69bc184a1b8d2efe29bee402a63ea5a7737b1bc971f830ff667f6db35f1e65ce

Analysis

max time kernel
138s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4df66c795acacda8fba65dd540d77ed3_JaffaCakes118.html
Size

109KB
MD5

4df66c795acacda8fba65dd540d77ed3
SHA1

0527ee921bb244bebad580e29128149b015d7da5
SHA256

69bc184a1b8d2efe29bee402a63ea5a7737b1bc971f830ff667f6db35f1e65ce
SHA512

7568b78d5a4c4152cd53fce4cb9f8daccf116de9cd50dc5085bda05bcde24aabcc6f11b14da87d57171e94401d7e804baebb08a5b4997e982fd6cf01db00de84
SSDEEP

3072:XUcjvG8rMdcXmNRS/RHHCBtOod+hDpRkR8O4Vnt/V:lrXmNRrcRkR8z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C530A8D1-13F0-11EF-A6D5-5A791E92BC44} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422072898"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1556	iexplore.exe
1556	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2240	1556	iexplore.exe	28
PID 1556 wrote to memory of 2240	1556	iexplore.exe	28
PID 1556 wrote to memory of 2240	1556	iexplore.exe	28
PID 1556 wrote to memory of 2240	1556	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4df66c795acacda8fba65dd540d77ed3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
c385b784ab9ca816e84a497ed6ae04cc

SHA1
ebf2dba7c1f1425116a8ff8b73eab06fc4e47a7a

SHA256
8b1eaa18dd169f3513c85869aca04c1a469ce3351e81bb54ea0fde5c80396566

SHA512
19bf0214112ce18c9f804d386a9d306b5e77479cb863dfd9eb90ce16ab7eab9dd2aa490e82b99df81ddcde41525eff5c4997c912ea0d85db589c2121e3db0718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9f91f66b22520f728c70b7e6cb90f6db

SHA1
bf8107cd6d8b031b74270e3b1f5187a670f6c01e

SHA256
ec8220ae8a057b5df4f7c7d48cbb58c69e6b589a2a67ca61419cf64a986ae710

SHA512
8c6f37e7f6e20f73dfb8fc4931542b89aa854a15b130a8f97d7392b99cd56746f71ea87403832b489aa22331fe8193528c08d0d497a6f693671cac992ec9b4b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd079159ae0a8c8cae9163bbfc720099

SHA1
f58cd08b11c9891d2c3be9ac09576b58002df4f3

SHA256
b120b141988de42dc5dc30bd168c993cc28f2c903aed227bc9b85375c5f75c2c

SHA512
cfa3f7a3d28f1dfa6fcf1a05a920f8cdf602dbb092ad9d6e39148cd1e2b54332f3b664486c65d4c69b405b877901a75d17cb1fe2d878cb1c1a52674b89586a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a94614b8520cf5e641013b6b581bea9

SHA1
bd20a884360e0e2ec6ffc271ee7b7aad4fa12928

SHA256
6caff50368867d658134d657daab36023d9467e55e9055cd7be1d52984ea3291

SHA512
076f4e1b35ccd49a745b0ed42c4699e6ce27d8f4be9614d2cf0c5fc064f100e24e034d4c7d3795aff20dcd9b2b9f84ed91f9cc3144e965d8781ba1b19daa5034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af6e5282313b30b245278354bdfbc7a6

SHA1
babf9aff53f1d43688e46868f5659a0b0f8d43c1

SHA256
ec8167967fc4495728b6d581d1c312644fffc1872eb67bb0bf453a2346e5fe56

SHA512
a216b7ebc0ef66dc8922c8c75b187bc2995f30730287c9a229a165362c493b9b82741fa2428db3ee82d2e8ed2397ae15898b3406de8b88167adaab9fe0bee4f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c7fd47982a045b33f167b8c5bb29943

SHA1
a7a09b58a67728e9324889413a0bf1ed8636a13c

SHA256
016b1e163bbef272958de7a733cba8fc3168841c0d2c65bff78031cb69d83f09

SHA512
e9659a0239b6d139f4046105162ed826708d85e04b59d4bfd2f1ff249e8c6bf0296665d9ba00b5a2e031fb7030c9db8d8b19d5065c6c76fd04292d51d969895f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70c8d7fd446055634334dd953a4b0a3c

SHA1
e9335e4d3dd7e8eba76b70e05fa124cc92a3b193

SHA256
013aa169b7819fb3ee206dae3e8978807852762c64ddecfa0e89eddf24cb33ff

SHA512
e625955269367927dc67e9313a2cbe13cb37e2dc83938a63ec3d839d203be573f90b5509b346d3dda47d36123bbf9f87006626b3c3daa6a5baef53d180f8164b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
373cb5fb26f47a1af53056420206a899

SHA1
0aee1393696c5b2e86250f61cf45f5b8658929a4

SHA256
7ace28c46e9f31598d0ec7b118e4608bd8306e74887dede928566f3ac85a5a8d

SHA512
2637e8f8c32875c7b8df4b3a16ee761bbf5d358fa952f331a4ada159db9a345896a0ba8cc99448b7d05e444ed7d3396c6b566361657975ea5f67cc15b5bbeff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7219ca59c1854a2406e9bf0dae3031

SHA1
0e6728b195793dce88eb66cc09454345bf9f58fc

SHA256
d96e52c2da12dee1d1318c26ed72a0adfd48f86de28da4169d3a0a443bd27068

SHA512
94e9bd6857b7435f0cef7358a5ed6a8e4ca4f3dcf25bddabacf16b6b3a09e2a61797a36f1084f955b202b1ad69893a1daaf874a300c0fea49a27c0a8f4a9bc4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74b12b7ccee2433df74e9e3e851484fc

SHA1
cacc625673f62f12417d408264833c397c13ae09

SHA256
614721a51788afbaef8a241c229b5b700509d371b2d95f1fe897cfb9d43e5422

SHA512
da57d29b624ed75773f5467394442a84b64a782181a8d728e0ea51f6467333cb4e2120c35720fcc5c7fe156e6517c00475f6560d7af8700a11cbd7312bfd860c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba564c931cc9f1bd9cd42b1a6af157c3

SHA1
dac75759e9da8827e85271b5cd14f0ca4dd4177e

SHA256
edce6df852fcb1a25497e3acba71962f79221be4718f55de9d041744b7818b46

SHA512
0e4e2f42a82d6f4be6aeb51745d394058bc535ba492421fe13169d9f7e1781483a7837ca052773675a2d9bba2f0cb9308764117e10e8d840676c09f9f3ed16f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91cde1bbc4cad37a2f4142850a142add

SHA1
07a248994304bd22c08e61176c81f853fde809f1

SHA256
9829bf67d1a8d4adbbdf855b6f8f370ea73d7f871135cf9a83887b352f1f3646

SHA512
572683fcbfdb4d83b8f7912447f61ca8251f31e654e63a94f917658bb10355487749f423046f60397927f88d66601cb1af05add72274320918640d03471d0933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa024a08d7b3c01cc6817075fc6e454

SHA1
1ffd504d8e2bafb929e6bc8bbef2aacd8f971b33

SHA256
e56f414a33f8883016784fbd8164ad13ba5bf53cfe59915b054db9725803f3db

SHA512
14167d5e539b571f1e5438e2ee37e7ffbad667e640452ce85714c4ebdee64822dccea9487546887afe54818c4ac46fd800ff7cd0c497f5d505f2305131644f7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
294419e0d655ebd43e6672e2d07b3f68

SHA1
df90879b0fcb2c870fccadf809cd99e8b64104d6

SHA256
82aa5614717f0964b6701cbaf8572a73d7cc900663fcb7fbfcf53774e25a5b66

SHA512
33921425573c97903f6b1666aec98c2b2298884154d9e138a81777d2a285fdbcb016bcdc2fbbd532ccade1a2addb10e1aa4de3343ac1e8f67036e6b83cb18cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
eedf134c17cb22c73cae21fd174eceae

SHA1
d4f513eb0a898ca00b165abf28354327ad9aa0e2

SHA256
d683ac0055fbb5193027e46d10f6fde83771d9b115e0a1fe3dee9b3ebb9be538

SHA512
9307740fe61b9856b7ea2512e22eb8f7e2c75a66b097e3f97b1ee74e9b72a9864cdbf55ea424a72a756a8f83f567be81ded66a3c85f5494f8edf3ca5ced4e079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\platform_gapi.iframes.style.common[1].js

Filesize
54KB

MD5
7ef4bc18139bcdbdd14c5b58b0955a67

SHA1
afe44fd9a877f81a3c36f571c0fc934324c6cbd7

SHA256
192bc707852c5986f930528442d88a79e5bcf4513aacc2b722a3c5e964501838

SHA512
6c2920e80e4d5059588a32f75bc2b5dcc19f8d68224c0935d74f9fbf49476ca5b1ce43c279768f3d36871dfcec39f36db3fcad559c2f93cc540154cdbb04dec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\cb=gapi[1].js

Filesize
133KB

MD5
4d1bd282f5a3799d4e2880cf69af9269

SHA1
2ede61be138a7beaa7d6214aa278479dce258adb

SHA256
5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693

SHA512
615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB73.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD2F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC14.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDB3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit