839d42b1eafc65201a788e2105e112b254da25822c06f87412631905f9566145

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28c0bc6e320043a4762ff95b38184791_JaffaCakes118.html
Size

104KB
MD5

28c0bc6e320043a4762ff95b38184791
SHA1

3d73fa38daa3c145b322e29a3536fd0aea14ff60
SHA256

839d42b1eafc65201a788e2105e112b254da25822c06f87412631905f9566145
SHA512

ebcbdd2dd36f12e56ef15e0a1ab6261ab3e3b0a3b48d8cc04e27681c96795f755b9c56cd73ea2889a8f3b163aacdfc90431ae3f5fc01f9404812b93141830190
SSDEEP

3072:zH0/2G3+W2paRLCYT97MO73lLc2CM0z+heUPx0:zH0Zn2paRLCYT9IO73lLc2CMheV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBFA2EE1-0DCE-11EF-9511-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421398680"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2252	2220	iexplore.exe	28
PID 2220 wrote to memory of 2252	2220	iexplore.exe	28
PID 2220 wrote to memory of 2252	2220	iexplore.exe	28
PID 2220 wrote to memory of 2252	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28c0bc6e320043a4762ff95b38184791_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
47ce4c023a0d350eb4aad895c7a58173

SHA1
4f45319cd4ce7468bd1ced143cb5ce939a795796

SHA256
6dd5367bc5addb954464562ec3ef53f36109fe6e6c29d712eccbce1b92a78cf2

SHA512
cf0b3d887a75c58a25e3a8e6f3fd87890b105f11c984acef6ff4b5086e422aed253b30bb1fe2983b834afa880d8fa47d5cb60da2e2516ed57849020d92d74b97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f593c68e334021e67db7b41c1b9c5c5

SHA1
c9974672d4738b4b6a837e849d89657a0389b501

SHA256
c93ab30d3260141bdcbb9c3cdfd41a8f13e9068069b718affe244372d5ac71c7

SHA512
502484532fea23791f72f922ed6a03796c202e47aea3e306e7c4b28d8d4bc42d5763f7b8922055061c6b2a0f8932c40e6838c062bb4ba398bf89109a2321071f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04e67058fc698b5569156cf7a6831715

SHA1
7eb994abe8e931ce81c634aaaf0e6b44a1006553

SHA256
0f4ed0aab5469b6083178f7773cb18c3d425e16481a28b5b66bd67f584a9a5f4

SHA512
e6c4a2292651e9759b6f21994d6e79dc39a5b8c97e470f822e29655e010aff8c7beafbb81985725e3ce3577ccb97d943b68a1a290ba6829e4c4eb98c9d1a66f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42b2aebe94f58890a1d3c30dc718d643

SHA1
999eb9a124f794571a819e87f733a1ea280723dc

SHA256
2daacfd15d01a5a2adb423078c896b0ed0161d5f039ebcb1d7d6848e42e40616

SHA512
9dcd91d76b57c43108d2952b31a5b152aa761a7f391cd93e527e0c7c173dcdf70507e3046980d022b6dae79e28c46b6854612318554fb65ee0a9b52636791fde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ce0025b0e3c40c0b07da2af0d943ed1

SHA1
11043c4b7fc7eec6c400f3bbcf8c4cc43a00f2f9

SHA256
0658c34d18168e4e276ee4c16ebc8192171e82452eff346f6de3850a0ee50a96

SHA512
3fbb0e8d30fbec167d6f0ec5aea479c61e4fd01933e1970353de956d1ae1b41babbb63872c83e9825ca7e685a9dfa5c4e8d839506df6332b1ab99b1240c518f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b823b1783cb0ada73a49c4cc3ee23a23

SHA1
ad1acb7f9e74a0fbf4cb6ce698996ea77b0838d1

SHA256
c5048d991ab46f17f4780e515040cf5e726c181f5bb4ff12c02851cca9ed70cf

SHA512
16371f9f5fe7ce109de2a158d870ed8a4ba72623b86413b1bec5530b4f8ac2367b3c91d14e29680d0c5450d9c7d4a063e992526dd8ede00f79531b29d7479ca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3aa830a03eddac44b37dca7bf47aa65

SHA1
dbd318ff5ad460a56890c406b19a713ca77d83ab

SHA256
4c316f64cd8ba4e74d0aec33c6f57e7690f883ff121a5f5af42fb4b4b75d9dc2

SHA512
6450cdb4b80c23b53609831471ce9fc710efe0b9e240bb7851428ac6d1fccd70706e7f30384484ec2b92a5f601c3a3bce8887a00407ba136dfa0a8b22b7f921b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9afeea4d495d7c636896f0b8fd5dbcaa

SHA1
4d22f5d977ea5e4d93aa86b49928a3f2136d10e9

SHA256
4583fffd4ef70aeaecb6027c3a55f7d4d91de0e04f346b266f029ef89c7b188c

SHA512
a3e234a86e03d1f30c5cbd008979f4e705549372c858774d7a14474246b13a91e48faf0a0fd05f4184489b823c5386a8b0792a3a239028fdb2547f34866c9d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8872586c581364601513e22fd6c32ae

SHA1
2c01c20d14650981cd24ce3f87d258ec49d3db5e

SHA256
dec11a0393089e254d2f864b09b79debcafe3dce4728ca3a7cc5589aa63f608c

SHA512
5d53e3f198906dc6895b0c3497d8cc01ce53c5f00fc0692cd7c6255c382f6267858f0f7d80582c6f1f3274e45f6e2ad1edfa7eaa3879b85a2b0839cd80a25928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6787796fbc8533ab701d03063c855c8

SHA1
3bd78a1f9fb87c4eec6179af2bac1d9a72ea2343

SHA256
1dc91dfecba6b48dfed69d6f6383bc7995296dd0cc76ab145ecb90c87b59754f

SHA512
75661ec979f2dcb1cd184c54d4aafc5534936193d49761bcabf718ff11e88412c6378daf5622601af4b3b94bb6b3de16cf161e56b5297e343b2c0102c2a1ac1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01e27b8f22cb87c8153bba165a69af04

SHA1
b286fc900e989a6e54dd02ba2ab7d0fdc68bbedc

SHA256
650bb80bd814b4d372190b373d59cb13d168e4e3f3846dbab6ee5b273c163360

SHA512
d94116ade9c6bfb9b11a2fb63cdcd5cedca7877f2158e19fc754f8f73532de0c9a14cb288810fca6f6591b8046f037a74d2354bc64ac26dedfa76ef916980fd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a21d3092d06df4e57b9a156e875e9b3

SHA1
084e23dc61437a549efe8c20bdc1ffb3204f2a4c

SHA256
59fe111dff83813938f329e035e521fd0061d3faf8146716d60ac6771a7639bf

SHA512
2caae4ac0b2e6ca904f45ddea89adec28fadda2c91337d0361cd63a8c8b17c55e2a07985d0b3229a25cbec03e996a0296d9d4bbb20a74e2b3f7ea4ca19331c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8d8118516237c29bc557214d2386a45f

SHA1
f9e2f664d78f020897783fe4dee5ffebf7a72117

SHA256
0ed54b6c1ba1196d6df2eab6c91e40ad43f5a983c3fd0e36d440cab1eebe5a21

SHA512
d4d043f221a9d5aaf7452eafe7e5bf3a7384076d2a2a9864ecd4062ddebe436d65f39370da1f92a2a08c028039234d369e7f245ee4e6000f1edba8255850d369

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB972.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB4D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit