f13700f1a68980cbea96499aadd1f14e66d15abb766ffc533ef09b2836342ba5

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c609c0accf5e7490ee9187d60669155_JaffaCakes118.html
Size

213KB
MD5

2c609c0accf5e7490ee9187d60669155
SHA1

a59c201fa8d29e2bdb6183764f554bbd88476e81
SHA256

f13700f1a68980cbea96499aadd1f14e66d15abb766ffc533ef09b2836342ba5
SHA512

6cebe526577ce9eef495bc634f000e5c4dca04264d044b063f0ae1bf0bc1cae688fcc2b18203373ba6895ac596e1c209894ec65a680a616312744c84e3ed6dfe
SSDEEP

3072:SUjknYsFCaHyfkMY+BES09JXAnyrZalI+YQ:SU76SsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAFFB701-0E61-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421461706"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3012	2168	iexplore.exe	28
PID 2168 wrote to memory of 3012	2168	iexplore.exe	28
PID 2168 wrote to memory of 3012	2168	iexplore.exe	28
PID 2168 wrote to memory of 3012	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c609c0accf5e7490ee9187d60669155_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f48fa90726eaa473226de12ab17ea24b

SHA1
e38bbab89c0db57fd6a9d10fc566252e7696da01

SHA256
ed426ac37204d8d440d4e805c91ad7420788dafc6933efbfefcd4027d80d505c

SHA512
354d46c8828427e2c6f960f03c194a187373bc3cccf697da6374b19f320960e333f0ed30ee8648ded9b4c2542d424b25cda6f15ab0df4325f97d931d0ac60cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15d606dd0f37c6632d821ee968cd88eb

SHA1
85a51bc0fc1b12a0259acf5cb41b80bdb028d719

SHA256
aca4257a7e036afc8c9ebfff484056a86cee689ca1ed244729f5bb1a1b3d351c

SHA512
9b95898426868f1e5bdce51ac19b9a30a5c322badb201617ae12025456dc38d59c28391cc5e8dbdcb3f49818b1f1f9dd533d00c93985f187ad572fab03451c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e400deef3d57b7f0c5fd22776273aac

SHA1
8206e5323a06153f653ec258dbaba7f621060e08

SHA256
87b0cc17a5892624dfc90877ecea9ae50a77a59169e26d170822e0dd8c9b5fde

SHA512
491141586f4a575009ed3786420f934c6557bac9f592a3658895a0de88c326fc898b46eb4ff262a5c7f0a9b97f94b86a572c467c1836920dbfdaa053179a16ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcf3166886f5179ff7554a29d0962bc5

SHA1
d6440128d15aab2a28b3ac99c16f1c2d940764fb

SHA256
09603fddf096a58ac8fca20d21440bf0374f86162604ee4747698244d9da0754

SHA512
917b8656b5820bb92e2a97bb324ddbfb23ec876136c23d85f79f0d3b3e9e8a92f0365865d927a8d660e502c4a3cbd7eefeedbca05395b2ea5e2edb98fd7db731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b085ad431f1c342b18d79af62056aeb2

SHA1
aa2285d018342478c64f18545ff2f42eafe61401

SHA256
cebb41a5864b02af638b2fdbcf993a46387d00ab9e8b9979c912cee1e3dd9117

SHA512
935fa6f98869e038ea94bb50dddc1415393c6e523e8866888b16c27ecbbeea105a6e26adb8fd5b09b97c7f74379d8c8b457af4d997a5d0629d52d0e1ef77710d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64f3ecec02cab497873b672fdedde6cc

SHA1
0cb3a44550a341a0fb0d5934f7a21f5bb53f6345

SHA256
d7c1f03a1e10cc16a14132038a63897e4d2780196166d3066d3c2ed486074d02

SHA512
fd4e2de3bb2bd55b5b56ecbba4f8a304aeadb41b0f2d4bb716e5f783878b04150663cfa5270915aecb55df750114ce60968ad4d8d07d3f4bb9cffcb6d50dadf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a32ee996adfa1332dad12b238cc21a8

SHA1
1a5146d3e2b31da8df9a07bd8ff012d3e1147dcd

SHA256
8f6de78d9c3a8f3c7b8d2f5c9e29df82162fd3af457b30853cc3f44d620b1dd7

SHA512
be45f5c1e02b410fc23fe6d2e940e2bda101d58c3bed19556a45aa82245d4425753e7daa902c4fc4549c3904137f843db23ee4cc4607fed22c80c6a6252b02c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d87792d4bf3a549894e44548b3572aa8

SHA1
bd74db62d5a291a122564629a0445b5560b8b640

SHA256
7b35bfe8ae96da7c89ab80bb9f5bc7ce39df6e0668375c1e77f0c95325e01fd1

SHA512
2a59af781c1fb86025e7358ca9c710eec6cf5104674020ed1fed0c2e8685075802b944fc2ed5c6fdff75b6ac1a6a839a25f84546b399cae8df0b8e3b2af07c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d8aecbaee962b28800c0b189bee558d

SHA1
0d3ebabc79f739c04fe00b97c1d9123185f3720d

SHA256
d2ba633681f920612b65b4d24d96a2f29bae943aca5f96dfa41a955704e852a1

SHA512
38c62e6d671d07fbcea69f65c570449419c7cb4f658ab172664af4ac47d2d31319cc18a6bef5e04c52164c45f13590defefeffa2a4f4b6696a983a5fc1249698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7263981559b6efd64463ad95a21a223

SHA1
69326ce186575dbe7d2161532475244b700d0c19

SHA256
f9cc2626491884f1358977a11f6b9615b708a542fc02407e06560baa2a88eae8

SHA512
0dc0eaf6dd11d9e7f84ee35c00261c6b75788ed0b8689793c27da5579c03de3b12c8d17c8a2350259527bc8d0b18e641c8027213deb01f1aae676b21a737d406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01d5e542c880f0f6cf885ccedbd260ef

SHA1
b73d4e86836a0f4f7d9e2a096a7a548e6f440127

SHA256
187ea065194705e955e416f60b4823a9fad1e4cc0c416ea0006c74408addac4b

SHA512
f65012c665220db7ed004705fb87c8d0536c9e3cb2f3057919b7791ca42fc34909acf29bc69445b484f07189c5621f54af4addab7844c63aa4c3443ec160ebf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2feba7216d724d53707e7c7a60a5981f

SHA1
7c52d648112c213b15c8fd49f322d81ff4cb6dc5

SHA256
f077a6aa0ee8dcb7faa4d1ff4d4a1ce586a120465bb521a9a87ac0a0d6567bfd

SHA512
6318befd8d9051cdeaa089db7fb12c974dd0784753382119b10f89f6bfe96bf419dbfc1e4731014d5e122335de77de42e5d1c7b3e6aa7a7c01ba17c72b215ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
070c2aad360e269482bf91ce15be8477

SHA1
3d368e834d50ca2b1c73357eb427a08cd4b874c7

SHA256
833fe3e4d3f7355978822b0ffad5b16e8da0a781f4525fef233e04c7c07c94b0

SHA512
e93a4dd1f7465f33dad04ebfe51e1dcdc6e3fb9736b8945ab015cd2de5cf98339687383ec54ba9bfc6cc02cbbad0008fd7cc8cf25dfb65e7a4a4edc76cfc36bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7633d8e6894c3d9851510d7ee2140f03

SHA1
cfdb64e91d34b822a49a03e05027c83cc0d40426

SHA256
19a600b5e2c7963b950ffe0c48117c8f8da916e168641d36dd6b240d5c5d06dc

SHA512
53d3801ba975cf92f0206019af96ebc7a2378892a738235cafbb2ef8cc18f9456615dbe25cc23b0c7a4a5fb395ebe28e695b4ff2d004576706d752bd52c87def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b9dc999154289895db57050fb5f2d04

SHA1
d260e0f3c48ad4419ff37e56cafaf38d7b04244b

SHA256
9285090ad8815af4c7985b5af461f92fd1fb0a6e1edfcea5b17ce55acfb1d517

SHA512
918c62c391edd3aa429bbb036090a2db1529bc3624c659168e9708c28bb189c103bd7fcdab7e3311549d01439d2a5ea5e86847df98e4fdaaf09a423283e067b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d58f4101e679d4a408d1604dee626d6

SHA1
12544d6269819e24ae24cf8488727784b013d332

SHA256
7771dbd25861c87933734ec8b8b412afbeed2c309c9d59d101ee89745714a07c

SHA512
6a80a293581bd7789c17e83a04e6f86a3f32d56de3a6f7cb77dc8fb5073a8ce032077daac01f84a5458525fb7d976b576635e42ced20b57b7f6bbcb7a002cf16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bb4e98a9fcec37ce1c1a0638555455a

SHA1
09b1414f9c2db6ab74f352e7aff1458ef44dd68a

SHA256
eb44505b2c97dfcdbad23c16723e37ec8ac528cef754607b0b69fc01b8afd5dc

SHA512
dc58ca9a0a2ab042e5406c1dcf1ae332796a496331a0290406856077ed64dfc67f6ca68e826c0d7a49f154c64243fd2cff2d60952ae0c4f4d0ae53e1f2bd8c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9431064d8f350d0e767840a3258ef953

SHA1
dbf05eae158e308ac250af7d5b89bab30b612e4c

SHA256
040577220e1b5f6d2757c5cadd28d3d4dfab930bd4ee476a98e17d4a3fb0fca6

SHA512
273b2f544c81ed047d850e4898fdddf6955cacf1a0ac7882b9e7df1661e1d012321293eab4e6bc5230290e95c0606aad4e22a849e2fc6e2b8809440ecac319e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4394a30b1c8e07816257249409557d74

SHA1
295d2b2be52312de8c8fb573a06922ec4201c908

SHA256
5b4eaa590098d33da769d983b39f9757b963585783c64d07101c4a7f697d42c6

SHA512
4c9df67c0452ea74a7874459ce2a703452d8d6e3dca58e06c02f399a6f94b3c4767f804038c4979d7e9d788c4d2adebf47e8aeb8eed451111c5edaa532b31682

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A3E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B1F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit