60bdcaaf2c398fc20efaa13b1ab4815276e45b0e90414683134c7673ecd18e71

Analysis

max time kernel
139s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

373cca6178922049214a6433503bcf03_JaffaCakes118.html
Size

220KB
MD5

373cca6178922049214a6433503bcf03
SHA1

e2dda6cb28d701074d23211cfa88abdc7a409a28
SHA256

60bdcaaf2c398fc20efaa13b1ab4815276e45b0e90414683134c7673ecd18e71
SHA512

a22b0e7a9c1da250ec70c49dba461a6c801b266910ae69929ea33de0e9c98952f142652393b70183b212c93acca2fd82abbb08e3784fd12f0a5594a023a45982
SSDEEP

3072:Syy6KF/bUtlgpyfkMY+BES09JXAnyrZalI+YQ:SyGC+MsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15A466A1-0FF3-11EF-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421634087"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2916	1760	iexplore.exe	28
PID 1760 wrote to memory of 2916	1760	iexplore.exe	28
PID 1760 wrote to memory of 2916	1760	iexplore.exe	28
PID 1760 wrote to memory of 2916	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\373cca6178922049214a6433503bcf03_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d14494fabe115a03a16a9f4300e2160

SHA1
42cea9f4a5ee48bb5427302772a11906a52b9439

SHA256
c51cac3ba2f38a6bcaad7c83b8cc834fce19a6f8ccbcf8ae48f127ea5901d7dd

SHA512
0cae8a6311ec01dac1b9f4d492fe29273bdca7f869c816aa51d53a60f75c7ac59ef635de6da59ad8ecda94b8917c276e218eddf6ee518f46bb59c57fd4f571a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f12fd7753ed0194378b2f31a29e931

SHA1
b25abdb76a7a2d9553cbc11db51360a33770005d

SHA256
2c08d2ee6058d49ab4c77208ac8f2686bd0d63eb3909e6d9d7eb26923c447541

SHA512
942dcc2185e5d0f2daf0689c861343c7b272cefecc36eba4024deb79c7df8699d13ca2bf02f830eb7eec3cc0aa8bbb28381895cc136502b6d5f32ce3a1f4dfc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c7c240a15e9477e76bd0da036ce63b

SHA1
5df81f1e51046e92552c586efcd65cf92b85c22e

SHA256
5bf73800de9fe560a04a7f7634d7ee4aa397b10872a768cdb97e07ec09410782

SHA512
10472e454bc6556f4f50f52d784f6552391f4ec02f80819fa26c1f3c0fa47bede009555e5c73d285e733213aaa154fa53c19f1aced0df4fa76b8fa152912b270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca7f40f5efd0608d0546aabe48c6cafb

SHA1
a7489a7fa1852fbd5c25718d9e19d3e52c51c5f8

SHA256
fa3ed87d57257f76ded0a762f6e489357357eb4ad99ccdeecf8dae2fc1e0f7fc

SHA512
11765f2a87848440bbdf70ada413c1156434b832d8ff6c7440356bbf42f71e854f5aa4dcc9632a72c9b08caf66e343ff245ecaf9e4637a5fa3f3072fa3ef505b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba4fa22648b556b9a5cbba6562513e98

SHA1
1c8bf4e3b569e1a30b7dcd64e33de4d548b28a08

SHA256
a4a396147b582123807b46ba30a9fd12349bd8402e0cc7d629565ee1bd132c35

SHA512
ac94e7150371c56d396af4c6ab9a15de20cae242da60d0f2c9e8cfff4ea206319bccdc7d6475b9c494a0f57c6b979dfd44fdb019eead17383669b3655f0d8bbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0745762baff28504831f434f410d1a84

SHA1
1f7e3b8055d9357efe1b0d3118131e4f821db9f7

SHA256
06e4d0d34d5a03ebad1acdbdeecf4b7d4b23cb1f88784b40a47bf95982da5615

SHA512
c6e266cc47c59c8d97048ef4c8f1763c5765d60ee4a002037a54ccc7c17ddfe9d373925d6d5b57b9b8b4be011b0fde2297c0666a70d50df1161ad0bec5e7e9e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7da7755e054c27813286bc75538fdc7

SHA1
db2c4e922d17e21d0bbca09bd108751ef740682a

SHA256
f96404eda1eef5bf44606eca8d6b7d5fa812c8a73c36e9fce144cf555cc6fcff

SHA512
148de9a2e5419457f61a362dbbed18565b47ce757fcb80cd64ae91b5c792a493b61626677048fc8c1d0f979aa8815afa170499f4e74765048582f70721dc029a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21d48e049db3df3c9e9133861d5f0936

SHA1
8d10c774223be9d219a5e72555be4588a4d4906a

SHA256
29beb96977b86d90a9800dff44096a728101870af347efdbdce3e789b991f157

SHA512
19d0cbbd13cd9b0bd9eca545efd7d60036a098dfda894fda2e23d82be8535027b880a456400aaa1da4992d375a6e2d132202f874f70d36e23b4252ea8b9d6883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
230d091baa3e3fb2d22e54066e4e0ce4

SHA1
4809d33fba89301e206e7eed264505bfd607480c

SHA256
bfbb48189a0586b498b1c5d54b600604ecc59ac03b3ff530932f25e3b0e3dc7f

SHA512
dabc2d53e916bde27e1bad084ede71d6082b36aa9980ce522f407e478506c54d4e99384e304182578453eae660d2ed789d38f6b2120e52fe56732c0067b3e166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94be96e8dd2168d2579012a282798f70

SHA1
a2360b9fdc7cb3caa36ff9457da2bff3fb3bee1c

SHA256
36bd43250a93f6623b958b78ff97408ebd47d002abf65e6e7f0c54eafa8f5c92

SHA512
36cdd99a983e132953949c894233abaa31eb7bec785f6b5d951d859bec8eaa8853eaf230e5275fb421c46bac93664734ab859ea507891a3d8396b8f51c90540b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c26a7eb8ad8e89343e6ba20c70608592

SHA1
b7fbacd80e75b7229741314adfbc69f7a3f6b242

SHA256
f3b7cc88d1203edd7755c175001b23ac490a8f12820fedc2678d0e107c0c91e8

SHA512
24492043fb67513a98da2194e29d27880d9c924826de5a240e5a916a5588a7978d6b17717ca17dcb25df4f43edf1b331e29c35be5a76158b6e7e71c2d39b3f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c99c0ac208f9837ce85ed97166872466

SHA1
6be5eeab1cc7a43387390892ad41e10938b44fb9

SHA256
68f0caa7fb79b185fccd1a0f034d8b9b438e8434b5f79d069415897ae76de567

SHA512
2f735cce866020f1d6881326bbb4586ead5264dd607549b31bf42ba30239eb109f745351ef2ffe964648707e99a9b544ef4d7113a2d6eafdd56fc3d41dba94c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec5e92c0b19c1fef650368a789e6616a

SHA1
8c29b21ea54dfbd6b02d902fed743ada52b29d1f

SHA256
82321b2f10038ea341291ef12480569e8b0d938ac6543810fc38afbb862be067

SHA512
562f004f827aaefcf8c9af55367ae20d17ddbdeed99c539fd4a94af0ce2849069c2ee93a4f08578839b2d3c559efcf43f8bb0f64c1546ef220acdca4fb69e80e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04168448f71fd4cc05a58fd07fae0d12

SHA1
efa5e72622bb722c3e4a77096d7cc65aa7ddce33

SHA256
092bf412c37713a9df38d45f8c6406730f70a1e063c62c83d1c05165df1348ef

SHA512
cef46efcc442fd5064155004f9939c76ba66eba9dc9d0996afcceae2bda50096f206528d5c99a8289f4e6eb9b3d36e202105253498e177a2a93293db082e12cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
309f2cbcc6742636959fd624caad7807

SHA1
1b078f427c27040632d27bbcc81eae9070e6df62

SHA256
620e2a90000ff8f00acc063764ba40b9e9ddd402a15b1f74212302fb5411f72e

SHA512
dab0e03c812d20462178e130b720128c0307d31642298665bb37e090f07cccff753d98412040f8c5fbbdcac5259d1fa254c19d0044ff35d91bba0c63e88a686b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0cf36393653833d6cb9c683c53a5b8f

SHA1
5de707da9e21fb223c3c3076142f423de476c4ae

SHA256
ed0cb96a8fcd14ced233ea59effc8309531a07ca02f3aecf6c50c8daa0fe38c6

SHA512
68c6b570b8b45ee1a64cd022c2bffe7058978587d54dec1d73b3c7ee6bf612e99ad939ff3421b59749e59bba8d38ba4ea0fad73ea02986a20cb8995c434b93f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ea9337d4b90cf4cda11f828dd6541d4

SHA1
c063aa6807df2a52ff41a92130d6be94e90c0826

SHA256
8b80b61b9221f2193f9e2efe1fb0040b6aa8cd29a8a9cae5f32d11646f490457

SHA512
55c8c8d5fc42afa1114b5427efcef6c8115ff0d6f7715d5337589acaebfa0076ace9ade3ab86b1f3bbd68c6da6e550e1c371264c66b0ff9593b07ed254f9b355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab959C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab966C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar968E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit