c0ea192ce05ed82a869a68d2d0987a6fde5bbf25f9b641c089cb5378b9142acb

Analysis

max time kernel
65s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60d2fc8dc1a3de2a0c4b58d29c42c613_JaffaCakes118.html
Size

460KB
MD5

60d2fc8dc1a3de2a0c4b58d29c42c613
SHA1

209d27d2df4bda86eefc31a4729c4f12ee35ef4c
SHA256

c0ea192ce05ed82a869a68d2d0987a6fde5bbf25f9b641c089cb5378b9142acb
SHA512

fefe8fa2c2b251f0f20baf3d5a68cb3b42c992c0d40637953f2f512788949fe5a8b4b7ce71f943edc5e303c347e678a1c2a477202e707fddbe94c3f638e08011
SSDEEP

6144:SOsMYod+X3oI+YwzQhsMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:h5d+X3qc5d+X3c5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000945f9c7404ffd142b370d484247174a100000000020000000000106600000001000020000000ec4a7f4f9b0e6a2c6b6a2647c26e05d87514adfd0fea011b87e45776592e0c03000000000e8000000002000020000000c73b301df8805e046cda1e246cc18bf1242be75207e176e4d13d0cf1e53e2ef790000000cfa071fa201c6fc4608fe96e14cd57d03dfce078cd2db5d7de3115590bc52ca017303a67fa189b8914052263bba9d3acc1a8bfc171340c5647311d3af6af90b085501ed84384a164b414483baa33b0e477d266d3c0be16f8dbb3ae41f5956106f023b93896afa13d021b7134680867c8195f0467bad60df2705792c32c9f18f4715d84567d32ca5b07ad5574e053c1bd400000001c00c72c63e9f40c8318e20fa7cf2633a331dfe71756a1f0aded3578e271c43bfc09d105304369e27d9f28dcc203a3a98d7d21676bfbc17ef5cd77f9c2f7bfd4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50B1A701-16E0-11EF-A596-F62ADD16694A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000945f9c7404ffd142b370d484247174a10000000002000000000010660000000100002000000072f3feb5d88491047b445771b53a7cac630deeda67c4aa75c6424158cecab83c000000000e8000000002000020000000e8c3358d070a18a4c525125cdb00f5e2df1edbd6586e3c55259c8f90de447a2d20000000f6ed617ced8e56bf2420b5b4b9be999e1d0f09fe62c1a8dc17c18d5d87009ef74000000018eb62b64ddf39e95e1cee2cdda5bd848729a832edd4b28f8183edac489b2853029f82add12f9177694273a84db771096652646207bf71fa645872b1309d9379	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0882029edaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2636	2364	iexplore.exe	28
PID 2364 wrote to memory of 2636	2364	iexplore.exe	28
PID 2364 wrote to memory of 2636	2364	iexplore.exe	28
PID 2364 wrote to memory of 2636	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60d2fc8dc1a3de2a0c4b58d29c42c613_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
626091c8e2f837de538becac7d37c7fc

SHA1
35aa5772ea93bb81fa3812e5f93bcd0bc61c6404

SHA256
abfa1505f2a196a92c764ed28d4833fc15eed0d84d36478e17a2d187c70bdfe3

SHA512
ca41c7b0b0ec8d00cf012ac45cd92855d90b637d2780e5fa72107c6d27d800e893daf431f4ccbe0489ad82c8f1a453f1040b5014613d8ceeb88e5ce40b0f2b77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
454fb6d329fe71b8d7dee1a6a3cef790

SHA1
76a2b197316b3cde75346da9daf7fab03031508b

SHA256
e31bd41cd98fc54d9ebf393af157426ab1b20bd74515ae0676fd70b3411f4519

SHA512
c1b8c221c6e8cd7d5e44c586cd6f54949bea791365454a1ef99526b9bc3fa1777b447e90febafaaa3f8a0e0380ba9b95092c16fc834b3f70157898508862b35f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b5507dc43a268299bb83813a499a9f3

SHA1
250b9cf4646c5560e8cb3a0968f1eaff1f3cecdd

SHA256
c733d80d1a9326154d8d897e4c0a0a3447c22ad84e19d32c08eac2e5d34ec35e

SHA512
39bdb05c59a037f03eaa106de411c6d3983ef236ac6a4e01b9ca497fb6887a65e6a0779566983d873593ff8848fc5742d71a6e9dbc588c894469b6772eee74f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35d9c77dfca53643ab2b2ebbb7d0b4eb

SHA1
1c359303b30bcddf98a1aad41be5883419f6dfe9

SHA256
f10eeaaf0e28180afd35857a7099ac1e846011af383bd85e7c4c3343ca52b007

SHA512
a6831881bd0729509a0b17b3fcb1e3cf8226a727e6954eae84236b3032dfd12352c7f09189229e01655f32d74039f966c6002c8bd7cdcae7a21f4482b327ff6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e97e123271ff71010917658d58f5e4fb

SHA1
411d065185471e9a87b51cca96de9a50e101185e

SHA256
5771684ddcc82bf0e88673f30fad6a474a8792d1f220e04ff235399bd0dba80e

SHA512
f11fc0240d8cdace9d31b0c286910ca5e7ecf5b62057a695cddf9132dda58a94c59b188b90d087c2e0910b6346d4691bab1488c1bdcbd9f0d8d48f83ce1beedc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
401adeb1ec64c8baf97cdc7e21ebac7e

SHA1
d3ea4a4d74945d3ee600ca8ef0da6d43ed37f4fc

SHA256
c3c9eabf210f79e2a254f3a6acd442d95886e8d32be01982fe512018d08757e9

SHA512
03ea4b872892c84ae719c2b99a9423c124bffaa6a2d554eb3a2bc5415694cb93c8e3b8bd2a99f0690bcbe44d08c182a1893982a163ac1caf66873e258003017d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b28602f257fc8ca90b8add4dc489e4

SHA1
c47a5b5290eecf48a54f3479e278ce65c7a07a4c

SHA256
814b456da1b89effd3186b3b3afc1377d584896d698ff560b200b11c7c354cc4

SHA512
6022095ce6b88766be5fb3055a4c6fd0dc591914a896f6142c08eb0872231dd6c09abffda1cf82df7784e97defa2d816e56c871c14d4c4f0b7b1921b0e148f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2ede25389435e38564ec681cd45e301

SHA1
b61264e3fffcf3032bafd11d988ea9c98ddd3591

SHA256
6d96ec646bd47cd7e549acb49bda565f2774825242b82cd999bb925f4ac376ec

SHA512
da8d1511916ff3f3a0fb2493143049551a5395d0f98f4e6ba4d60e8e1b564fd87f65c17f5da357a44ab93b177262a82857229092c5e0e39d19169406f748d25d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
863c1a335fe49af564f5f24d49158524

SHA1
5a152f42833a8277d8eafc1cdbf1d4bd4d7bba2d

SHA256
4211b1d48efe3ae4aac4d71dbdd9441d3e24696da08a145dd879dcd86ea76a8d

SHA512
877e58abf1ac77275ce8dfeec46528fc7ac312c45eb071438032db68bc4deaa9338965024d1bc912eaf9fb624f91a2649de02f48806df1930af7205f1aed1c39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a26e35e37476a6ed14fdb30c399c213f

SHA1
05c34679fa41d16fc5df42d3c8f6384eedde72fe

SHA256
8d73a347abadf05bcc0c8895fda0fc623518d23612ad59287189058143fd3b76

SHA512
e9d7ac95cd71bf33d778830907e4337d72a75174965dbdc0c67f0fe28b9684bb67cd84d1be5a0163e2f9577158765d5c22afe215601f7ec56992d7bce2d6b3b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4e0d59589b14478df21c8e04ead47e9

SHA1
3335fff84a7401c1ce1201d2a2489377828e551f

SHA256
5f089da3965a79863808dd309bbb37a739fbd33f28f46849de041ed542632f60

SHA512
1d84ac09d473d25bedaabe597ed5cb0a496cc90989f3447cfcbb414fe6f48e3d9e9b8a31b9f1ff990d084931b9391fad74942874e2622cbc93188d5f220519ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bab430cc5a97530cafde1c4853254ed0

SHA1
7084be5de9c8c6b887cd61090c4df041e7990dc9

SHA256
755be0a4447c839b1793ff90d6ddf32d4df9b0324039509892982d05e4ea7147

SHA512
c5b32d39a478601bf905af9ced8f33a346d6d7a39157487ff84877f05b117409c16cf224a2302f95fa7f7f0a90e3aa437d322bf4b0ef3cd558e820023f4ebcec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f3def662727a86084cd49d0d0faa780

SHA1
6656e7263257af337c3ca626ec701df1b0e6d139

SHA256
75852af926ac484e98f414f72e12d873cc27710e7a6a3e4c9f694ae835cf88b3

SHA512
935b03d2f028f4cf1ee32105e238ad61d4d8e4ac427f66bfa8a75dd6fd1a2b6ab6b907ad2bdac08131558ba156751db3da00a6f34bd421401cdeb5daba5b4d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08366baa3aaba0a41d3f2f08bc7d960c

SHA1
16feac10a972d016a723b88e1807a73758e50bd2

SHA256
be241fbe69d593b3b4d8e24545808a76f8e2509f9d45819e4dbc003a3c3c1adc

SHA512
7e1e78002ce0d234d6b4410b25b9f7b15e8b42f024108e0157d8011ded02d7571d240714da7e7101e0600ec7b50d83f1648a56a1bf2f8eec0ef5da8cecbfe4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42e086c24dcbf4aa29bf3b8fa66cfcde

SHA1
c78c4f2014d3b3e7d5a2073e4cb0c2c3499c123c

SHA256
f6c895be0e2ded47545aa0bda59c5ab32a657604b3b1fa2664f665f1caa20e0e

SHA512
cd5bf86ad7f504564df5c0248c6d103e5a4fe55d47f833f8bfa5e8c627f71be5cabb2c74cfe947e8a9e1d5cd33e2525afe602c273fd7d95c21c38d51739f7cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab394A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A0E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit