ff9dc6ba86120d70d4a4cf6ef9497dbf39928bd0df8e020b4796176154901e4e

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c064ff3d0b9a84ab0609dbcedff33fa_JaffaCakes118.html
Size

241KB
MD5

3c064ff3d0b9a84ab0609dbcedff33fa
SHA1

d76a4fd659d1ff55afa99c434dc92ca60048cc16
SHA256

ff9dc6ba86120d70d4a4cf6ef9497dbf39928bd0df8e020b4796176154901e4e
SHA512

b5c551f822436137da8413d5c0619e061d7f3f29c243da9d256e398c368e1bfc044b22872aa8c05b50164d45006423b65e65824340543e7d88b09cb0f4d9068b
SSDEEP

1536:hdYkmBB2MPqP/tNcUZcyW88V+Q6yPr6vTQRGXRKeEWDnuoSfWVM0VIcJMvNg7fsd:hdYjP7EapMCSRSJkkGNhswBKt6KejE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB2B6AB1-10A1-11EF-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421709125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2032	1288	iexplore.exe	28
PID 1288 wrote to memory of 2032	1288	iexplore.exe	28
PID 1288 wrote to memory of 2032	1288	iexplore.exe	28
PID 1288 wrote to memory of 2032	1288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c064ff3d0b9a84ab0609dbcedff33fa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c042107177f40a9144535cb92f2ed7eb

SHA1
c9f638c6e403ff1d18c144e04ae78571dfa49f9e

SHA256
1bd40d62ab42a4fbe6122a4ac0e28e412b795199e1089f4f27858995bb24608b

SHA512
507f69352a90be2fccfbc343e5216d24e06244d4adaa4e4455a6013c973b3d587a0a10c91c9056d077d2229d65aa74058a6e6142f78e03510359cb4760de5aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1bb4cc34b8b143225fd96648ccd6642

SHA1
4ddf96126eb7e7d20552feb7db6525e14b2bee7b

SHA256
6f1d0ed3c80b411a733ce7890a06e9eb5b1bc564e1e3be3e905122659bb7f06c

SHA512
0da0d3c7b501b2fb47319dc39d28e481291d77358458a7c9969e5b5b4ab58d02cc5605ffb595392b0af19eb825ffd26a5986fec95b64e1171f084da8fda23ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2eb06faf768dfb69e2747e60a1a5532

SHA1
c1d34d67d2d57428ba2808f5b9f285679bba9c80

SHA256
c7fc082da8f8d6ec6f239681afee28bc1a18277f16b278daa19cff95def42162

SHA512
7957f7b0ed04c4459b8f6aecb896535ec66d4c9fb0d9e7a9a6af28d24a2c21d520090094c1fccfd93d814f672a6d1d619f4f5b5ec06f6b6010ccb5f6ac2edba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5b58a1951e621b5e73b624de2cab4bd

SHA1
349bf97c9027213eb2960de8ee7240d93582ce26

SHA256
eae7733831145e81228334f2df15b79b38b98ea4a70848d335d416e20c450b3d

SHA512
15d8f15cdd61be8ea0d50d92dc5f0727bd028efdfa60e18c983bc41e3cfebe19e300accc9e6563606766761f9c425460f8e6a2161613e6a035c9740f5f6d4033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c33b8cd32a8928dc2693cc3feb449fa3

SHA1
cc854a698c2faab12121c76b706fa93d6cf962f3

SHA256
c2a24d2596cacb92124ce4c215329052db87bae745f88ff0d1457eda2a8e35cb

SHA512
48fb4933dd2f4a2fb6e6c8ddbf620c32031e5ebf3aa20ad6a13363bd0ab87c4438d9856712c90c242eb2366bf192fa2be432bf2727c81359f2c8f09ce7142d59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd381dfdf1a4e3a810a85e0f555e70c3

SHA1
c25f36ba3e5a877de8b145fd333c958e9d1886e5

SHA256
5c6a5bb3ace914fd5f482d6be98073900c254455c2d0e7af96970744ecb317cf

SHA512
58288f3799f884fa553baeb9bd2830d2c0a350b1a989b2121a5decf93c02a635505ec74ac55bed468b4e025e64b8d6e0976b1e22a1643d5ada4bc4071bf8f6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8acb74e8a7e297bcbcdb42ee3a19bb29

SHA1
8d5f31e3cf004810ecb23dfcf86494a34628c4dd

SHA256
843362b6fe6e925b1e78e21cfc6c76a5f5c842df3b9be140c42b870897796d77

SHA512
02977b0a5dc71f654953a7318ad8c377079cff96920cb2b3b526b82fffcff6fe58c0273af8684d906bbc9536dbbeca1c4e70bcd72441770beac6071ac8086527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4430c3c534473a51cd4336ddf76d68ac

SHA1
50687deaf726eaef913bf03f24c2598e8a42ca49

SHA256
cdc964720364a0445ae298a8220d1dff894a4ef2f584454686a6483e63d45f76

SHA512
2d2516281b78d3b6c406162ed25bfe6cd98fd84e3e9bc4be65587982b3936cbf1e81aec10802f249a6734036a54355f20087e5b97db1fbba088fe80121d6c7b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d133b668c51ccc24203e65f9fa28d2c

SHA1
f3f3ebe649789f54c1a384d803b74f5e40277318

SHA256
b9d942238eb0eb5de30734ea66b73d63e1c82833689050586b69d9835a9974e0

SHA512
05feeb0385173439153da119f08ada816e444326f6aa62aab05434036643cdcc1e5f71d35470f317fd71250b3e08dd95fd741e8e9b3a640d20f6a629e8e2d829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98e9706f4541d64608918eb3c5916d37

SHA1
460d21f26648d6e776e3983f38f4e1c66048198a

SHA256
824d5839eb180b533f9f050c5ebf4d31c4ac471a9d717751092f875749809659

SHA512
2e325865870a10bdf5fca51544e08788f0d779d59169a23db07e0e5cf1df202f19bb8184e026f983d7e8f675996088ceea20bb4f837abf76d86475c553111e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be3c8eda1313a634872d17c33499415d

SHA1
b2227f4ce8f979c78229b71163f856e121684655

SHA256
9b88cc5deebb7d261bec3bbf6160b79080f2e31b51055e3dc16e06b0a41256b6

SHA512
5da2d8233b741ffe0e6bafb6b7c5063e58ccc6b1df4818ce884c9e8b2fdf8db72fd555a8ec1eef42bbc3dea4e7a37728dd80e5c59114eef813b9ff37f3cd2ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ddf66b748d706cb5a8acb7092d0583fe

SHA1
aa6cff985b960d9539ab140047652901524e20b9

SHA256
8932aa50c08471abcce184df05f7f84c5547199677b13d6def6af32c700dd028

SHA512
cfd2c80762e08100cb104cd5444e97c55d5408f2ba675f183bb6156a47872498c275f4814b40cc7786511008f92c9b91a1e2105aa253a72aa5e6e6a1cd1f798e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\b[1].htm

Filesize
178B

MD5
cd2e0e43980a00fb6a2742d3afd803b8

SHA1
81ffbd1712afe8cdf138b570c0fc9934742c33c1

SHA256
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

SHA512
0344c6b2757d4d787ed4a31ec7043c9dc9bf57017e451f60cecb9ad8f5febf64acf2a6c996346ae4b23297623ebf747954410aee27ee3c2f3c6ccd15a15d0f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab93B7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9551.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar93B9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95A4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit