42c4c744344ee7d15ce94810a45184524d5c65cd58831337e45844b23a411d2f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cc7bac879fc272bd9e122c43d8331f1_JaffaCakes118.html
Size

23KB
MD5

6cc7bac879fc272bd9e122c43d8331f1
SHA1

1aec9d58274b58482b797dc0d3bfdbff67202651
SHA256

42c4c744344ee7d15ce94810a45184524d5c65cd58831337e45844b23a411d2f
SHA512

7f607989e4dc22f70ae15b23969cc1f87f06485ad24f91492470a444ac644c79da08b6988961014a4f36544fb4e3f6ed5226227c4af4f9c65015be2e68053574
SSDEEP

192:uwTEb5nqWnQjxn5Q/NnQieYNnenQOkEntb/nQTbnJnQbGLnLnQtmqMB4qnYnQ7tc:3Q/CGLiH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422672330"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F0DF381-1964-11EF-9479-523091137F1B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2384	2032	iexplore.exe	28
PID 2032 wrote to memory of 2384	2032	iexplore.exe	28
PID 2032 wrote to memory of 2384	2032	iexplore.exe	28
PID 2032 wrote to memory of 2384	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6cc7bac879fc272bd9e122c43d8331f1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b868f898684882acfd249d19ca0c2daf

SHA1
da38948ec16a5f0bc0da5db3a10b3af6024f7259

SHA256
1e71bf45691d48e8b92a02f383208610eff3dccceb6b40b1db2f972028b06f3c

SHA512
1c46185e1fe80abef39bb2297d21240e55accd249cf1249530a86297253753f5086c521c816822095ce0bc15822595489ff3113cb5ffc7ae5b9f69695bab243b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3eb454b1796e77d63c5d947b6bb088ab

SHA1
94551e696665fb37aef94f5f45abad6d858e6932

SHA256
21f313cf02e659f47a7436818992cc6dcceb6b71db147b029ca467ff56f16e0a

SHA512
0b93e40d9dd5cba27561070b55f298f9f47d3ea8b8641b53f2bdef4c482063633ff8d04f1c557b6b1b14ed606a1306e259e506cf687c1ae02f6676c1214047af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1abee892ccdbdbfd24e6e6f75e3f4aaf

SHA1
70407ba7b3fdba6581d6b4ddee382a2f9011639f

SHA256
b3d2e7de310ec42cdeb628822f66e7b40bc1517cfae80aa85f8de2677cd12f92

SHA512
b3bc1a3b3a1efd0224bb3950e0e2aeac949904aacec2e707f7fb2efc026aac5f2d29266e6da83a155d602a1ef531712395da04d162c16243ce8f3a03fed4cd3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab03de1e65862f1353a0c9e0badf1a1f

SHA1
c58800e31cdb2fd5aa5a4e64070712f89384fc8a

SHA256
01bded6ae70a3df06f8e43ccebde881d73ff316ce132320f57809a458ca91b85

SHA512
70e16444c42fcd96ac0c7e6aaec5a8bc2d3c897047a91885be88ec2cd5f970dc6c7904e6288ecccbc9fa08765ce3074207a2c850d749f481e29fab9ef1b8f823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce4720f646c54ec7f2d4250fe659a83d

SHA1
c2aa19839171413b74bdbeacaa45eebd51f9f082

SHA256
98a5dd104f612955e72089209dcd62855d0b8f6ebc8fcbf2bd89c0aa5a0c64dc

SHA512
537d0b504158c79ebad069f5cd3876c3b76137bc56a1d4fa14699d17ab9fa34dbac6ba826e5d1dcb0a16af9f8f25110f288904b2c9fc2b258396c0517f86c360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03be2a77672d4656d1189cfa3aec2bcd

SHA1
65ed4d3e632dc139b97ad037a9f6837ea512437c

SHA256
ab71ec1d8abff738085d2ff7fe614fdbc1288fb4bbe2be5871b5a38988364ebf

SHA512
7d94636b93ca717172967ba038f2da573e60466af73d2179965f9f9a767a5ddd6fd88782c680b9c0984e58bcfa9fa5c8c1c9cd89c7003d6a7ed02d713ebcb176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
437696fe6622e57e4ceea12a95e4cf72

SHA1
7340d5bc8a76fd2f506a4778cb0dc22494e8d653

SHA256
bf20157f09e1fa0afbbc699a5e1fed5339a62dfc0bd99bb7767d58b62ae9e3d9

SHA512
c1fbf23f9474fc9224480df5e5d606f84fd037c42831b652e9421ac8ed07e85b1519d3d7390ce5d245f351dc87e5477ed640d5daccadde20e596cb6f5894bbca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c11b7ff81c0e7451ec55943700c5c666

SHA1
ae4284b5e32f464b37e47cf764a02b9abdfcc820

SHA256
ac55217ffbf6d05b66234ced5b6e3dde2f59d2b16244142c02a8f2be9fb1f398

SHA512
04fe2c3b7a7004fb860e3ec8a99b467c6b4534531309fde60f6bb7059fed753bd5228eac9baa81461568773af2258b41c8057cf909ecce7de66c5b63c8852b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c0d1693d1cd38506c2bff008d07309

SHA1
1d005ea6502d1922a7aa0d18022b97c05c998f93

SHA256
2e100320bdc25afa6ed4c50dee2e6cea6aa4926f8130d2bc24b769703a8ed08a

SHA512
7b9e57da6b39f76c6765a669644d1f197bfeed2782a9fdcdcaf292d700cf21d2dd65febc72ab94a9f05ae69131789f1f839c9d9f9ddcd6e68ba24c708a1cea41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bafd32a88a64504d917bdaee5240440c

SHA1
8bdae1d95b4a651d5c9e34a9d32f3bef79c498b1

SHA256
2496858beaa7926e99d494f28d5ce9df634f0890973a83934f1a234122557de9

SHA512
76e0ef44d63a8d0d19817ea63aa40fdee4f18ad5468e4e1a42783a3f993ab06021258264de1a9c1f4504e3b3f00555dcb492bd9078edb89406f48385562ee422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9486971a5844f2498bd2d5e967e67fc9

SHA1
ae31ae4fb76f43038402f2c429b2a872a3e10574

SHA256
035354bfe69eeecb0d1a490074609e79a962fb4488545282195e331f0fda1ddf

SHA512
08b5787952e5be93a2deb9cdbe5c5c3b9d28ea8146e8a397664d046777e960999b832b39c099582f9e33cd067acdff584210d0ac6014aad12bb6ae192866b70e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1422.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit