f9c0d7e8f69ca7a2c111177b0eb3301746c34ac9b8dd920fc9f0761c1dd77b09

Analysis

max time kernel
137s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c197f825b8c2e22d27af3be5f2e1482_JaffaCakes118.html
Size

143KB
MD5

2c197f825b8c2e22d27af3be5f2e1482
SHA1

64ffcfa02255ff73238d4a15c85705e0435f3300
SHA256

f9c0d7e8f69ca7a2c111177b0eb3301746c34ac9b8dd920fc9f0761c1dd77b09
SHA512

c7a4c4c2cdebc642af9e5671896184853858bf188d63e27fba564bcf06ca28974945316477903323c7594ae00d65c4fef71c9d9d60014f7fb1b736c87fd72fb6
SSDEEP

1536:SBjKwWg3Fx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SYgVx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{918FCF01-0E56-11EF-8F47-7A4B76010719} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421456911"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1744	iexplore.exe
1744	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2616	1744	iexplore.exe	28
PID 1744 wrote to memory of 2616	1744	iexplore.exe	28
PID 1744 wrote to memory of 2616	1744	iexplore.exe	28
PID 1744 wrote to memory of 2616	1744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c197f825b8c2e22d27af3be5f2e1482_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aef56d4b4cc4b335dfee2b0df5bb59f6

SHA1
4c0d0e83140c236f53fac3d7f1f3e9df73ae0133

SHA256
3b05a3278d253d8f79062e62f05590a024328f1029d72564de862ee12dcae814

SHA512
bc1b0b5efeffcc3069aef848e17732fb77674d6f7972485197a5e318cc1fd733bdce4e157b157f851b167eb90d0afa9e6135207c0105322a8272ed907228b86f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57f6a0c5c5e1fcd7e3c64b3349b30f3d

SHA1
752ff64764673e4089f0a296069df785ad25ae01

SHA256
f1d760cb78690b0c5cc6c16bf71da711ae79ea7b82c1cb1dc7e5658d73cedf81

SHA512
d1b4f666c277bbb00dd4433ac06fd98390ef65e3c23ec0c4cb6edce8f031f04e3d22f6c28c6edb9bf759f36db85c82d7099f048bef34c1c94f93aaddedf1b7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64b9b5db172248dbee5db71dc3e21dc4

SHA1
a0ba4a2e5aa93d31f216a1ff9fb75b409623cf00

SHA256
9676efe8aac1d9c8ba31da8bf615e92116fbf900b0ea11ac9e4f699ed80f4abf

SHA512
677c13651fffea5b04ba60e09af53b0a66282f4adce53d27e6af8a5b4f229c9d5291ed184756bd2ee1fed26d761fa5d4ed5affb0d54c675f811f65f91dd2cc36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a952b6a9210d3bb531ac9b62de2c4ccb

SHA1
35f97df13997593ad184745c1060f14b62aba20f

SHA256
3603345b81ba4c435d0482bf7a51526d3b6accd154aaf01bcb865b79cc5805f0

SHA512
10d973e17167a638592e8e11d4a95e659aae1318b50d73ade7765d56e5d5a6561b04f91178da7169001e64b8937516612f3fce70a8f22e31a538c476c6f89bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87dd23b954c3c6f8a46d72349f4cc18a

SHA1
e1a58efeeb53ddc2739beebcc68d9c256d2635da

SHA256
d81f4a47a4b754c1c1ef928ad630559dd8b1e26f119b5687d13cc47a98d4825e

SHA512
c66a92a4d4e57794767f8ced2cd546388c53ba15907646cb010ef422b24c0c9abd93f00427a84c5d1148c966b89e4176ad4e02b3c0414154eac3b0ac9e6cd94a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
664f45b72a064b681a0dd915c3266c9e

SHA1
35584f0b1849a38abc8fba85e750be3e6918b488

SHA256
49eef575200f75100b6930caa1088fa122f45a596647162f8f1cdfece621e252

SHA512
190eb3b37e011c4ca8c16686087ce667cd00e83ec172cbd017c3fde7071358f357163d3ae334998a3c7457d3b1f666f9efdeaf735ccbda994025ef91ba40df12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4612555533a4caee932102ace8d0b693

SHA1
26d9b2035dde74b7aff53f4a9c8d755fac95c2a8

SHA256
dffe46a6b67a85bbfe24e82050c624ea260e72d7fda8aa93eb88ad0aaec2fa31

SHA512
105d21c2e83c64bdc0ae0c1027da5c535b7fa15d0b6423b02c51cf45ca046cdf232d8a1b23f975a52c4d9c15c0fa78176d577d0c6843565374d6d3e4bbe0324c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b07b32bb16114056fbc7d5a6040fda9

SHA1
290658abeb55c9be74c0e01f880525216c416e7c

SHA256
695df7d479732ea9d2989a69428f0c1fd2bfceab80b510d825af6858f8a4f5ee

SHA512
e8c585d0650c8c9e833c66bcdc012095b1e7b46614249bcc158013263b3d8998d73fcbd089ae56d277f96703fb0119d3c4254092f711e4ef3113f229d1f0dcf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197a62aae55aa37a0411ba152676f68b

SHA1
401383e722eb1d7f9a9e221a4adec13348ea00de

SHA256
7c918916540f5b177df288f5f2777c694d338fd3d664d1afb1dbb8a093176ce0

SHA512
b6af82d0c70838f78d087debf9646d434ece502083ade8b7d3384339ad3f7ebb4a2a3cc6fedffe7a43e253fc43d34e7c046f98315f74d23dbce1dc8b261017d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9275668ea827d39a299b35175c985ed

SHA1
84df233798593dedcdab55682296e2a261833ba5

SHA256
43865c6dc8e316a2b9839b77ee7e535c7a43f902a90597781d302b95aab07ed2

SHA512
7e606f6b958471684319d66a27d9601db73bdd223102f48798a8e0d09b3dedf98759db6b61e6d55c55e11f62f040157f38fde3d8f49f4c6da4b6c2a5076c7291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
824cc779d5f00d9e26df103892547fca

SHA1
c1178e7309e416952451e9301fc60bba4d26636f

SHA256
7dd3e3614d573f91222f0fb961b47722b0ceb1ff4bf9fb853621c4c87c96829d

SHA512
2bcea53cf7c043553c5ede99e722dfe0eb6706773c5f0155153d8b319ca27c9765adda4f6e5a91cc277ff1220f0b9b841494d15d87c4063567387750998a2291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdfed77cf08695c7938272575ce613ab

SHA1
93c0b8369d96056862c4680039b00da19dabdcc0

SHA256
b1d78e5b1d41fc6b95639f5ed05bccd05ba2ae1f94783ef891f6a15498859cdc

SHA512
5ada05c66f9aa0118e1260481c74f80e24c6f175745a31e376563ce7e78d0634b56dcf12f835fc0e9d12a4f2167b0b615304b0072be3593e704f0682ea80e8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5204e03dafddcf1d2023267e293d88a3

SHA1
bca4978b8b54257c5182336562465ac49ea1bf13

SHA256
4689c7653919abe6b4373689beaff9014760397b09984e55faf22ed6eb822e62

SHA512
43b5c11c7ce399050cff806e6e06d1d946e5f852bd564af06c9088571a785375becffba75aabede4582a217dda8710a9a907775a9e643b76e96a49d3f010a6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d3488e04669e9a3928977c21c872686

SHA1
e0a327ac5ca811125b02236e826ddca8d1ff8772

SHA256
b02313a94879e81c125e0d3781874fa1da36f4439530f49e89923e62ffda6806

SHA512
89ab087fa1642abd219215f2f5ad885bbb95d8b482c33096946882ba17556a281b7fea2fef2abc89628d1443fa51e598628ac99dede60a3c64879cadc137b800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8634dcf38dfa5da30b209aeff14ecf3e

SHA1
aea1bf1f7c71b984dc464d7eb1e7ae93345bb445

SHA256
8af785c8170f030114ae4fd04e0d678e6fb98f612bf9643892e9e62cefa1feb3

SHA512
b9df0db4057c5f4ca05aabae8bb549b1d08bc101caddc5846a11020ff8acb3893153f8308c7bd0fbd31b29f367fb569edd76a6afc8aeded6dcd648a2eab73d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a51230d440433d80e06082aa4e7f52e2

SHA1
e164743d475cb14188dcb100afad18c0d02877c2

SHA256
217a5aef0e90c85fadddf1b390364a45faa8de16a7c4daa415b19340012e988d

SHA512
b15df8f38bf999d334d6b3a8f37e9dd33bd60c5df72b0d895876fb5ff6c268b5a9452b53e44e973d53129898f3444131f1c8969e2a9f65c93049b095be9aeff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b45d3c13b1b6c916e0eb94bc32ae4220

SHA1
8624d7f56542c9bae34408beb7c77fe88a6ce71c

SHA256
e0ab0da474a2cafc8df5d61fb5cd678115cc2fab5b2f12df21d61deb0bc21d77

SHA512
a0d251267f031b41542ad6668c3e1275b1132bfcbaec98f0fb2ffcda260a9ca5447f08a25495ea15e4be67e4b5d41fb5b0d1cc21783b09f76de1d0609f443344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
051600d7c4cef0a5b92f13a2f25fde43

SHA1
69d1c5e1c920885c7a6d5cdd06dc85c2090da79e

SHA256
187ecd3d6d3606a3272555364efd51527a8b5cd600e5dcff20a06f9477942f34

SHA512
9baf34231925fa5e197927ffa8f86c44fb83369be86623ae110b5315e2886abc409f0a5dea0538c12d44b25a7b1fa257637edfee7b4303b056bbeccf06954998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd95e33cbc2971f71dda25416f1e6e9c

SHA1
29f13f3bf539392d65814c993ff1c9c3e2a9f9f1

SHA256
96eb87d8d65de92edf1104a8c471908c0f1467a58f4c1daa2fd58e1dd5e1c730

SHA512
0b90c5911fec018e855092581812aa8ce18928f6e35b32c9c498dcf3864d4b84381dbffec31349197628cef75f6281df67a9952ee36acc962158e3ad927a9278

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BBD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C1E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit