0e32061713e62408ab39642f787350021c787920cd4b16687f9760465f891794

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24e68a7071790dad392fcb906472ff42_JaffaCakes118.html
Size

143KB
MD5

24e68a7071790dad392fcb906472ff42
SHA1

c6952823aa6024456ce19a822f6cccb4c8af06b1
SHA256

0e32061713e62408ab39642f787350021c787920cd4b16687f9760465f891794
SHA512

3834bd821c68516cdf0806509099b5cbf6618f9207a4e204349361014bde3025e82c0632eddb9ea1abcd44142fda9eeeda6153836ddcc849c59ae362827dedbe
SSDEEP

3072:S6u+BhEN2ex7dyfkMY+BES09JXAnyrZalI+YQ:SAi2ex7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421334274"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{082C1391-0D39-11EF-97A3-C6E8F1D2B27D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2444	2176	iexplore.exe	28
PID 2176 wrote to memory of 2444	2176	iexplore.exe	28
PID 2176 wrote to memory of 2444	2176	iexplore.exe	28
PID 2176 wrote to memory of 2444	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24e68a7071790dad392fcb906472ff42_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd674c85b30dc1403602f604daff8106

SHA1
8b828921adf3b0b3db06b9a2095e0b992abaecdb

SHA256
40f14e71c09ee6a0d9afd350b06aff42cdf9218cf21141938a4852114bc43947

SHA512
ae9ffd0c6df5395217655bcebd0a49a7d5d3ee20faf9b45a4d7f042111f76be4801b6f4f3215a87916d3330c6bd5adc1b6699adcf141c107daa6397f74fac24e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d0ba2dcae2325fe673c5f267e9c2442

SHA1
7bdaa2a3c4ac6d362b0aea7c33e2892131e8368e

SHA256
54ab3f90e2f54f3d1d3164554b66087ea2b9fc47f53b75eed264ae303ac6aa23

SHA512
f6431dd4093b3a5cfdaabfa17c926a454aae27321b0d1ee1edab997e4a336989ee4763ba1064f566d8588139005a7cceb8b181b3fffe48dd29dff74f6544f4ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e957916e064f5704355ff66f6fdc8705

SHA1
017b5325bd34ce377a9b06ad100e31c31c1498bc

SHA256
f69f0a6a5e00a941635048f2019d3f39510abf4a6e18b09d69447d2b6f32d5ad

SHA512
4e9ec6014977b6450dd8ffcebdd22bdd985ef4089662ab9327fd3f0984bebec6253492ad3f4cf7560b7b02243711b989b6ec37db491642afa092ee87b46cb1a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c20e191d8b45c3bf7d3c0debcfdc5d74

SHA1
90e5715aefb76c884558b8eb12b9fb1341e45199

SHA256
f8837056a4a18205527ed491268e5eeb4f3b8dee981b8bdf9dd155c5f8b1ad40

SHA512
e86d6cdaac1aa9c99f7da1facc3d833e0853fce05796282761a351620a7e6ac4a1aa8d2c67bf64f05af5ff306cc2069db44eae80a915ed8d3930f1f23564e1b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
870c49926ff7a0bf25dabaef7d9be346

SHA1
84c5a5fb1fc0f6fdc8cd1ade499fd28dcfab3517

SHA256
ad4cdd270957fc9de69e0ff559b88006564d9cc7d69cfb3234ef9980eccb1c4a

SHA512
f876939a8b10ba8c2581ab54e965edae06cdb84cd86cae362e1b79136843dfd48b197b5efb90d011fba89d90336aee7fbe8ef967e2dd039429b090bdff6ad0b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06238777b542aa53e28284a67a091528

SHA1
14409575f693539f1651baad70175a2f09eafdd6

SHA256
afdb906b8e3d0f51f170d3aca9d75cf9a102fac439602efd04a2ffa497e8271a

SHA512
433a76dbfa236920c2e41721d7a7bec1cf0f7bd3ec149dc70041429516a1992184ede0a9483000477171d2becf9c3201981e0e66e6ca462edf38c5e89d8a6034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74918fc6d83725714260687ee5680db1

SHA1
7ec9165bfbe367a36a4c3c822e4479e3670b276c

SHA256
b8f3349c7eaa4577247fe1cc60515251b702fec4ef9ce8296926e56c98fc9787

SHA512
5de8afefda5788f10e1a5bcffea831fec0b8d27842b0ae5facd6ffb74b3c06803eb70e3bfce89110653b10bcfcc9faf71d4d04fb42e5c79084b4e348b83eb6a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ca9a2f7a268a09cc3f2fbbba43503a9

SHA1
8687ca3c1a7359efbda7691c98acdba1e3a845be

SHA256
f81a3abdde229030c06654ca6d13e200622aeb3708cf1fa1575b6683e4ae7c29

SHA512
74e572558066a146734fdce7a7f2108540b7c42291ae4291bb0d01f5566883c96c8e2204b571006fe909192eaff2f4b687dbccde347c16bc149363414b4f6930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79bd41e043e80f0501dd0eac8e095017

SHA1
e1da331964cdc95224ec4db30c5905d8f4dd3e0f

SHA256
30cdebf9c684db115ae7024f817ee570901e873383a86012a88e9b44e3012698

SHA512
d9c44a67650d03f4de0e8d30c1bdf45429295902e08e014c58e3953f89356791b433e715925522d0f7d5c6dcd17951072de94e29832bfcb989c77054fff5b4f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a74433f5bfe05d69ae2db8f40ca6fb67

SHA1
7a5b12536b62489cb0d257952c8717fda40a0e27

SHA256
bff33664d86597f7cc101c7afcdd79e90899dd307f7b08b778daeae714341028

SHA512
f8cd188478e4d90d8d8da91a0298b04b6c57cefc1d6e0727f586b343b9db0bfbbd7e30ae54e0d80215618b3a1d28fe420ebf5f6d367bac21294cdff32e50354c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6c8cbc5f04255da5ce5fe3a9ce8bc86

SHA1
606fbc439c3959eb688bde944a2da50a21ecc71e

SHA256
db6f46dbfbdd7942f265df1e2e834530688b8d83ba4d61a0e7f7fb48008579e4

SHA512
6a4e5d4167093ec8d0690b0cfb4bf6cf8e03711980800a1b902208ada42cc011541ad12cc402eb4fb50e9d93c29207f2003521172b949d2e1b3b9bbdcc99a842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d6ec3e27539526ab9acba20fb5b3be0

SHA1
7eed76be10d09f5c3d02dd48cb561c779f2a5201

SHA256
1338b3583adbac4cd3dccd942c225d40e46cfce5bb7583de372238079c307cdd

SHA512
3f9da7d43b674ed011fd947b994ab8b3d035d01ea274f3be6fcfd7caf893540a8885e70382255d2288309f4766afd508ff1fb0fe4a784c8ab1c2fb71dd85a4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
479866ce7463f71a172fa27f94e2c33b

SHA1
486d418d32e1b214d11dbcc6d574750449ed1c16

SHA256
19490c2f45ed642953c98d1ffa592605113f05d7397895477538103ebc7c4499

SHA512
1b272f551b56802964148dabc34a0a6b5dfeaaa383ae07765a8733e83812f367f2e2a79a19569c4fd12c5161eb84a7d2ed4daec1336266c5cd316e75df7408b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f39d034569d5c3e8a800145529305461

SHA1
f8fceccf6e058cdc86f3faee17c42dd13c7e8b8b

SHA256
fa95ee4211e6f885c8e20f24540716906e77f8ebf2d4c0dc65ea35153b1b4135

SHA512
6067ad5c105ad5a6bc74515b57fabbc62937cd43d4ed781c3cf9f1f1cefa255d8682a710ee2e92dac4cdfb571de8f4212030ec359387521b9da1019f70053ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62c58ef547cee35ca9f89f795df04a8d

SHA1
540e3d787a53f77051b3f9acd02c04b63e78573d

SHA256
6a2b7d58f9c85489e41c5a9ac31c09bd5e6d5cea4854090667b041a760fd4060

SHA512
52386866df60eabb13f23a4db4bca6b87e2e535292a5e5c2fa5e7df5a5cbaa4ca4b275ae8ea991c74515e59039e8fd857794241bf67d3711d9dd86e421902058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
030e53a27ea3c660eff6152cbd224d80

SHA1
9fb59dcccaa54dbbf5f02e64279a05cf9985df44

SHA256
4a8c7094a4313047905f17e15fa08399e9b960847ba88e2f38d6b44db0fbcfb4

SHA512
bf4a7b396c165e51a871a43eafd2af96a60beba3e9fc5d1d3c062adcd94514d5294bf757665555792a0d5d56bb7a4ca1b9c62d755e1dc57971619587534bcccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb3f8029f29145648fbb8a06a8f36b3

SHA1
075412b24c5c15a3d37bc70c8127dac0389b3729

SHA256
1d4ebcc043905f5a6d688806dab6ba6f2d05b4175a99c3b19d25bff64f399dc0

SHA512
89570ae934c8eb9a7e2eaf597f66ed3c165e5111a0237c59643387d501467d2a7d1a37bfe340543718eb5b25fdb17fbd5902dcfafe31141d9fe789e2ac60dc3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2607174b24642d7e41a6553ba3d62e5

SHA1
c7738a9f8b2407397b05bfee2e7754b20bab1d5b

SHA256
685007c71510267555d8a07ccc5971d2b3ee2b485332c2cc8cf8335dbaf897d5

SHA512
383124cadd554be47e4ad86db0cc11d649abf90b56254dd65616354e450943e477d0eb28629016671a3c86bc73a6686deb2890b5d22a70c8bff6a6d9d24aa7f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14AB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar150C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit