c59f6b58be61bd54703f7e7f45a75ec873d1ff00fe382cd9cb6a8d0ec78347a7

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28b8a0dc1273f8dfcc2a0b747a6edd60_JaffaCakes118.html
Size

35KB
MD5

28b8a0dc1273f8dfcc2a0b747a6edd60
SHA1

2a6c8cd907e91d834df6ed732c149dd819c7a6d5
SHA256

c59f6b58be61bd54703f7e7f45a75ec873d1ff00fe382cd9cb6a8d0ec78347a7
SHA512

3ed184c5006d566d62761e2baf15f4c0033391f1a870be08e9cd0c90d58d81e8e11e274f18f0abd7ea7ca9ade319548c5fe60e8ff302db933aa0b8c2a4f76a96
SSDEEP

192:uwvub5nNaHQnQjxn5Q/VnQieYNnU7InQOkEntLrnQTbnxnQOg+cwqYTcwqYUcwqs:/Q/K9E3a5AmYR/3/Mk7jHz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8059168fdaa1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8595E01-0DCD-11EF-A564-5267BFD3BAD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000f6bdc113bdcf2926145ebc952e61d916dacd85884e25758a191c8ba8f021bba7000000000e800000000200002000000004361af5f3faa838b3562e608d6ca76acab372a753eaa54d171b0c0b7eaa35b290000000b2c62e722713ff1e1d52f8028eedbcd8837639043df6105287dc11a60b174d3cda25d789338bc184ee1d442d7b8487774f6bc8930dffc32faa01e369aa5375a489c7327cd953f904cdad0f43c9d9a3d77a4b2200e1ad44d3f2b050a74e67627a586fb05d8771fd5877c1c08db7d3a658a79977286a3d2735f51dc78e031db424180696aa3626481a41e48ccbd75eb27c40000000e12a2cbc756d5a4e715f83b9dd10d5f6c0841d14b7c405156171823fa66228216e589076d83ee75a335fa60a58e8bad37a974f3923bf1d89b114cbf2ecb80c5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000074177ad5f9771d9399812fc7508a8315d44a796d946d4625412c0b90e87c9e17000000000e8000000002000020000000a9d19a733234ff99befa957a3c32bb8efe73ec6a1f52b54e90108abc857d4d45200000002f19abe2a2f6d9c6335ce08231cab8ed0cf6bc89ba662356103e848129436ea6400000006a689519de6e467b0a680bb02a9bb0a2ba7e73d47dbe836f9b32a7790fcf713c4ad2b1bf8564e60b8d83293996e7aebd2f96c48b2b496a302ddcfe501f292fd9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421398136"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1220	iexplore.exe
1220	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2468	1220	iexplore.exe	28
PID 1220 wrote to memory of 2468	1220	iexplore.exe	28
PID 1220 wrote to memory of 2468	1220	iexplore.exe	28
PID 1220 wrote to memory of 2468	1220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28b8a0dc1273f8dfcc2a0b747a6edd60_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
192a56686c687a1f7b647620ee132e04

SHA1
79e30505514918c089b62f17809654db0191e279

SHA256
49871db69adf17c3f66e28c2f14b5ad6c3cb49a2ff35a400efcdf108cb2b9253

SHA512
ced65c4d4e52f8e62676b3ece0331f9c6200a1f80d2fd7bded67f3962d78886923f72c19e8ee94da6ba3be07203afbd34bb369feaa2e2b2607cb3ec2898990e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5499d10f60a11a850d1739933d9680ac

SHA1
6543bfea7d0ca31f6f14d74b3a1364f698c8bbc2

SHA256
0f5c80d19d5e615be63c590d5226c7b4fcc3ee18a1fe37e9382d04b23a80caa5

SHA512
e657db9aff4492f12128cb2bf47ab600cc0cacbb47ec05120a9f5a351746e9e3e28edf3e977c80b8f80a10b1308b8f434a97ea660febf275f7273bc1320acbdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5a1db87b0b63748bea35a2f74c0e15a

SHA1
8f1594e03f629a5138a6dcf50877a34f9e34f64f

SHA256
ff95044fa956301501bf6b673cbf71315d82d536210b50d09b055aa00d7dc4b0

SHA512
34cebd7b2d11683a14e462ebb9c0604be60719cd51824c45f212fccc0fa281b37c799aaaa6c6b7c511cf247b29453d4b78c76a019b1cac2348b2549d039a9339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6c5a29f9486bfe7757845aa80686da

SHA1
bad3995ac87666a4643d7ad7c44c148779adb855

SHA256
93de5e508c0427045b1fb3a6ac611ceb02fd86c01d9326dc0d4c7782fbf0818c

SHA512
a6a2188bf46b5af9d80621ce0856b45e2258afdaa17e1e2fd76a1b3a66a063530a75ef0f07b456681f73735fbddcb93b4ac71d1093499f1f2b2c3209e0fa5ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
223627cc3e3b3e69dad6262e4e064aab

SHA1
40153c880f9abebac9e0877ebc629d08216860e7

SHA256
e7b29b37006302eb07a650d51e4f6c47d5b39f1a373dc421a3013ca2f67793af

SHA512
e171a94b37492547c4480e2b12ef84cb37e56b907d797529397b3c323efe445dbc2efed1d9510cc0b6c6d7a5db3b2669a6d16bd54a35628e05627f6e3e91c07c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
018254983783a349bd3dc9f0a595790e

SHA1
50e559ae511eb091a5b06bfe4649c2b9162a0891

SHA256
2eee920d677586838c2630e7f538a494aba9e740bcb9b977d968a67ef9207672

SHA512
2e58f65ff31b49ab60f9cc6840e053dd786102278022630d62e44e9b2afa20c4050701aca6a45faeddb4bf7f9226dbf78c7ce6ebe823b5d7d6a80e4f5235c6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9722f676ccef0ace6e42e7f85e14fe7

SHA1
111323f88ccd179c40b242f0dbdb8b7641abd459

SHA256
299c0d4f492ccb3aaa6de0713d65a201dcbb244696110d0be1959363a5423166

SHA512
a5ba8fc384146f72b56389c3a03b25ab47c34d169ea34978201d64a75b68c390f8abe5afd522534c648bb3b3b57927fa79d59ff62674965477d881ea9fdbf758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b15b41dcdad53dea543aef881f8499e4

SHA1
e72e43f49200bd630b6a8e2aab926c365aaf620e

SHA256
46aa7f2b4090cf3f6ce085aa625581a55dcfd022205e55d5fd722678bba2878d

SHA512
2da3f29b8493aecebf201bae58320084e41ea478bd2dae7f1381a6542a8ed4bb71fb1ffda2c86495d62e63ba3bb5e5d93bfb3cd8ec5afa67bfc2585bcc233db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2814038fc4896b1b2ed7885afc216548

SHA1
e5b7626c0641fa07d732b0dc901d6f3472b95325

SHA256
ad831af496077f6e36747a56643ed3320479c61abc4a60c08e66d7bcc2c3967f

SHA512
e7f8f70029d96692cf7289e0895e1c8a3e69b8875842808a3a5ad18c8d2702abe6caa9fb48f3a30b5e7c2946fbb7362c0e018dcaec1c9eeab7f17d658bf938ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fb1f831949cc7e3bd19708f55d37575

SHA1
bd73967755d3d5250cca555762fca4065aeaf14e

SHA256
a88af80d4211f8f29228c310b6bac55d67925422a536ed5b1199e30472a6d68a

SHA512
0486f40522eb7e2bcd2cbab2b99ae476e32125dfe98e380fff3464377e189778aa69ba743a0a889ce92cb500dc3b641e10523473056aa70bed70c2ff40bd6613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d18114817499406b29865a52e92b315d

SHA1
103043d3b1aaa8f446a7b16fdf24c026a5561959

SHA256
6162406f2f3e42b20169e62ab1ea4e96ad938eacccd76116d72fb3c7e75c3200

SHA512
fb998df4880afca031a6c50d175d9370e59fed5360501930faf8602d097f953b044802032b132be0ce77c6b0f942cd62c491fed396665db4754088feec134f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab57C2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6543.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit