cfaf6f7d3542fae625da93bf06e1656e35ad3ed76a091baa4b6466bbe955365b

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61e8489c69fb3bc2aca780324ae3c985_JaffaCakes118.html
Size

142KB
MD5

61e8489c69fb3bc2aca780324ae3c985
SHA1

761c1f85e187b4d72b943587dd97779974ea939f
SHA256

cfaf6f7d3542fae625da93bf06e1656e35ad3ed76a091baa4b6466bbe955365b
SHA512

c7eb03b4323fd9840b03f55a9cb97c6bea0c7fb39a9bc5fa92b51bfe0640776e6034d5887de4428bbeab6b24dec974ea58ce87c63b4acffaa7194d91d86c7139
SSDEEP

3072:S1K9UKoa/x7dyfkMY+BES09JXAnyrZalI+YQ:SeUU/x7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C6ABF21-1723-11EF-A1FB-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422424507"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2744	iexplore.exe
2744	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2944	2744	iexplore.exe	28
PID 2744 wrote to memory of 2944	2744	iexplore.exe	28
PID 2744 wrote to memory of 2944	2744	iexplore.exe	28
PID 2744 wrote to memory of 2944	2744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61e8489c69fb3bc2aca780324ae3c985_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3af2747e28e5a7978c8bd3790e52c3c8

SHA1
8b265cfd2bfeb6292bfe63b2606a413c6a861772

SHA256
3f548dccffadf6bd5cd4d3f5645e6f51668848de64ab2868f106b58c467bf6b8

SHA512
80d66cd71b7dc43f8573dc121b48fe8ffee9d1d39cedc2fa6eed9071176e1aac648b6e208c62d9d941ec4c76dc2774bbbcbbf87365b9bdd8f92ed429da81de89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28cd0b2685dbee291cf28c3e2e82106c

SHA1
e6ebd772c91d6096eed3fb0cb0c57920f3e7bed0

SHA256
134a5b2f38f3cba55221f70858c3c6e935b9f9cbfa286b63c01dfb825ed75427

SHA512
afecf114c683f0ceb4edc5a78f7824976512cb7559f6b253c4b0a8825f6e147cd5b595ac5b55b4aef7500992000bc20dcfa78819d08cbcf9f751c204ec008e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
796482609eb85d970c85f7619f1ecfca

SHA1
c680a33dc238a30582da08f1eef51d401e6aa393

SHA256
cf9d8ac493a2af75cec4e0d4620ac3e15fe3833f1c25a62a8ea5e497d75a45f6

SHA512
85345d61b14c077aa5456eb92a2b2612722056218f73c886700a2e9abcc26f25b18739d469e1c522d1ae9f4da4d5fb898e04dff46b334dcfb405ead967383afa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
709b579e23966ed403db0fe52068e0b1

SHA1
07b800f65b553392819b467bd80fcbbba5561a72

SHA256
cf24adb49c84385df9869a98c7d9ea50ace79779440fc9360cb5bd7d27b13de5

SHA512
4efe69c787cd39ef1f9ddf3b2c15573421bd8b3f3f4a81158b57efc9d11fb59dd7ff8eac577898a60d36cc0de740675514e08f99ff9c4838c011fa3e82d36d03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f60854414010d3febb77bc7b173a2749

SHA1
0350098a3c9c5dd6a624a069408984b260c803d9

SHA256
ad03551acafb1edb4f9b34834450a92715423a169905fe5d236946db45064a59

SHA512
07ac4ab3195d3c0007087c3dba53e3bd4b85067a370473a067c6937343abf5acd7b9a03089e373c661032dfda4feb57aa6ed7b01c05d0a937ff62c6c0901b5dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
319e9ae58f4bb80eed431a5c78950891

SHA1
3161603dd28504488e6710be802b5aa8e0d17654

SHA256
89fe4b027b5490f57529c8408fdf2a830b39e0e50e8251b582ac355232466e1e

SHA512
84b7d2ca5baf3971b9b454a95d77a104153df9ea0fea14c2af8796197cc5444933d1ba27ccefcebeaec2b02b7226edfc536d2a955dcf6898b43676eb4b9bff35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fd7aa3e2e59feecd2b528261e4f5bcf

SHA1
e6e9f9c0a6ac5070bbb878f0067816efbf1bed1e

SHA256
c218eb822ecffd0cfb383ebd9877ba95d6e83a8e7e1ca804ec8f27efd8b7aba0

SHA512
b440431cc2265cabf70b5f3c0e1611810a13b68c3ddf365bac882d3fef6d5b4e7d3300a9a4204aae8c333868bf05053f96b8b32b4e2c1578417e265873add019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ab6f671998f1fbe6b91594399f2a728

SHA1
6ee65d9c2a6777eccbf29a0b378bc6c16d5560a0

SHA256
da9c62a03d19847ef6be04108df1e83bb2f5fefeb5cb4dbd27d5e3e3f8b721ab

SHA512
55717573c88232c8d276696d6d5358aa1ccf9ca4e697459c46072394d45945266af8f7cc990b6a47dcc0e3bfeae4fb167b07687d325174d4c1e9b3ecf89814ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d47f6bfc8b0324a0d99f2b6132aa86ab

SHA1
5f58eb8c4f343aafd89c6460154aa5b699cd8cae

SHA256
32dd8531fd6520b0a4cb678301df10ecdf5b39fe3f0200a0ef00c94855dcf4bb

SHA512
55d61b5f4582d1064ec5ead4acc2ebee72acd49056e9425592beda3b4f2173c7934a649cc51c0f5bf2b9881134aedbec0367fd9fdf2b85ea7449387ae5667de4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78e47e9988e7241d28ac5d05392bf4f8

SHA1
f1639fd6fcbbce57be7901de86cbfb196f2e6033

SHA256
d49e2bf2221255bdc7c4169527ec6da8352b9a2769a923bb5ad30ea624adf5e8

SHA512
3b952c814898c9c5118b034bd949b33f6737c4c202f2c01a125753a8962975cee3b91b0feeeb7f505ca5c6def670bc766b7d3251c59a94dc2a0d1daa84fb4baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cc66912cb58592388d4798ebdff5a7b

SHA1
42acde34073c149ad342dd3c063871e4967c66e6

SHA256
a99885f8be99b041cfa0f4e8c8f3256d7156ea320920eda9d5e70b2d0a97ec10

SHA512
49d8b4facbe5f9d24640d8153e27b52436bef0aaf783eede96a5924dda8c8b305fa5f3dd671f9712af81227a5396fc34ae03a2747f50e0fb8967ff88cb932125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ba48ee3a65e5415cb35130ea0a54379

SHA1
11d669295bcdc0f5215e6f7f32a96f7774c959b1

SHA256
2e370ac03ef2e21c3e7770d83fa482b2f5be6481a68d7aa0df604c3ea4725145

SHA512
f4771059c6cbc8b67ef8b3ce6c8527bd4389289f2907df60f2ebb259948290878a96046d571a20fcff818c6718997bf481cd10b11e6c927df80f2120a0ea0cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab782C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar794E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit