44c1ca7332c36ad4377b3cce35bc059d8cb0805b50e2e375e573d551a2b8c265

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

31e652d26f23f1af459235f9df6d9b33_JaffaCakes118.html
Size

20KB
MD5

31e652d26f23f1af459235f9df6d9b33
SHA1

b519204f0197a70af71aef5d0157835820b93e11
SHA256

44c1ca7332c36ad4377b3cce35bc059d8cb0805b50e2e375e573d551a2b8c265
SHA512

c047dbfa8961703691e268f07c07face48e21b0aeb838544d28113028295bd3aae205e527c8d51bcaf1e4629858e1e615c2a07d9557a4fe23778b150c67c8b6e
SSDEEP

384:StLBRngcZ6PiS3qfngjgD8mFmboxWft+jthBufs96XA2a6s125exN232Bo5:SvB/66xoc8mFmMCWBufs96/a712KN23L

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421550519"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83A36891-0F30-11EF-805C-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1912	iexplore.exe
1912	iexplore.exe
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2596	1912	iexplore.exe	28
PID 1912 wrote to memory of 2596	1912	iexplore.exe	28
PID 1912 wrote to memory of 2596	1912	iexplore.exe	28
PID 1912 wrote to memory of 2596	1912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31e652d26f23f1af459235f9df6d9b33_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e943084a0e332f9414c870b41e4670e2

SHA1
a8198dccaa2979dd9bcc308c13469150d23d462b

SHA256
b2651cd0721a01025a0d4908e4df23987ce42e91f6708f335f7ba29d9dab606c

SHA512
e373419f9b68d6c290a01b884ce868d07e7c4a87769eaf66ca597728e5c49c0ca37e328a4cbd2e436193a67c888ec61c75ae9fcea242138dd8b9b994ceb170f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
211c602c1eb726c3694a94f61cd028de

SHA1
bb64eb220f770c6ecdf4b5aec6efffe6b6bd2f97

SHA256
4d3b7ece487bcef7f0edcfa7945cf08de2ddf1c5a1390f554fa297207245a1ea

SHA512
1d1287a469c963625b7a9b847c95da83a47deda5440894e2c3959b524dbfc801f71d4abe4229ffd2cf8a06fc4a8bbcfe0fcff65c26ccfb661fdcf3afe393b22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
124194af4e25829694f302e358d50d1c

SHA1
39691e83b70f9900538eae7b5d44bafca0045b5a

SHA256
0c4f852becff682aa518bcdcb7d4acd8ebe1c32a52fa6a13676c60ef358bdfa3

SHA512
ba14e409ec0eeb7810772986f8dcf6dffd2ec00b8ce9d9d656ca006abd0bba0c2d308cf8b41f70bde558ad4aadc5ffcc8ecfd2f62d0aab818d56bde0ee61f59d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f84cf383b9c86ea27c5f75a4d8c3e496

SHA1
6ee99ac8718619797767c6ea0ff32e5b4fe93414

SHA256
fa794e2b81c1fe8c7a6397f616e4f65d6c59bf71eb92a50675f40dfad9105f32

SHA512
b403acc0c2b929e5a0bcf6b021c4327848d994269abf1d59bd221c8147b32071348f36d26a9206682ea38e10247af2e084c3054403ae31569cde1a71e84682f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ebc2788ab51ab888a10aa405ef3ca48

SHA1
f545f239370390d494200d162d9e81a7e64b3977

SHA256
94de3806faa4961afaa8b69d16ec193f47cb0849e68d3d0f77ac65a90f6b76ce

SHA512
e434553cd5f7938eae551e79afde737f66fb14374070308beac85b404a3aca8e6d7d8538f0d684c315692365eb132bd88d37bb7fce7388e7932936b02c904e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33f7d454ae1ccbc54092f43149b16928

SHA1
383ce61654106cff1c92519d8ba4340e45f3c408

SHA256
ff26173dbc782e5c0e39cc73394bfea0dfbb6134db96dd60917dde59a3e0928d

SHA512
e279ebaef7290cd8c9dad1de35bf1e0dbc86a299c48f079b338aa23e00c9c413b032d76679e5caa4012a30e8f63c5e8b9c309a2c769dcd2ee707ff6f2fec1a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5e507fe538a9985771248b63e553f4a

SHA1
352496439707acafdd253d9fa89c23cb0dfb7870

SHA256
980819a6e23c779fea5ff8c8f02e298f1db4946a04003a9e973262d3906b677e

SHA512
939451fa1cce10f7bc4de0d7125df1905f98e228253b78a5620ce5c7e1c2274fec140a712d12e11b4cc4808481b2aa790033e46e86787cc23fcd01f81bbd5cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9103ebd38ee2f6725d789ce2e5e90d8d

SHA1
880f0bfafa7a2093606024ab0df64d8d2f5cc75d

SHA256
4ddd72957abe81d266b5354857326c136f53356e2f30cc0deca89529b3e383d1

SHA512
8673c0fc6c3bdf20eb396d98b2b4b55b6dcc0c9999378f61e72b011bd2b370d33318c594899f79f4e8a58f2aa61dbafbfd8ac45de8ddff25f3c33df15f039643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbe047c120134756e9cd50366eb0a730

SHA1
f837744488a7504c8b0f168df3e418f6af329c51

SHA256
dd8f7c71ed5006a28ce495119457516106c093846aeb7e81f5f1ce198fe29e95

SHA512
faf9ea33b3cb5ced15de8f258edadaea2e6c6f798e664d9f009c0c63ff62875561202b914c39a081c08d65ada75fca52f5bd2b1c2b0d679f9231151ddc4f5ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d41ad302178729b3a48f5b14ce0edcaf

SHA1
0d5ba5a6205757fbacd0c98b14578a00b141dab2

SHA256
1fa614c7b5afdeb5716e17f5d0dbccdb6661da96b856c8b387e3738b0724870a

SHA512
9cd76e59bbd7424e7d14e54047ea88cfa48dfc06374ce5752399ac9549dbec5397a8fe8ed7e27910d8bd851ca78af24dad61b6a21367e23e9ec1e954e78a9326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9b93cd9eb9019341d8cac750471d89a

SHA1
ee714e1a2cdefdfa022b436b7941fd1c4a20e7e9

SHA256
f66fa91d0dfee1e8f3ee7b00d0b226abde1a935f36ec7dbaac25855909d5a615

SHA512
f5b4600c678082579fc19a8ced56e2711034941b4db57bfd4463b4d8b50b925aba22a518caedb6010cb4e91403c35d406e0ff32e9f6fff3d3980bd99ace50691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66439b8b1b915824c2f872f05197aa74

SHA1
6de65258161e71567d2b3a594b61a35fee3c952c

SHA256
9272a3925a79443409744a86a211201dfa01f1cfc8faaf9847e2a13f8a6f940c

SHA512
4aeefcade09e5cc30e959c082545237e9fef902ec7b4f93d3ffdee2d033e88fa385e17a897460579da168bdb8dcdc8924090df85173bcd855f70175834f87850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44751ec63b9cc127c8e564fb4f0b6541

SHA1
7a199af4acf8317660e2fce523d01affb6d94afd

SHA256
8b7fa0bf8750de5f41b646f18a277fa06de63aead3dbdc8634a15859d0e69cf2

SHA512
f286bfc46bbe454ab42ac69ec62cb6caf663494bbd1acff0c0dd4ab60677eea27ba7a1474ff05d9514898e46a1f801b2a7dbf38cbea1efaceb1b4d87aaf16475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
ac9dbe9bbc3e402607124a7d8fba13eb

SHA1
c9af5416add730a071843ba432380afe48bd3597

SHA256
c341a3f6e1b6f5c8b7a2389bb91a08e18b178084e66e95a321b8ada9ddb7bbeb

SHA512
16edc18126f515c64a2aeea8919a3ae7cfed84df2bffda3beab14309e31095eb495ae8bd6dea3244ea0d526262217d0f0259e0c0b19d1c634e8b879496f4cc2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
67d203dad9d136275df3a6f53b8caaf8

SHA1
fe1c63523354ed86b64f8ac60f1fff38bca8041d

SHA256
3fabe5592f06621f6cda447439d59d617f95696bcd3e990971e89c38bb870381

SHA512
3ce996eed7d96c921608c851e80eb4179e24fcf514cd19f705d041a695f8bda2a943e6af5d2ca23b9fd4d1a12856d7a2047567c2e54199c4f418540208ceab10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit