6c0abdd1514cd780db5032a386c6e4f6005689ca1015bf5ab2480948c577fbb0

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78068913526f067673048d63860c40d4_JaffaCakes118.html
Size

213KB
MD5

78068913526f067673048d63860c40d4
SHA1

de86e3ad1caee31f75a25052bf51990de1ad4996
SHA256

6c0abdd1514cd780db5032a386c6e4f6005689ca1015bf5ab2480948c577fbb0
SHA512

66e85d0aca167b9a5fbc72dbc669cadabcb6a8e80db6c6a26cbb461f576268cad9a91b292ef3d7bc91013070aeb7aa989472a3b1be656a08f17ec64fbfec05a9
SSDEEP

3072:SpeqSSK1nIDyfkMY+BES09JXAnyrZalI+YQ:SpTPmsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422949008"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C7AA261-1BE8-11EF-B02E-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2704	3016	iexplore.exe	28
PID 3016 wrote to memory of 2704	3016	iexplore.exe	28
PID 3016 wrote to memory of 2704	3016	iexplore.exe	28
PID 3016 wrote to memory of 2704	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78068913526f067673048d63860c40d4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fcb1e0caff1768ecf3a1bca9754b8a5

SHA1
5bf3906518c4acc0ff8373f6449c80cb25df65a3

SHA256
508649ac5b17ea7436b94643e7edac40c2bf6efd7db83141319245ec1d3cfc3d

SHA512
aeb9bceb5806451da463e5223e1da2f755dbc2be01393c9fdd1eb7ceb256f13a0be6a41485218a759ca8212f8eae373a41e08a9b9d2b27d970de354059056023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aec98afde66a4d9c9adcbf26a64ab45d

SHA1
b8bbb5ba0a71afe8702b5f785f85a4c03f022a48

SHA256
c73618f7a77949009fa23cb15f376942e4ba7348c659f2477e579d371ffeca6f

SHA512
4428fb9b2685517c9d20a1ca605260d23f4f0b750bed505309643953df552dad4d2ab5f2e8c13e8109ad91adc3cf772aec11c4dbb9fc3f9a8731fba8a99044d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12a552b1ed2ebb4873355fe32cab2ad4

SHA1
f8541bed40987de4d081179a9a0a10a49fe1b57d

SHA256
f5426da8697b5b18ee2e61f8de0fcace131a858302f1212f570c04ef4158bed4

SHA512
28c115ff07d88e11c17c4a08996534160b72faceb2e12f440cdcbcb0521a503f6bcc524bdc661b38593c854bc2e09f41d9c6ce62e3227ab554e4d8c1f334e1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27c73b165725f0c0c6087afdc9d93dac

SHA1
86556c867fab389068d41b2ea3b60c3e2c43f937

SHA256
8352c5d52756dee1623d286f8c37eb34a66c7ce4c0a36b7b9fd6f381b090d5a8

SHA512
ef849611b29e78ec73ccb1b19514958e6a62c90711fd31dc176cf58023274cd2218fceee08cc04eccd6a75dd22a3a7ce1485393b646165612e74f229be2c9d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cab1fff8ddc41d1e232fc64ffe3828b9

SHA1
60b50f952ccad78e147babb7c67ea2d22fb4aa09

SHA256
69ab572756c982391d657ad8db750b514c03994046528a60f74226a349ee12a8

SHA512
ddc62c9c0b7fc021416ce18cb3b4785c86ec87e1d9fe163909791cfde4a80aca550ace48a321398236c607e37cbf5eae15f1982b5a6ad826c393f2cef0f6accf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10665b77290a5bacc0ae1105bfc28d80

SHA1
3813b1fcd7c248e0c481d85b9fa6b51eeed130cd

SHA256
ca42843f40695584fb18330f4143eee403f46e57285bb125e8edf10345b9644a

SHA512
4eef2ff2e4de5b80e36805b1b7138ea3eb87e09a0388b391a981d358d06e00744878e9219922b5f2652d59527af9b40081e5f1f0632c49f66094225ce250fd6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f66a8f9293801cd5bb6d7dc9a88dc70

SHA1
7bf6302adc169e5d15bb7c4999f55efdff91cd55

SHA256
25ce992a0d936fb34014ddf6dc7e8224269c588ed62d494fe14b5915710f20b7

SHA512
0de98507552027e90ad7da3fcf552c6d54512dc47f788e59825b49f547a848e5910c7264fcb5c4f937c2906a3d8799fd6c8389440491558b8d9123ae79debf2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f22643f4893d8e4975b48c343f5d43d5

SHA1
443ab5b409325348df973b430769dc9f54f61d02

SHA256
632ac4d44b98a8964d424572b065d0e0afd094770768bfddd0c91c938216b43a

SHA512
4216d9ecdebefdb8e609af8e2e616df15f5f40f714a22f6cb8ee758370bb2f25d39e61f7a91772c4ba7b6e9346cfe3f4887c7ef83dac3c28fdcc9f062db964d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c689b07260a1d2e2635795574df9a3ac

SHA1
37f9acd44cd6988a9e8027b5a7fe64bb368c478a

SHA256
65203d6edf8db04ce6336508d9529e87e838f5013332314448774ff80cec92ea

SHA512
2437ae94ddd0b36cb8630cef8c65d877e73242a52e00f30bb31dd87906d2884456b632c591f11e8434ad64f40ed2d271443f2c6a0698179057be43166a6a6000

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea5cf0cb294923d88e251d43bfe8cf58

SHA1
d9c1033fe343802dfb295f4a19355f75b2cbd9fe

SHA256
69780e102581e18733c25b7533d3f87ea2811b8bfede3b01aad9913e4c925ab2

SHA512
7fc275aed1aa3f079eb31ef7e0f2740d83f12f1a0d81f6956d1631622e6cd1e1d77231a13539fb33dfe96a4277bbda78db05773a0bfcb47ef37dc53a13a33303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
097ec73c94a36a9165245056fb504d1b

SHA1
40bde3486b8b3317ae34308e6b68a13fbdd44dd6

SHA256
b9a8188903531d05b3ecdc12dc69027589568b27e3b073e0f2cb3e15f9df73c3

SHA512
58bbaed0cb7e96ee5c215da8872ec3c430e87737ebce3d7eac98123a616e4a287a3e2cdf80de30108b4bcdbb74465d4e96ee6a483150acbd893c2823d652c46e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
255e71d7643a114e35fbede5b08fa43c

SHA1
45b89232e7429fc797cfcffa63865926eb9db36c

SHA256
1f5810338f45a903fa67c33d75c2465d790842d2949520c0b9c92c468b6bd7f8

SHA512
c80b46d3ffd745e3252ea508927ec086c51f3ec1b5e05a221d7eda9a584231fa6d5d30e936adad87a5652738a4046a4d10a3f4152e955b404f59223c83d0f7b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa45a9a127b39c84dfd0560d95d2d1cb

SHA1
d74c1f72ac62b2bd36fa840a05e3803f81160edd

SHA256
961e702aba345a19d30783e9d232a33b9b232292bd06d063315b398e7969e3b5

SHA512
277e6241688aecc857b9313f1b054c6b8ef6a1f34319369057e2ab281e5fc8b69e598e0a166f178ae023bab3902fcaee9fa50358065152a7944c7bca7e650cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c6611150895b47a25c98e26fbe24026

SHA1
cbec23df32789dff420ed9eef4ed38dd79787544

SHA256
bd529352d4e0deb3e35997c91063f1f283e6d472afb88c25985c89f1a4272bfb

SHA512
d708f7a1a7d7d414687ee80d1a8b76f8680436fa956b6b298d0aceca6c334a5c36777428c5ba1ff88081462774c6948712b3bb7ce590172de81566f5196b09dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c2e138af129f4be5ec0a763541cca69

SHA1
189913f5cc9a979e9c34eae87b87569ff51ab885

SHA256
f0a3dd81dfc26ef1898d05a0bb735a19fbcbef5be8a3902d099ff7836f0d7cdc

SHA512
d9712e6ebb972c0a4e3649b60411fd3d46757888c5d6980c78920488018766d538ffd3be3ee2e92be4f46a9937afb38114de106e9b35b3a0c99e2e12e889b371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5537c2fb64612c17b93b5067120cc58e

SHA1
9ff91f3dd9eb152198e42bc98ba8c39235eddd0b

SHA256
cb5c88beb9aa4b7aac28a12bfa120e083430423038783c0514d5ba6bffdfff98

SHA512
bf684b6d7ce7e5185ffbebe2b81c730fc1b54e612e05a99867204a5b0ead0d10557c84a2e91968568c7666fccb1aa366b04e53cb7de7dbeeb2ecbc7cdfb8bd13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a95d2689353b20bf76ca66b9bf51a0c

SHA1
3c657f24e5dc12272ccd322d6bcd41965ede8017

SHA256
49e06fbb64fc92ddb7b3453a096b9c9febfb3125578f43a104e6da72853239a6

SHA512
3b370ef12cdb71ecc262c6a21aa783b47ffd771c41fe3e13d3f4a92e8f9fe621d98c93c4b1d81fe8fe17b8e2e2ce18bc7192f330e061ce4fc8b031b6e7170b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc4aaa3701afe4c2283faf3de410e08

SHA1
86b6d468e6d582e8cd65003a97e9d1f97554f43a

SHA256
e43416789c87626b988d3189349742ad4764d4524e3a7d73aef65a456ec9ea69

SHA512
015abcae10fdb4556ef451c69079be29e54b1987cd22cf9e587a25162c599fd19c68ab3ecd6e3e4c84fadb4a02a7581156bcaedf755c6c9e146d572cfde76073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
577e94458dc100a507600b8bb61d6bc9

SHA1
af28c693129dbce006dbb4f7f03dcabfdf3e8bbe

SHA256
5207b078b8334dbdc510b85f84e74b57935761513ca1006bec530610075d1a77

SHA512
425a688fd14cf4eecd29c7c28c85750efa42491a1306beff80526d46b7ae8684fc7ac9a891a561980826b5618da95796a3f84d16e3ef43294ee93476577c4904

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFFA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27F0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit