c8763248b8e780e68b8069a261763beeb82bdf9e9ebc2c153f32c20adcf9a335

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f03d97919b903843f20fa34596b4901_JaffaCakes118.html
Size

57KB
MD5

4f03d97919b903843f20fa34596b4901
SHA1

2685ed27b36c10ee08f5543ca99f9a05791006b9
SHA256

c8763248b8e780e68b8069a261763beeb82bdf9e9ebc2c153f32c20adcf9a335
SHA512

c425a9bddfc84b1bbdd7e3d418c1ef3298ecedd9a1ef59bdc79be821e822c6afc4667e1135bc720a1bc31c2013eda9ed5543391028568cef81e3fbaca0bf4564
SSDEEP

1536:5mxuX+bsWPW23YC9yjFGx/OAEUkXv6KweMzAjnHaxc+nCHAKoskkKYRQvclhQEsw:5mxuX+bsWPW23YC9yjFGx/OAEUkXv6KR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422093317"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4FB3DFC1-1420-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f03d97919b903843f20fa34596b4901_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b2b67f4fd0d38688b8ed22856fd76385

SHA1
0f30f7b6ec2974521eec9d065bce5c70868dde5f

SHA256
1ea55e225da23b11f64cfff9a65db0ea830ee572c65236f40f4f327e8b1e0dd6

SHA512
710dcdde46f969c67a3fbdfa98312ba8707ff3311d6348804b465ff2d01431aecd3fff0988f1fb430e411ea44d69d5378e5f9c52b2a93f22eab34b775a224b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f484e915d85750c546da1e1b841841dc

SHA1
559f1bbe0683fb93dc906ca07de70cf574896656

SHA256
90ba7856aef92d3925ed1be9401d2e76a4eca2fabb899c68f591cc40591fb7c4

SHA512
5f8124b7b6c1784965ac0477b7d58629ed0a5a6ea2214e23340f9e75c01fbed26ca6869fd7ec028b667aceed48788d6fcb12f9e72c163a1cd2f6aef06deab92f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fc9e537caeee974e097efac9cff383f

SHA1
84f65a50c7dcc17061ecd573a38ad51822c59f0d

SHA256
ca275e9762af573f8f65e8835318ca71e12e1ce6e226452424cefae42d822740

SHA512
29e729f2a2394d8c8e434120b02c346553c1f2bc35266f3a5743204061fbd31fd83476502827f3a8cb5543ca8ad402a8fb04623d08f878a74b06fe5592b35278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5357048b576eaac49f816daf355a0b0a

SHA1
a85f8de9787fce33f51c9f4e6b3581e21d5936fd

SHA256
62940e9e56c2ea81bbd90fa2075f57919a6e8457826abfa13cbc374991c05776

SHA512
0005c0329ad2b3edeb63260b5b515dc860d6d83f521598be838004c7574912fe925819d3b5f16e6ac1f492e1e11f8c81f2f73bf79aa45a1c665dfedbbf77a59e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f6f60e16c5832c0dd525c98e240bdee

SHA1
78831f74fd1b5c4e3c79b9e83b6237f8446702e2

SHA256
913a59154a2e4ced64c49eb40d14351c29094ec91d001e43c222ccae7f44929e

SHA512
e538ba03fc2a29e1fd7a622951b75d8f33807c6cae06b3ca46c83b50294d3dc259e4b8ea53e9144a608ce2c68633b99cf67208d3b40772c88fb3eef741594331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3a3038f7086a6af392b4448bcfa9d24

SHA1
776286f82332668de19d526b691f4e42caa29b56

SHA256
63ab83e132c0b754b59e7e23fb898c6371fd3f4180d72b2980fafe5a3647e772

SHA512
4a8cbe551873daa5b78136b55f5c65533fd455450ee6cd6e5c33fd5893239c4a04dc9bea8f843f46eaf3176c99a7cdc4f4bc49941e96cc34dbf3c2edc1d2aa0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46aab983c5f3d6d9bb959148b27b34ab

SHA1
dc3d757b8422edaf132b758a0081791598a3b8c9

SHA256
a41e7ff8966b4992db402dda3864c81008018fc6a3c3aa003f1ea0e1b080b8b1

SHA512
4eb0daa38d1837e44622e05b9eea3fd7e95456779383883180315f660caf25bba76bdaff27b0f935f638fc1bc9bfb7e00170a7f72a6a7e7394da0d64377439a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68a85836886775995b8510decd2c5d92

SHA1
d91f9f456a88014221243f2dceacb437e28e660c

SHA256
9afc5b5f78f3bcd58d06966a12e38d38ac3b553acfa2ecc1373a14400338fa3b

SHA512
1667b760936ee84c637fdcbd06a1b96a181fba13acc7d8edba3da2a93a817c0d2ba67f272d35938495df8955d1b3f5b6404bdef5503282f5bb2b01e8c63c05c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ca0cca3939207544122bd466eac64c2

SHA1
4cf76110a33de95cb65650bf787ed8c6e8ff0060

SHA256
f3b9fddd0ed9fd3388375498ffdc9bb42bdcefd84eaaaf2cd8c30f55f12ecb7f

SHA512
d2796a549054ce1162dff6c3a72393f467a84639542aa44c5629494ce170c54b446f0b5376079dca427bb31dddf7c8cd30692fe2b23befb33a5ef4e33e85a021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cade493d503be3b3fd883010b94dd034

SHA1
75bc556dd32eef04854ff8fa0222f3b4ed513e0b

SHA256
d778f7a23161b225a43cf4748720dc373f2cbd48364b218c69ed457d0e8c3424

SHA512
57ba803a5c885a519fd93837531698ea4ac75933f0a0e74b19543f532567301b287cc2c8f9d1a39d1c2e71cddef36af0145a6e6396eb611a0b4f01e9035c8d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eebd6300df79639a113954c0bb3c9d3

SHA1
2a00c7b25e84b45d8abc8c9a4e0a86f655c5576f

SHA256
f6dd0e68106a122d3104bf95b599825ff9bcff84b6c3013f6caec7a816206c11

SHA512
dbc79e9809a3aadb8cf72d0f4fb6a4d6402a5ff2b03756217ea6cb77ea28537fe1e97be36217e2b9d804f953d063db523d9ec425cf771f0814d80aef1d87d06b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16b5bc5a1bcf0e1fc73a01f6da364981

SHA1
7f5686de6f05c742e52361336a5efbdcd30fee24

SHA256
38a9352e3c8a6679ea5dec4dfce333985a803c01bc2fe15126385de8347f41c2

SHA512
3c209e1dedaba7a06f1b57932f6386fa0ec8bf49357e57244026e2f57e66f45d31dcbd2aa3065c70f7c8b802ab46913d1ac48e494f5263af53442eea096afff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c04858542db860a18ce578140c3978a

SHA1
15d966d6664f602ed88c7ae8bf2f99461eb9045b

SHA256
0d2cb37617c11385f4415c1d27bb58642540b560c72892252ed9db391540616d

SHA512
7b26df3674d173bcb1621402342ab1904dbf66af9ee99ba27a90c62ad478cbf9dd3949debc3574c3195921938e319ff9c5ba4699ace9f71e063eb522c4c0b98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bdf2e7bed34c38ffac68c9242f6e1c9

SHA1
9579eb60cdbf0d6a893172b922f0396510077ffb

SHA256
12f4e6dc1104ebb28d9b7e12a42d9a5a6cfe2b9c8cc0ef79669697e73155d9cd

SHA512
c57a9d309458883a6cd59c4c8e8ee855e147bd8795487165f99135259f4bdde706067a3ac34c7aee0b4b5356c35b41946301200c01c7b4706ec50be09b646ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
57aac0baf6a486df539531ce7b532921

SHA1
ee5f7ef1da013809961884f60403bc222bc9aed0

SHA256
32ea3dd512e7c5b5a1d606ef93f797b87100c8388a48c3f6a649ba80eeec235d

SHA512
c947cb6e66f816e573ded7eff9d4b6c108277ea21ddf914acac120bdf6f9f496adbf93231411461e3763f19b40803288f750654793220f5e7b3f825233e75633

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8067.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar807D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar819C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit