cccc2c68023359efecc73b106fe123eb031d3582e21e3f1b09c4df7d9eac562d

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60d343d7d583143b35b81c819cf3ccdb_JaffaCakes118.html
Size

1KB
MD5

60d343d7d583143b35b81c819cf3ccdb
SHA1

a90a2a5bf16efd2cb60a6c6ff2bf188855446c9c
SHA256

cccc2c68023359efecc73b106fe123eb031d3582e21e3f1b09c4df7d9eac562d
SHA512

b6b4ee95d6111663444fb6dfbd46a6a081ed6241fd81928c584047764ad97184fd16e7ebd9726486d0d4b45cddc6b6d70ab61d2c623750ce88494ac9cc1caa5f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58FCF951-16E0-11EF-8B04-EAF6CDD7B231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000029c109cfff3a32a5003a997fcea30469663f15697f49606ca10de70f70dcd0ec000000000e80000000020000200000008e18dde5d5da8ee679c108af68630a636a5a965df637c9a75334504eb3e62ae4200000002d59b3276b0394cf0fe984763863f0404c3ab1e5e70295590862929a773467d540000000a90619e785762e0c59de28dea0491537acb93d193aa528d7c3ac7bd84794a33efef2c14ab4b0df60e47e8c510f7e0bb9c298c20cbdf270b10b31c67e69d579b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20af892dedaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422395696"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000056a5d5aa30957b78774ac0363a11f300e55d105ed555ec74305b7ff4b476cfaf000000000e80000000020000200000009cb184f4bef49d77b89535d1ad3619d592c822322740bafc88e7f9fba1978076900000000637dfca3b58277da24b6ee800fe1993b9eccbb0a005d5543e53073599ac5de36e1c644e44d2812bcdbc13f6b9d76e42863573630961e15e5033e13bbdea7f8c3619649bf1fa0fe1bd47fdbcd1529989805b2070adc672cf245b842aeb5ec12655412620ca727e936ad5603d55a1197b53b354e0a77005503821f48f22b419af5cf2ee746a5b76794d2ab66f3e04ef7240000000723616f8b45132afa3c586fc61968a215939555700c31e53e3fc2610603c0e3b904fdbb0944d2c41934a476883b871296ad7d8dea740fa5d7e6c2284ac89e1f5	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2560	2368	iexplore.exe	28
PID 2368 wrote to memory of 2560	2368	iexplore.exe	28
PID 2368 wrote to memory of 2560	2368	iexplore.exe	28
PID 2368 wrote to memory of 2560	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60d343d7d583143b35b81c819cf3ccdb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3c56362418089a703284419a7e299c2

SHA1
94118145f1cb87d6015f5c510bbb1dd1816f1952

SHA256
c81f2a75bcba42036f309f059a1f9cc49293154794cb0f5c4129e612e577a317

SHA512
6a7b0bfd9195da16d1583f09cad902b8d60b7af86b2732ceb98fd79ad7c8f78390593df60d895a4ab608307d841e2012b501360c93ab96516fe668bfae1da048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e676bb9f2dba47784056ef01bfbfff3

SHA1
a11fc1c2c4db7d528de1f98a947f7e2534040471

SHA256
ad208615be981c93a5f50e211c4d68dc4f49cca427676fdff8e7b55eb819a2b1

SHA512
bd3f90a66b39badbf710156583f48002b4dfade480fa84d25c8fde7029ce352774c8ff1c1304c1807249f44b2d49709c4801b2d74811aee31aa28e245f3abe72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
419b7870a10ea205c705103ca6cb5474

SHA1
4a26f75bcf5ceb9a56b721e28a045ea0fcc3f29f

SHA256
8350b97563a331a7315df2aca3e173596df2ec44ca9a7fb4f962b5c5e725f560

SHA512
526e9364548ea5b2ced8ce8af3460dc12c5e0b8c49ebb3ad22b82e5a64de3595ec49cb47f8e80a5d636250af865ebd389f4a067ba62f1806ec3f1980108b3c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c48ebcc760f270576db775cc559e2378

SHA1
3fe29f08344b87e7c6d23a8665d537ba079ca5ff

SHA256
2c45c04ca7e8a578c57d736c4e0230664c96486910c04d33d79d099ada05677b

SHA512
3a29b53382659a97f2c88808438bb89831ff11f1c54ce65cd336776543c5caa04011859ea1e0842d077e7c2a328d46f4887a31973c978a6bdc97ff00e35943a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89c144b66e0f40449d2517cd38995301

SHA1
5b52444b1bdedbc7b9ed949aba9615cb007ace36

SHA256
5225be654605f59f9745abe0ce74488f1be61082988ace3923f782b4326b8e66

SHA512
e696b6572f1c78d31807fadb0d8eb5ed57848e49a7e7cc082bd9555f1ff7b363094f8f692d45fcb7d2ec15f42a2b5d58c8022c93adcc95cc1ea434cce7fed6af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b772842aef31f85b5ce1b0abeb158afa

SHA1
0e3dfa31acfe527c2de1c1d988d405100a2ab1b3

SHA256
c9012f0ef2aac934acfe2f741a61a145c739300a269013ac4298229d66cfe54a

SHA512
6bc85d19a724363959dacfde0b7fdbcc4823e26aa5a284d6966d10b0e91ffd89240d53b67993f58584370223f21320c688d2490c77195f127b41c839baf40dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02ddc30a876a957d4bea0af382a5e1e1

SHA1
0f65cc6431b73027252471f250904c89f9669f4b

SHA256
ec86c9f91cc5bf6f1ca3a7dea7c13fa9d95718484374c637f91d02234e2d0ac2

SHA512
5ec74067fd6198aaec01ab17acbf0369b8bf091c7c60747f74f033c4fad3e621bd59006ede35f3e6e4e5a5691dad30d238d13aff3d13c62dee66ed6c306ac1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1bf3b61d4433acbfe95bebd931c3261

SHA1
2175d3d699544815efa85165b35288ecf44766eb

SHA256
e0e9eb5f4f7983dd3954022e18612cf5b7f43726d8a7dedf82df23099b236fbc

SHA512
7e90edf853ca6062462a33a36546453e94b3e7a3b20d99ebdf1cd4ae5a8903236079608905fa3d34f771d23541916a10bf4d5b652b174f25af4620f8e26ec03d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3373735fd236ac4ae28b209c2a6fc53

SHA1
a56259d38ce11bc17c08db18bda4100285394dbd

SHA256
01c47c782a76f6e10af5302fa53e24733106abd565cfd3a405edb80c3fe05b47

SHA512
5a99c37ea076ea9154ede9ecae6c0bfb85fd41749007c189e036e9d9e0403227db0b4a03795920c2cacc1674c2e1d102bd047f831154874e620d8b99cbecd8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f59078afa378ba4062645e1322e74be4

SHA1
290f50affbb85470fd11e654ca91c599f2af931d

SHA256
7c0d76530ae077e6b70c21d94d4c8c5c54bdd1cc62ef28fff5f3c693e3f8a381

SHA512
9cb92c638c74ab9e089dd10d4dbf7d5358db608e55a0c1ac676ed33523256fcdea8bc02f54e29800f9829716b3029e44c48b51b9aeb5c9ddfb2542e71ee051d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aae2498d1ffc6e516d0af7329b1f3dd

SHA1
14cd88e12d17f5da9cc0fcd663b0e72f53dba7b0

SHA256
4f54fa92338ca71139882f871624710e22452188543256a56baacd2f4a9a44d2

SHA512
c37c56eb968e8a45958b5c9746403fb00bee966e444bb6aa67646c2d9ba204cf1410b4b92a75d532f4b2cc8f89d20a1f5ffb7ea62b2aa08583cdec196e98882c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42bd76b67df270d80db9141201234a32

SHA1
81d22b4c9828e9840925c95d1855ef4f2612bfdf

SHA256
49fcae2a71f3983f58551127934d0ab268aa5e514c473cbdf0eb0fd608890327

SHA512
592ec88b6172f42c52e1519cc1148a8ca2ff4bf4bca20c50ff3249d46fd7ec3e23bb49af4fbda48706a92833ff4daf39d3d0af384bd41ef5d3b49f3336f9812f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21e0f3cc00b64d18f97902216ed00730

SHA1
0941b170f87b357add40c0120814c0019c537376

SHA256
07803aa4598d6e693511043765fecb3533b805418cfe97715b18d36f99ebb381

SHA512
7201b4e71fa0f28c9e1db06f01796b47e5816fd3365ba3fed1815086aceeeda46aec902153933240e53990ed67420076b6fa4cc1032e7a0633b4e00d3d9ee057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40410de857a272f10a76e6d4e8e9d5e1

SHA1
9516d8a745b2330f75ab337e0819c48ac836704f

SHA256
16aded25285db6992a8edc14046e969e07a7ba978261bd299c79e1e66146fe72

SHA512
88bcf93b78269955e709181dd9f5ab860475e108819c7efc614d81b243c7a590a39e3910d51f4fd6d3b6f85ab5ffa3bb61c770afcb014ffbfe2b903f47fa5b2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e2ceff88d25d3a2215083257712768

SHA1
3fa7873d11f1d0d026240e640e5416fd86b6e033

SHA256
ceab0464fe18e21f869f8967335dc261b656c920ebee82d458db577d399ad521

SHA512
81dd91916a91c320cc12cceb17ea94502ced26d1a1191e5a3dbea97b15946ad772c6f7ff5897f2b6e9c1c997557648385b93ce968b646490e0aaa710a7b6ef4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cba259368cd4f220efbb9a769d2f503

SHA1
c5337065a603c4ba6191f875ac78a743d64e38ad

SHA256
ea394bd4f26b4b92fc81d8215d9be1a76d44b5e6191d5c60c58be6a8c422aaf7

SHA512
c45a7da665e4cb2eda1c1cd2c64dd317155764d3c218d793a71b26640976a8827e0dc43fd47c83286bb550d302e4b6ab7453f00ea89470e3442ebbff0cc9573e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3667c16ae6801235da09f9099384116f

SHA1
d2fba7f8f72fbde4967a989fd9291e8b4e5cf016

SHA256
c1f7299103b811f0f9870d6b5a0f6c63129e6c9e674f8be4fb4f81354cf86cda

SHA512
52ea736b1749fa74fd945c4a517d256cb35ae0d55fe5b51b82b24f8e5090c93ceaa4a2bae0913c622de62cfb24a335a01f74bf607709e888e6a159e40ad84613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
816ccf8ac14f5002e68eeceb029ae355

SHA1
4ed0d9147f9e382cf3925f05e05214fbf62ef80a

SHA256
0168ddd05cb465533117cbde2edae4b3bdb4b23ea6ddc53bcdb312d9eb7d679c

SHA512
766533a2c6986b227b6879ec24896e0bebdf5e9ee74f4d613eb125079cc377fea1645bfd7f7b76a50ec63590a307e4b37757d108d1a74b861d2a5474ca6da708

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab480A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar487B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit