f28d44f53f588904c45318e85afb38f938a4d235c9de301886a7b1947dbc64dc

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c54a18f7c541f5486c243a72b7f9d23_JaffaCakes118.html
Size

24KB
MD5

6c54a18f7c541f5486c243a72b7f9d23
SHA1

c1a89bc8d3d82ce9327e6bc717cabbcf8f992fd7
SHA256

f28d44f53f588904c45318e85afb38f938a4d235c9de301886a7b1947dbc64dc
SHA512

06192edf8c7031ecd1342edcfd5e7c6a9db4f993e0ebe7eafaba4cc0eb8b834b8d36e05eb787dc78bdc6bf0a1dc5e0ce8ceff77924ca23354fbaaab87a7a33ff
SSDEEP

192:uqN7HRb5nW7unQjxn5Q/fnQieZNn0nQOkEntFYnQTbn75nQeCJVevo7NtIFo+Nz2:nIQ/vygcnnBT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{189DE2C1-194C-11EF-B7D6-72515687562C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422661877"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2332	iexplore.exe
2332	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2840	2332	iexplore.exe	28
PID 2332 wrote to memory of 2840	2332	iexplore.exe	28
PID 2332 wrote to memory of 2840	2332	iexplore.exe	28
PID 2332 wrote to memory of 2840	2332	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c54a18f7c541f5486c243a72b7f9d23_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bc5a847a961c9f04256e32ffce34d1b4

SHA1
a94b9b7e5b8faf929b240732b048108f8d6d9367

SHA256
de5b3dc3376b84c3c30ab887e0e4181853fb83fa8f24d1c06c83bfeee0681509

SHA512
40dac88788d01ac29174b8df82380e1586bdb572dba2f3af8056d10dbc8fa741d6ac55892550d73907dc5f06bafac3f4bfd8321ba77b99ec126fc4f30ec3e2aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4331979b31e407cc9ae55881e622de05

SHA1
067314226906c4dd6b86ec37ce7c627000398054

SHA256
03f5538c7ccec7a16c4b354c5814e13adb277158a45e4116f665d0c4f7851661

SHA512
9c6630606fa2756ef2a4e7aeddf8d4381046cd5d706d8f0b62c2dfe3cfa62af400d0aafa5c85659ba7d27cf66f25f3c0efa402df127ce0ce414dd87a77dde7ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b77d07d146fe590aca80a08a24e8c4ce

SHA1
6500d52e8e30aca7b3454192f2e3a3f8695f5d35

SHA256
8c8b29ca8775bd471ad55773960c026429f4075779daa1babed8cad976a7bb84

SHA512
b7895cdd8e6c0a7325c4f2e1e7c0ccc641fc2d10a79355005f2fddf00b2f1594c72f6df5fd33592c54462ac9c5b29387507f23d8723ff315c3111b6e35598ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1843f6f39e3d6ba9f9d213e5a51aaa93

SHA1
bd20895506f2e58d13476d9bf7674c32c41cbc6b

SHA256
7a5134931646804d0095d2462c0ce7a061e4e47a9f31396e55cd8450e8378b16

SHA512
6c4c7549c937e38ece3fa85f5dba73ac8177eb02cc86cf6d47c4f5c7da27f0870b65dc7ae8c5e10b59cab11d160801c90770acd679222bc287b48c1e9e211fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7722758c0ba365336dcd04636bfa2efc

SHA1
c4eb4e422f9c7043b9fccc6995d5f0c477c891f8

SHA256
36389c6c0205dbc11c6910c16859eaeefd056f3c021e2adf4bc3c0357aaade7a

SHA512
036fc78b6365fa8727920980f53fa54587ccb03b81e615235dec445ac3378242d8bb71b81490038851e3f6ff577eeca85f7cc75a9faf53d165aaee385e41c5bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8373a37d03416a4de29da781676237b

SHA1
e099933c70829341e681e4431ce8bb44e2de96bc

SHA256
f64c332fa5233c47c135303f538f8bc07f17b5cb367da52a8d6d10c95224f68d

SHA512
76cd2967585dd30c93645c8b39eebb6ee942fa59e89a6d8de6a8fe6dac56b2e477740d949d6b919dde857db44d3d9c02f6e0a30e418621a1b7046e8cc6d3485f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c9aa091912c41507e1e9ac46f8ca91d

SHA1
8a44d4736938ffb6900ee86cd8c25c0d57b5e399

SHA256
3ec19fa8c2be89b9a13c9ca81a2579310b05016b1b96d453ec9ff777c14ea751

SHA512
994ebb188814ffa26068d082eb01c4e65f1bdb704ff6ef7d2c363d4ff25a56a1b53b6a111f294d302597e692114a550e969053f1bbfc66885dfaf58dae563700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9531de77af9cea3c89f5f293085f41f8

SHA1
44fc44a5a1651ec9336f41fcdec22fb3510e50a9

SHA256
f92ffc8ad518cc06c11a8aca6b3633b76e2ea52a79bf4ef623de71553b7c407c

SHA512
e09f4c654ee183d699c727ddc6163fc3b4976c320a0dc1c5bf86617fa0b2958e753127ff15c0f80ff2ad376f8cba36f24d581ba404d7e45e0faeba3d64e26f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa6e6cdd5dfaade213f477c8d75710d

SHA1
b9898051d2063af02ce76fad17cd56037bdd9fb3

SHA256
3a20af483833463d1b0d704d88bb2455da4d8ee22e3fdd3d68ad8368b925411f

SHA512
7a121552db8136c6d5cb468d39a2416466f6524984966e4447e7517a61eef470f673b75f6df678f210154ea80e8184fdd0f7967c699676a61699114e2406840b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7243a56c7bde3b2e0a14f31e526da3dc

SHA1
0661e67994ae5f0fcc6533af6cb599b7ea05af61

SHA256
ba358d23a18d615d9916da5a0b1dc7de8cbc535e96e92ff03138b100d23cde02

SHA512
04aba40e919cc75744f4c75b8ea287aeddca1344737cd0c1424a1045458a6a938869eacc84f32de7505aa10a1baf378bfa7089e1118235cd7adcddff50c4f4be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
99ed88d2c3f092abf843e4c07b4f40fe

SHA1
5078905a54584e9635964f177ca0a49dcc5f775e

SHA256
58b49ed28b6a4a9e7fb2f0b767e5621873ce1d429482aaa9050a82ca1c8ee8a6

SHA512
87ccf4246b79e855cc0e9267553417e984fd4c88f9f0e6a368ac5c3e2feb14bec8c3646cae6879e9a7172148b9efe71b87bace39b75f1a875c872995ec69171c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar811.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit