8a9cad7073ed0017d7814fc99f59166a0188210f77c4dd617d2562b3e80a9913

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44d9e8de9d17d942caf275770a2901c1_JaffaCakes118.html
Size

26KB
MD5

44d9e8de9d17d942caf275770a2901c1
SHA1

1802fed69a039afbc1fe7a80b161e8c2a18a2cbd
SHA256

8a9cad7073ed0017d7814fc99f59166a0188210f77c4dd617d2562b3e80a9913
SHA512

5b4cbd56ffaf1d54aa45dc06a09f7c125f381639457d3e76e959c0eeaec7ccd37172a76b1e5786a086484f5872a30bd65c21e067b1a8efe641bb9b51d782ed18
SSDEEP

384:6KzKAiOTU1OMaSC+f2nj7eQ+JJntN0megLry3F+eHOQnzQ3Dj:6K1e4ImQ/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421915691"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BDB968E1-1282-11EF-9667-569FD5A164C1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
940	IEXPLORE.EXE
940	IEXPLORE.EXE
940	IEXPLORE.EXE
940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 940	2724	iexplore.exe	28
PID 2724 wrote to memory of 940	2724	iexplore.exe	28
PID 2724 wrote to memory of 940	2724	iexplore.exe	28
PID 2724 wrote to memory of 940	2724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44d9e8de9d17d942caf275770a2901c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
792688a36d56dc2dd6e787aff8054e71

SHA1
036ce9fb933f7e42d9ff37a26a5225191eb9116c

SHA256
eeb2ba6107646fdea9903639122794b7d3fe3a82e21f1dad5393d4260492cd11

SHA512
15a4420636e959105004a54249d12396f02bb5122a0ad352f564c2bdbf7afa01a25fbfdb5ee787d371a6c98df66bb2212e05d58ee04096a633c935977f6ee68c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0ba02089ed198fdc9685f72ebf6a3639

SHA1
e4dd7b43ebe93cf5eda72fcf4afbdf237e7a5e46

SHA256
8d4b49b1e3d8072091b338ac96c5b542ba1130b32b8acde3594d64ffe372e419

SHA512
ea05287f2b2bed1a62a2767b2c78bb70ea9798a6ef9c39be29df18244ca30e12c0883d56e42d50b982c9b6a457db2b2ce8e45d4bb2f59f7e11127bf6996ddd6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f7c414f86004edd1323d36b741084af

SHA1
fc37b4eadaa05c05936dfa14d5599b6ca76a17c9

SHA256
0057aa1cfd72d18b3a3a03f42789a122462c27b0e19fcf8b02549a47d284b27a

SHA512
b7c8c3bfe74162aff6656b373dde66e6c7d820ce9cbdf79bb3e3ddebe4e19a2c3b867a2846b5164e1bac035a491d7566730a84a7ee87040487f422027f72e81b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c4718b1a514f96dba3183271c6c3e5

SHA1
a9809a124a5054bb3932a01c4ab1f513ed673b78

SHA256
01e9929debf1881a6903a1f5289d58de649091b9ee3ef962726270f8fa094dc4

SHA512
32df6cf6028fc142a7a98a33d92399800ded9a8a793184d3cae33f96c3b4ef27cf08fe04783c9b60821fb9929600cfd685fc5d46b37ba944304755d97fc1d0da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5d7e95e1c9aebcdd9c7294136c032ca

SHA1
935e78abdd9890d06789610855d54313ca996853

SHA256
269c383166391b6b113c5108c420db2dd1615e52f46623f1916d7032e48a1118

SHA512
64b5c44ae3091a1df52bfa3e66586d2e4d48b2d279a5c3b9a09ea80e460758699abfed2d78782a83007ada4b72729282f4af90ed6a0fc7ffaeb46f2a9c855c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2239fbb4b3a6f7c0f3d8797fe9800323

SHA1
52d8ec87722a543f2c6aac92228d10b46a0fbd8b

SHA256
6e54872e10f6f80de491eb3cbb377fc1a9273f6583df74db472fe3a363bad44e

SHA512
de1904d49bc718f2ad418cda52ed74395dfec16293ca8d2f88a20117a9b777402e379c5c6add16f7c4ed6cbb230b856a6a1668d7b7ed1644400a2e5f6c7ca6ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35fddfbf4728f2231fccbf675e1efa00

SHA1
ffa3de06014dfa13e74b517c900e9f504866f5ac

SHA256
6b8a50f292fc675ce5b78ad24d19d4affd4001244e796bf6e7c4cf6426b2916e

SHA512
673ef5318f1d330a152d186c0bb52c3fe3084f6aa726c2ffca10df84474dae65c9a811a7f41c1c9b90d0d4913ab7cd363e59345d958c67cf52ef1e1798fd3a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
989e521d93d369f606442980b57b47c1

SHA1
15101535bc8ec35fa3ed760c40c999c32f5b2353

SHA256
487258321a269b89f22bb8440fe569e36ce7dfa72ac8413b64fd28a6580a2764

SHA512
85db68dba00bb8f5bd529249cd14cf142e12d6cdad2ccdd1f7af513b44e06d6767162c930d12bdcd3732f869f52fa0aa8065da39a94f74491c72817e5606190c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
180abef4e21b71bb0274dd7c33dac0ca

SHA1
71a8df89306ba433d7e9b45c113bfb1a219a0099

SHA256
cc4bcb1ca3188ac97aeb9410d479d246025540a4e5c5a9be5900d232efb18771

SHA512
d4dc03b7ba9a0e893d2e8d1c9c1bd406d92036f03452419a900cf0dff3de5b7c39f45ab2148ad6415dd6c8e2582280c07cece3ea26c1bd0f52a731045069706e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2dfef64bc2b331d7a73d335c92d4c8d

SHA1
e18aa9b2d42f31d73786cb1dec6476bff61955dc

SHA256
d5ee63ccf5f2be27463ce9833b185cbba90610e29ebdd5c4e7fac99ca0292252

SHA512
6483de4cfa928b1c6262838f85bdc917dcdd6f6786bfad21627de65ddb8942f533ce90c5b06d9125457976723f47c4e6c39c57ebd617ecef1143a867c32c2602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9c00dbc8ecc2ead97d0aed208f8d87d

SHA1
05a6a527189d4934632c741139ff92a36d9288d0

SHA256
fe5012a97fb46e97b9ab5bd2c978b9bd70dbd7bacf5d7e994ce9973858c8de87

SHA512
d317d4078d7c7222563565b0e0d090636eac394740f156eeb1d91492354af72d3584f4dfbabf99680e019ef701f5dad36b60dfcfcf1c7d448eb98ed8a82d0afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea351c9a6bdb64a9f705f13b256187be

SHA1
e71b344e94f4df09e23754fcebb277a00038cd86

SHA256
d7bd76ebd7f2b35234c4dd1ed2208d45ee8ec6bf39dfcff0a860c05353014ffa

SHA512
9a90491f8765ec94c26b56e5cc06aba1f186f23808151fd3340e9c3d526ad36b38c543ed067b83c09d8fc6c5dd8804bd2d17c73d6759d5f32adc7dff3fb8cc32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
cbe7e046c3bad596a4e85d188c85ebca

SHA1
efd89386785b72fc9d8e0d25b13827595ab375a1

SHA256
635734c835ca6c6cf59f252f885b578772f40a1277c70924bd2f12c52b37fe30

SHA512
5b97e9b559e861ae4d3caa29d76bfc608cf5c854de068277caf96345cc089581ef4fe624270d16618ac93a65855b56012a63f12d43a9c21ba83ab84156075680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7b87d69258a9bf9616630a27d07b5983

SHA1
76a7d2eab2603758746aca6420614ddd11b5b2c3

SHA256
00955a5b47566c005bef7c6624328cadadadaac84ae5b088f3b33e6819fb33fc

SHA512
35fa14cc6e4ccd4d2586829273260830e7f5291c615709399802e470c10b65d0f1e8e32d1b416b72c601cbaddee544745d35f2e32ffa0ba7410a385dfb322eab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87A7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar87AA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A00.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit