e486e3391d315e131221321db82976f586f57b7c3a944354ca686d48c65bd104

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a73863253e596472491a397fcc81427_JaffaCakes118.html
Size

59KB
MD5

6a73863253e596472491a397fcc81427
SHA1

215cdff0c35e244abb3616474eaacb9ab69f4c55
SHA256

e486e3391d315e131221321db82976f586f57b7c3a944354ca686d48c65bd104
SHA512

4a88436ba0a21962035479ebe73f3c2db9dbc9a85219a50bf3fe2a417c408f372624d486769916a3dd2560c486d118f2e2cd8a8c089dce94a1a4454a4e4bf66c
SSDEEP

1536:Ue9jF0IR4mDjIloy4+C/LVdUJIMNr5OQq:UQjF0IR4mDbLVqI/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422617503"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C65AFAA1-18E4-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2904	2224	iexplore.exe	28
PID 2224 wrote to memory of 2904	2224	iexplore.exe	28
PID 2224 wrote to memory of 2904	2224	iexplore.exe	28
PID 2224 wrote to memory of 2904	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a73863253e596472491a397fcc81427_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e4cacc9fa4adc8a6751aaf917c99e447

SHA1
d27c0b41d3fe6627c82ea3e6e762b1474f64ba51

SHA256
6ebb6b38a3cab01ca3d714f8df8b1d1dc0f159922fe9ae5e104dcd27c59eaf30

SHA512
fc104a463bf08270217f88841c8690dcb264abeebf8bd78dfda2dd2bd4fa85231dc7aede74e427483065ef3e6ef3f2c7e73c1c67dc274861da3421ea35927a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bf190d80f35febb18b4584838269ef2f

SHA1
61eefb6de14e1ae1b31e26651463335e134fc9d5

SHA256
23bd0218cd2d59887fbaacae7ab1d948d0c28b84ff889b9a4d592cf03166c1c3

SHA512
0c3b50b1c5eae68c0543f8a9f4188f4371ed9c90ea5413f9efe74e9ba40c2f7680c2ea3be0c345deba76b144f215b4bc26d36d50de0dd2df349176b92bcae7c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
2297d2e6f5cbf7b7bd435bb0f0ca0776

SHA1
d173459d68eccbcf65f573e3d7c6793e3cca6837

SHA256
c7bf7fbef94e5b276275727afe9e8b453fade5ab57b6ad2827500eba91327627

SHA512
f4e24b1a431105225ec75ca5930cef24ce5c1d97241be91c26c32eb9c2eec4e9e4ed05bceeaf955429f2886fcd50e5ca216a36abd5b3a31aa3b798db1ffa97ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a5cafbc628d77f75e5b0141ccf16f73

SHA1
46c63b1093aff9c369ca35e8e9eed14523570940

SHA256
a17aaddb410d7abced1625c62b464835a82e9626abec0733bde754e2828a4158

SHA512
31a803d6e56a41e5e5491a39c1bb3d418c841328e16b0be875a60039c6849953e84a321a2dabf7c5a44a466767765cbfb8f136ca880cdc560179ed7292244826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ac8b36c9a5c00ffa629ac38c24e119f

SHA1
4b97d75e371606f8983a464c47d8a6d9eac4e9b5

SHA256
aeb5bd27cac6b310391475a5aaf3571f4a82a4862e3f3e17ff511f3eecc70411

SHA512
e51a027a66af6f2f3fa2e2a4aa6dd1d8f07a10778bdbfa58c48ba71fdc05b09a3b7be4e3f5257a5e5d474b4a4c9053fd40d537789eaf36ef2db96a53174e6add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44bb50accc9f1d94b77d919cd6506ac3

SHA1
ccb83d2bc808f68131ed8cc9a4e309ea5900879e

SHA256
d142a29d66cc860ca942a160ff0ac52733da79a696d6e4b62cf7b13a087a980a

SHA512
51e25a99de09be2d42b0ff37129f7a03e40b3b375eb74f7d6d627cd49acd026696cd9c748a63feebbc6e294782b9ebc2f0a8b52290dbe8ec23267049597ad59c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9395112687a39665942d51a6ed9cf981

SHA1
6ce2c395b501647318eeda4b8597d527f30f5a72

SHA256
4cb0a377ff66b85425c7e87e4ac8420424514610e9ba696479f8a983a33d3b2e

SHA512
d706bfd4febcfe9e30bf7dcaa9e91a8038fd2ed89b96224db34fc116b943d6778538ba1454329cb2ad40b3ac029516e35de848225388b1437cbc8f130265598a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b1eb521687cb41b076932068ac17720

SHA1
0c99d5ba647ce7fb58619f7118173350805a0e70

SHA256
659eadcac79fb1212eaaba0bb52e65d86eb10643525fcd216e7ce2dfda95f16e

SHA512
7ef300faa395b4a296c26c903a23cb1507cd6c9ccdcf6a65a39889e7a5cab18038c612dd76491df6776e73454835d0e43530c94db250767be202cf82f91c533a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af94348c2017c05d79f7e2f36139ba09

SHA1
5722001421c479bcd764c7b2928d1b3cbb23317f

SHA256
5cf6e9dc5756d7a0dace34c06fd9d0d227fcd67b6ec2b2a4ab16adb17e737d2b

SHA512
74edefbb4c5206abdccfc72719fd5751691a0b3c06afa3d29b6bf9b8e2b4037f68a5cf7b890e935917e1a31c96404b388a52b23d5acf79eddd8e966deedbe021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
112213a802a233197f76efdd8c8261c7

SHA1
e149659962131ffe45917f3f84cc2021b7424b4e

SHA256
9c4ae07fb4174f6ba82a4b8a04bfacb140e230deb793750fdaf940323f569e68

SHA512
3fe8956569cd37ee829139022a3e978a52e23b6b491f0d9845430b3a020da2dc2811230e3e609e6f61a29d3578d949db5a70ea357bc8b1afc0886fb9e1d96a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87fe81ad92d6b1931ce055b733cf0148

SHA1
25e2c80b881ead8ea858efd13b5580187fb164c4

SHA256
9c51afd753b3969ef82d21f6403b343aabb6a35e671494fab89e4987d3e8f545

SHA512
93e067b1ad73060d76c8bb9f7d57763d810972e7fe5ef26cdd1801aad98485dda71d3f31bdf874b60ddc969faa3ca9cb47186e73f9b0cf204f2fe9cd67fee7cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f18329d6b900f3e9ba679d95cffd771

SHA1
acadfe5e5ecb3ce0691c4a8b619521c090adea31

SHA256
98d6eb8671ad4eb0661ceba540cbc7ee0a12c649d5be4fdf0e3ac5eb4a7df90a

SHA512
29dc36d55117e91fa8ffe9ed99907d43899f0903095d529f1669fd89ca053a008ce41ee273a754f5f84f13674d621712bbb173dc104b42ac470a074eb537a7d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4684becc2fa759efea7be156c4fca92f

SHA1
3d4aa4b36de24512493f3d39fc8aaa91003f11b1

SHA256
02112217fffb15d397fc114727591b9875f1e8ce43f105cc29edc7e6811081cc

SHA512
df952b91e0dce005c4ad951c1f8a33a1b1c172c49c58bac586d44a6b9b0a61a11475d5f0d3e40cb2eaad0c993e2d606d45c6a64a7f54dd258e369d1007617f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c761e829e3c97bc777f51ba6cfdd5fbb

SHA1
ff8a9e5f91c16ef85a52b192284ae53eaebdf0be

SHA256
be23f9e78d07febfc1b2e269ed4cb62f2d119cf0112a61c028339c6146b46083

SHA512
d37af3ce916974501e6ff99cee1f3642f4b455be57bf8ac6e951b1d5293b1581ec91c1f58be15ca0145c55c69655f6c002e5c785fce86cf86a3ac68aaac2b30d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef78edb9c01da73e253fba2b55d97cf4

SHA1
f8702dd377d280dfeaf859726c9fbcdbbc4267fb

SHA256
42acd412e1564769b3364772f0a64e3a316af9ced8939bd1fda871265da1ca92

SHA512
0db66d99bef282a804653362adc1b2bb0d17b1112f5100d8761751b6432f03b1aa720ee29a5aa2023e6bdd1945b93737f85bc379c44d6357c3811c661dc2050b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
f92832a93d84e07a79e4432efd257b84

SHA1
90fca07ea0f82f8fe75da9168ee0bf1af6531459

SHA256
4b20900b6a059e53eb934838dae71820827c595e5d4fe0f0ed409bd2cf05ad62

SHA512
075ec04e4f170f6d71cb0b58a4a8e33d17aa25ff044ff60ad562c4579fcf1d95583fd817956adc14134090a4f4bec8127879d81c2ee789b46bc94bf93a2de4aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5b9725e6f81859a6846b641ca8d16b3e

SHA1
72967f7c2509c4a051cb7c435c5a428bf64289cf

SHA256
18337215db02abbba1f295c559af83dfea494646612e4878fc63b0326e65c1f7

SHA512
3dce9a6807a1e3a37e54f73ed0118275859c6b0c77cd471e80085ac8bd67cc9ff9858636cd7c9966104aee34c077dab34c83bb9021948154fa576788845ac150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9ABB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C47.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9ACE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C5C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit