210447f276571ca083f9ae9e5ae18b9eee2d99f216c6181ab720c5cfc16ed4eb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

695952f03787a9bf073fbb74e7a7ea85_JaffaCakes118.html
Size

85KB
MD5

695952f03787a9bf073fbb74e7a7ea85
SHA1

f6337e91c25e9d559189a2dea0ad7a071f2b5607
SHA256

210447f276571ca083f9ae9e5ae18b9eee2d99f216c6181ab720c5cfc16ed4eb
SHA512

c4289b12f4a4dac25f059e28fc08ae82b80547ab843f38db90b794f557d7852a883ff46b89db3ce6c001b086099fbc8bab59d01d7c6e8dfc143fec7d056fb25f
SSDEEP

768:rfWIlkDgOriWNcaSoagG0kkTQ/A9pZTN7cOxPEjEaNRrPYHGNFwN9tkGZipB29rb:rfWA/CkkTQ/A3cOxlL9tkGZiab

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422590959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA3594E1-18A6-11EF-AE77-52E4DF8A7807} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2900 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2900 iexplore.exe
2900 iexplore.exe
1528 IEXPLORE.EXE
1528 IEXPLORE.EXE
1528 IEXPLORE.EXE
1528 IEXPLORE.EXE

pid	process
2900	iexplore.exe

pid	process
2900	iexplore.exe
2900	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2900 wrote to memory of 1528	2900	iexplore.exe	IEXPLORE.EXE
PID 2900 wrote to memory of 1528	2900	iexplore.exe	IEXPLORE.EXE
PID 2900 wrote to memory of 1528	2900	iexplore.exe	IEXPLORE.EXE
PID 2900 wrote to memory of 1528	2900	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\695952f03787a9bf073fbb74e7a7ea85_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d174f30996b2bddfedcf5adf84be2393

SHA1
6e1ec1c0a9dcf056c30f4527fc0ee010f99c2cdb

SHA256
b01155cdfab8a08e19bf86ece4d0c31d2b7e013db41ea1fc2b19f09d4365ba55

SHA512
fa91a4b0378bfc54bb9c3f55a1fcb69235cd247f821cc5249ab1922bc9666ed8585767fa7725d66f219036594d840617ec6aa0ccada1d4949e9e74a155650436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f0c94d7e1149369b7b86caa95526ae6

SHA1
9f3eb6adf55965d41fa7b0c4f8ede179701ffd5b

SHA256
4f13c51bb60632a8e9459fd6e3f45db8ddb5ed493f181b7fc9884acc3e1a4335

SHA512
83aa66ed21d78ad2c033823278d581f3d372def7598982b9abffec05a044bf75f82bae31b64a3b6de8e1a4ca904713f5aec97e12826c5185f1b65c0417c1cab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188dda7776e3297cd43488534e65ef04

SHA1
efa4bbdf05ee41fe2f676a2f0d556089832f51e9

SHA256
6ecaeb66acc57e756dc929242caf0576d1985d8a61d358817ca5bb25b0f95793

SHA512
41d1f1c76c2f10f84b8dd7487235626c155aa7254bb88eff7d6ef929538d43462bbba1abd8fef2c3c03400c8b4cd112af62fb275b9472ab71460b7f2e611feda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7badfae2658d5ab536c0fad10188467a

SHA1
7d74821d3b77279c2053fe740bdddfbbfb2af206

SHA256
d198c9a041d1ba9ce6149c36c8667f7fe07d7f8cc49422c0a21a148457375ff4

SHA512
d88a642d59512e2495966610a128e1c7c689e30eb96b0dbccac13e49ffc7f4ebce00ce958fa8bb4cf4ffe2b68d844bb6bf94ee321110018e779208c1c544ee0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32968ae105fd27e64a59551dd5c09fc2

SHA1
c486182e06ec3204dc80f2b17e1911db34dde070

SHA256
35c4722cbe93bb367b7644f49b097af6398230a4492ff5c25bdbbcc5a336a846

SHA512
aea6ea68ec1c8addd2519655e37664203ba53a382b5b33053d4cd24ca886428c64e1f2d8eb190574b8c33161862d9fc403f50f728ac88109c4d3867212cbb3fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ec54edac71137d821d06beae62356b3

SHA1
828ffbbc2e7abcd26d6049fe393f60b3912892a1

SHA256
ea65b484ca573a6b1988ed8fa5171f9ced9714ae37d5a14848b1fbd9c32cfcbe

SHA512
74c3b001858abfa6285894cd00b31b363aeb2ba0c9871b10de1fdd10074aed7c72e1a70c0b2af45ec09349079b00582fda412c4eff133203cb4cd4f5f82a280f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37cdcc0a4c99654728fa4d2268961275

SHA1
b8332595384727c445cc167ac32308390df2eda4

SHA256
6bd7e973851c4dc774fa252b3e34a37c6079fe89d8e51919564447e7acb81db3

SHA512
3b5ba944103eedc5291fbc6199b774c5d471de397cf49787877965084e760ffb2da24ffe3eb9cf11d574f83abf42cca3a026be357406d1b602131683e93fe8c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97c14277deec6a5bc31f01d10ee5f21b

SHA1
2d1d6cc27381178d3404acc798fca7a33415a6a7

SHA256
27c3ce9e5e105e6d10de42f2ebc327fa8aa111987ceb0c30f693f6b6e99720f2

SHA512
25ac850c5a5e4c7c98c8fdea37690db49f536d5525f8ae2ebd6dc2666e365f05041ec5511f3d33cf81f8cff68409b0e6c62a259ed2c20e4ff81a7c79cb462376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a89b45f4ad34a30406e657235ee851b

SHA1
1d3d5caf1d6cbbfdde4acece97089cfab1ab176a

SHA256
d0c81624bd6654ba75c00fabc8461a4c181f20a84f7a7018012e81739bcecd4f

SHA512
855b7d590dee91dfe3fd801d83d2b8777df76e257abdd003b30420ec05d0fcbb56401d28daf2333f73d1f18ec4176f384157c273f187a0acb872b9189fe6bce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0898e53e0e5a02e2bb7029a54e2c56e3

SHA1
ad54a65baf4bec8fa9c89298513d355bfd8e1851

SHA256
d0a5d34a6d3d3b656ed02c1be4451fead75d44f9520c683cdfcc21c79bb314ba

SHA512
03a7ddc8b9036e0360614a13c9aeedf644cf0603e30595f5671b28f257e8199a24b27ba0d5f1823a30eff65ed596ebf288b1a06ef06e0b3aecacdda03ddd7337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4068d98628266d30be6c7061bc2d91b7

SHA1
143302d92ca013115d7bdc9b01edfcf524fc656e

SHA256
b550c4f5086537146320d2b0fbdd3baa74fe3546af229bf2aa2436134cdadc62

SHA512
656d9273c3ba5b079b46cb7e70f040402fb3ddf7fa5e58d0866d7d439ff436de7420d88e57238cc33549ba3b19b9796b55d830122502774fb1018121609e6c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80ae97cab9136bbd5623b582e5b92795

SHA1
853316f7a415ce7a912c4fbcc45bf9073e766039

SHA256
c350474081c9eb04d08515558fea174818231dc79d276dc18b2eebd51f91e951

SHA512
6d516340bdf188f471f3a1f9c556ec2aca9ac90e6627f040681da9e784a8c8be4df2a9518c6aa59b6cff9a966fe4b487fce96ca068fba307af5d0b0d555d6b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f44a87fae49038d3ab1f1c6727a82fd6

SHA1
74e54436f9cdf1c3eacb1e4c889beda73c54bba5

SHA256
c06ad0975ac8d6a1d27de4dbfe63e81a99f9ba22668c195d287628af7ab0957b

SHA512
423a1b29a28e7cf9ba6db92c54b1c48737d224b9267d8b479cb0fdcaec520c5dff54ad4c95e1c38ed0512fe181c0c3953af4a5db0ec42b639370ab2077c3d1a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
da57791b9151e34795bdb6691d570f2e

SHA1
fd25d756d6da0335feedba1bad11b99bf411bb77

SHA256
40fca0f655cbac2fbd062b343fa5f48e23c5422737856f6ec8e4b05ce0325845

SHA512
1cbc71f696db6806bfac15177ad6e48bff7fa09925bdf3b17cd53d4b30c4a28603f27f6f72e7a2528ec1a88b96613fa467b40b077b9323d1d2cd2f8f473ca13b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2030.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2081.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit