9b0b44806753620132e292ae50b066dd4b5a4b20dc652b55d27fe32e533e34f7

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66ea8733d291059eece34b73fb602b77_JaffaCakes118.html
Size

139KB
MD5

66ea8733d291059eece34b73fb602b77
SHA1

900d68d31f15911c10186d209f55f1530c48ae66
SHA256

9b0b44806753620132e292ae50b066dd4b5a4b20dc652b55d27fe32e533e34f7
SHA512

56fa31f20badb9836fb00e5f12c2617b16a8d9cf2348fe023f23ab7642523450db24f2565cccf534c1bfcd9f48d70cf291efa0d64602288a5f2bfc60aff2d63c
SSDEEP

3072:SeOk10gex7dyfkMY+BES09JXAnyrZalI+YQ:SLk1Ex7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D351581-1824-11EF-A9A6-4658C477BD5D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422534861"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2072	1728	iexplore.exe	28
PID 1728 wrote to memory of 2072	1728	iexplore.exe	28
PID 1728 wrote to memory of 2072	1728	iexplore.exe	28
PID 1728 wrote to memory of 2072	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66ea8733d291059eece34b73fb602b77_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6969085f5d4e6d166e292cadbe0b30a

SHA1
c911b0c6a98570c279b1e958288983134de6f059

SHA256
36af406d42dbad71c3ec044493547ccf67c81dfde9dc14d0f995ea76e10bdc02

SHA512
f65ee0dd42ed083ec890b92affd11ab368ee12cc63ee024b7eb7e41e81a52e52de2299a5603fd90e07dd2174ad1b845a2359f92e8e0920b9050938825abf8ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f12bde148e9fe6cc786c3f22a61d7688

SHA1
80574d1a746cbee4552d2f916be5073497a2678b

SHA256
5106d04c820394d8268d41964263456fe518bb7db672dfe8d8907156eb75e41a

SHA512
4c9f406140aab639d81e84b9a5d06a2024cefe94cfd4269a54fbcb149bb7c47d20d21bc272beb6b1374a6a9f98efd7fa83ba842cf5c6c07fdf930bd5a7185141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a84eaa3be40c7f66ad2a17ed5b40cd5f

SHA1
0e83cc198a923d588085b398e4f8d9831da640ca

SHA256
0f6db2b163e81e48f99ec306f7efdd563c637f1b27dc60bd15595852fcb1b741

SHA512
793309591f802ed3d856611629cc1b743902982781527aa7f2a7fb42a01c2a0ed6201d8ff7b2fd9b67d07a8e5a1d4f49b81def038de2a00013ae3868168bece8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8a1b8790fdbab4ddce63ed68e877691

SHA1
a5c1b29c7450445ba4462f861eb8a7c75d865867

SHA256
30f0d24fd7f9dbfbb91a6db19325b65c64520ca3c46dff27f9e710926258dea1

SHA512
27a18dcb9c33113b037dd104106c17f9b6f36d97424d682cae95ef9a4e405eeb3c4f909b708652ba1293afc3519c5697a91d83b85796220fe597acab0adbf94a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e9dabffb3de1f323ab8f88a0113f7b5

SHA1
65732f9f0da90b4c6df46c961c76d85205b368cc

SHA256
e1c8bfd568c32fcea6b49f6b6f28c77eae74b859c6fa8db05c9bb70b563175d0

SHA512
b43f820bc225edfc226fbcb0b78b7edf047ef3d1e0c53aacdef97ce6d51431cd6583f82bc7bd335b7397a567d1c056cd3e13c0980f43f40a97fc9976724ee49d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da389e7f4a9e18daafe2c9e962e7bcf6

SHA1
1a9d66862ea5f502252f766f1efe19d0a43d80c4

SHA256
d77c4347ae6e1ebd25da53ca269d136d0a79b357ba11495fc441d3283b602f66

SHA512
5734c7ec0587fdd9cb2dd0563eece936740b7280060004e15a15e0b956a1bc4cc5c7fdc6e91dbb33ea4f87c52b7e3a42797cb3739d3447d12c120443de824487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a942a4fc0cab0f7d812636e3bbd4f43

SHA1
9629c8e99408eae4cdb61c00666c53f47de88970

SHA256
7aee8b715fa6f8622e0938c976cb75a6c956c09de60798d419857dac3c00f01d

SHA512
4184711a1c11cbd0884cb93b7c92813d91d7ad05b3076716caf5716e1dfdfda0262d5849650e33c37f655680a8343b129cc53fa0ed45c8d6eaf10bed0e64a96d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d29fc8efa6e611fe3dc64325d1267c2

SHA1
c96f3a21f4848ef0a93be10e9357483d2188e702

SHA256
bd64543ce74076dbf857cf3b77285d813cdf5cae7d0563c8c8be9efeb124b0ae

SHA512
d390ac5e283b8a91676355b5d5512668d37ce334a91bc13bfa07c2c6a24134706ce26488abaeefb8f4e48163e216c8f5be8a2993a02862ae87c624bc30d2ce86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1423fcdf300653d76ae9806c09cfe32

SHA1
6c71461ba660085803cc7e8afcfe1b798cf04add

SHA256
d6fdefe389b48167950d47c8270c15707f7dd46a584651f76605a29c4c88094a

SHA512
56058a69da0fc0e12f18b5e1f12501343f30b7d86a0c8effc594e472819044f9c74d9292ca56277b1eec3fa52f19f7c147efdd879dc6ed28e85d815c8cf2d639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75eaadd908ee0e4e88560f26d0902e0b

SHA1
6aed9646d83e2e8c26f3c38fa48dd0450dd0662f

SHA256
e867b75ba247781306dbcb99c53fdf238bb48c0e0ddc123ddaabab3805866444

SHA512
d931fbd274f67f333b0d81eedbc6090fc8d922025d65fb399950ffc36d9a1253ed9cf1f0bed324e5dd813628e8cfea4cd68df3c3d84ff900bf52c15221f3a5ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83bfe68e4239a8664aab80da1ab01009

SHA1
1fc70ffbb36acc54605292d2c1ecd2b562c11694

SHA256
2f5dfb93daf530f8e833941a4ac71b4aac1830d0cce75b7cf3ec4723fcb7f1d9

SHA512
bd0557a712e0d64d87a3486fc7da6881b17cc33f74ae7393d86113cf4351b62126e630661153d278648f02cf70d17fc4a2011418268c17d86eef428e995fec3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
745172abb6bb0f1af601d1e1b9a326b7

SHA1
cbc50a867b9211ca895992164656cc8ab67c591e

SHA256
61eec6d23286ac61e52e17a464e0018f48ce342f18ccc6d7cfd0553d2622068b

SHA512
6a0ac377b71fdc25b0a46ec292c0b340f250d7a15dc254c7d8a9f9b74795538176833d2e777a1ca38f5fe2bfc4a91c073725c4f9061e6bb324b81b69913774ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d2f2118f648cbb756d9be3d60138f9d

SHA1
1ad6637bb741efeccd5d0a352095911181972dd8

SHA256
032b0debf608af88f18a4f7c29b32ad000162218c44e1769407e392346de454e

SHA512
ff43a5b558650e53ef25dea5c4b953dbbbb9b45e0af4c319489f0396aa969d96cda43c6446b636aacfb64b0c18a4edc0b2e4bc8db416066d3d554fa587d449c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a4eb4ad5b2fef9f26024535d1773bec

SHA1
bc21673dc2e1c54adc6487ca80fe336ff7f1fc5e

SHA256
e4451e73d0f8998675d119333277ff0151d70f6310e71503f38a9729ff0698cb

SHA512
435fc35864e6a890432a4d33babc0f0eac423758d3dadb52cdadddefff04c6dcf4e71f41d31f6e852469045b19560b5dd0a3b14e501f6a1f8f2d713fffdcda4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
613cc2fd3fa65a855d53270e9d6aa4cc

SHA1
7795009b247ab7b45df74aafbbcaf55fedfbaaaf

SHA256
cd804607d9252edbbdf8f32dc4ed3a32c0e5ebcb2a7c22d38b53793802b73a93

SHA512
100c0cecd57601c377b37629a3118a0accac6551d6bc7453aee4e9ba60cfa6679017d370cd2ab6425e61cf2702ee40a1af695d13f31ca517385200619e32a01c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d71d89ca9be9cbc8a879a945da6ddba7

SHA1
95371e5f16964e7b92b9595c9d9a306c2c034331

SHA256
3c7f93acd179751d6a9f106650f8352c0664d9dc9678ce85280580754d7d58c1

SHA512
70bba988304fcd4e054ff69dcd23103f71559f5b46bc485790a2a40944eca050d2b9d27bcec4aaf1f669a2e4c59b25d5e33a16575e3ce90e31d116fce79c3083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
017b4981ff93a08aa2b9ebd78ec6a464

SHA1
dde5b36a689a41d115ae230d373861e87b424fd1

SHA256
c07119e2b30248519400af1e0f9a1694f3a9a3048080b15c90fb9645e1da58cb

SHA512
cf5528968f265f68e0039224abdfd2b700b132fd0c303bc51c73e519588b667dc33e0a6f35ab1e25d4fb4b2a170904796dd8f574becb65de96d4e4a24686dc6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d5a40e6601c86f625b1bfabb9aceba3

SHA1
2675ea6807550c56147e97c12dd335b25b6fcd7f

SHA256
c852793c743e1c52a6b9bafacb952e4434d4d3b199ea84681437278fe47fe09b

SHA512
490995f3832e51458bbb7cf25da0297c6ed2fab33262222948ed8bfee5882210fae2ab51ae9cb8e49978df77a905d243d7cc2fe10fb3431f3913059a1bc6ef15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F17.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F77.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit