6ca096e146c5fcb545e8172ab74aa796d6a5b35657bdfed8509c7ec35c848c74

Analysis

max time kernel
134s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

826d677d91009b7abdd9279f4928c7f6_JaffaCakes118.html
Size

213KB
MD5

826d677d91009b7abdd9279f4928c7f6
SHA1

63849e170f3440449c8d7c46583b6c4c6e24621c
SHA256

6ca096e146c5fcb545e8172ab74aa796d6a5b35657bdfed8509c7ec35c848c74
SHA512

f47f8a0965cbf4f42f864e90a98576516da11a67162c1064d9fb8c7e3863028207bbc40d6a564e029a77feab95656037739faaec7288bc127586469007e01dd9
SSDEEP

3072:SbiyffkTEB0gRyfkMY+BES09JXAnyrZalI+YQ:SbdqEdUsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423189044"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{800C0841-1E17-11EF-B459-56A82BE80DF6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2184	2320	iexplore.exe	28
PID 2320 wrote to memory of 2184	2320	iexplore.exe	28
PID 2320 wrote to memory of 2184	2320	iexplore.exe	28
PID 2320 wrote to memory of 2184	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\826d677d91009b7abdd9279f4928c7f6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6a41baca8327ed810ceaabdb483d037c

SHA1
5d40502ccbcd60cfd5c09f97733534fc91918fe4

SHA256
d87d7e12210ae5ed51bb12031ca014fa083f9f9bacd95aa1cc1eecf9dd422934

SHA512
5f21ed17e7a2df3b102d9c91c23c2bd0e3c4c2634c3bf0166f7445d61b2836f350ce23d34a0ef12efb0a1f0dda1cbd3d778e24921d3013ee7e24eba21e16c78b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a352ad9b0dc5dabdd716dffbbce8abf6

SHA1
565573458da206501a72371ff350336ce47da177

SHA256
eb9f213fb72c771485626e0f8167721c386a02f0310923d17e8087a04e7d30f9

SHA512
6f56504b040d3b5e71291aacab7943d1f2ba04b0c55857bc9d1fe8dc87310d8640b3b4071d3836904a67224e4445f4f28d2bcf9db372cad685c3b3299234b9e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14663fa467e3726216f5e418574b7ee4

SHA1
3a88ee8beffed48116fba3e8fbf560bb2fe7d5f2

SHA256
db11db4a9b31d65b87f5e628818ed3344d80283fc3ab2772f8c0435895251788

SHA512
4826b49645e0352f7b1a9141c51cb80e9629f1e2860173c8935063482dc6ca74083e5dcbd46d6a24614721424b9ab013eb1572f6c998a78694ba0745319c3d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c569bcf7cdb98a6fac9205fa22e269f7

SHA1
83228cb3d26641a468c04ceb6959cb86d680bc19

SHA256
f9f350836ee2eb390acf47fe684009318f3ed210ced0b9fe996faccc3be79a5a

SHA512
c226cac4004735a53ca4cff56765026157774a8f4eb7118f07b76547c271749d66f860cd153b77b456346762949403b3ef5a21076e42bf38c3237de3a5f32673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c20937a10535634f640cb3ae58baf39b

SHA1
de731bb1ec69bd92821e46be384bc69a8052582e

SHA256
8c60047d99e024e2d04acb5c122063971394768c5ccd83890ae820ca306bb062

SHA512
58e09e8bec99f43d11d5476334edfd2133985189f98086960f51ab8d7c7744712b55b13cbab2ec62d2ce4b572c6c41ea28a3d8c8fef3bd4ab5d04dc175e03acd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3fc3b00af5ef778a5cd38991404babf

SHA1
9a4e5affe32e2d739baf83a5476df3934e047aaf

SHA256
ff033e64dc6b18122104c175c047e4f92dfd1e3d73fc716ee1ac5c5fc65459cb

SHA512
b93604f0766c7b3f7c20e601722db8ed3d4ed137da7335e2e456b63ecca4efcc892091c7b8665e02b8ea33c2f974e8218b5e25b61c996223cc9e736b9057cee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8111e27465dc0bb865897df5e26e0b62

SHA1
6e43404e05f3c83c6859e795422567ba7452f551

SHA256
4f50c917165b7ebe2df4557cc8b709e005a0c2ce6e1a6598ccb10addf1cdbab7

SHA512
d9f6bba6c5aadbc6dbc5984f868c27b036218a01433b5aa519a9da1e6c706341af4a139109becc7cfa5734ea057780731cc6d838248d438482710be13ed094b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f0887d037fbda01b364ae5275e4f4d1

SHA1
aef7228bf5ee5b7977fe58f1b5f04877318a12db

SHA256
0af29d2ad1ebccba1e1bbba1f14a9685fa86b8fdddaf31d148f4958c8aa6571e

SHA512
9fca49104c2181609ab77f51a2915b4d9683980d4f7d584d9bc04765478085938062db70c86ef3549cdb544eac99c4f90791553c466e04dbd2f655aa132ac915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e60deca098345e12cf83f8509928f4e9

SHA1
ccf5769574a0832a1bd8a13ae1d26885370aec73

SHA256
f5451bcc313d9b8263e62dd1ce06bebdfb6e9aedc8910e8d13c778bdef4db306

SHA512
bc0ca562f7e64be6581dff2f7ea743524495e12fc681a586f30b0d1f1f059ba620fc6654b80e0f73761b714ff5215aec58c778a629eb7be81a5a64baa80ff6ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f131699d0b702b1345950f0eb7e9d0fb

SHA1
84ab483e3f4eed4ab322f5d2b170c0fdf72a1a57

SHA256
3c8accd3eeffc4602e567dfe2448cbe96cd2acc1a79611ee197a6e551cbb43b3

SHA512
2ca36424f22ea6e46e96280d2a6864d104b0d0f991e9c1d79d7f2fd51a5be373d5c6d593d3c6e85e6ee03896be7ad74a2b25227792ed61edb38dbc33edbea42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6ddcd10337d7d22109da7fb337387cc

SHA1
f97a16e003f68651e35776f5bb29817a1c9c7b22

SHA256
421bfa144c18613e9cb52c7b0e4dec07509497332b589f428416df2b4fd7c827

SHA512
3362e37a7f5c1bd70197db2b181e07918cb60c27f27e056d0ef2cb6021eebf50bec698814a0356b7f7e6dbf2fdb3b664a29e2712429b7312f33c9f7c45d0526f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2edb8c04f06170d2d5adffaa932478e4

SHA1
b974d08248bf292b9df34443377d994d776efdb2

SHA256
3a9f2710a41917278c9ad7b6a468714f1f2b1e631158be05149b4fc0bdd20a64

SHA512
ca5db7f1ea28ba556d20b275d07895502e7f0516c26a4fbf8c6b0d4cbab6e0840c131fd9ba4c6d37daa928ef6bac8ce93640558cf9b21612af4f8a7da669fc00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18A4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit