ad546ab1a38a5df2

SHA1
01fe4c537c0b49fe2be4e0fa096f9528192317fa

SHA256
c2c9f2569f362b395a3fd323846aa0e2888ceabd407cdf95df3924928dde57eb

SHA512
20ef1006fe4906f5f1f2bced0eab15e6078f1f87944889ad65ac367dc44ca9c820b449b43dadece81b197431fa87aa44f29258661ef550fe96abc09a348aa097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52f7dd3535d969bfd205f1cd6454800b

SHA1
3f58e3013e4d2110ffe02fcb27024bc43812846b

SHA256
decfb752ebc633157e7c9c0a91185216b896b1efdd2996153208a728be1d2291

SHA512
31e451013050c987b43463495a60c18297657ad71e37d728730bcd424caf114f8f123a97429be17f9abe4e6adac62652c0386a6344893743c9aa3c58d0845d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c6d33771f57ba2ae8ee3267a67a9cae

SHA1
39aeffa389ef3331fe965a3f6ece184003a33fcf

SHA256
187ba75ae53f8829221ed0237c25422ea66e2ba3705b223db0633fdf29303f49

SHA512
1b0cd39f393ee72d6935093edf2a7a96ebfd8bf47e6513f10afcc869250f243853f29e19af531a3019c4adab8aa2d46b58173b19643f1917377cd71abf1522ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E42.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit