f0d13a5c67a6e52cd4fbe06b2291b22f6375d218a658cffe75849b2366846deb

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84fc0bdb263b8e8ec1db876dd2824ab9_JaffaCakes118.html
Size

96KB
MD5

84fc0bdb263b8e8ec1db876dd2824ab9
SHA1

f604792305745f08681ff04bc6e7c4b52862189b
SHA256

f0d13a5c67a6e52cd4fbe06b2291b22f6375d218a658cffe75849b2366846deb
SHA512

7bf748c4c90c8b95e8da9c6caa0896ea75be0e19c57961d239d2ec83270db79d8c1d98de1721de580ab279425dd537000e6aa5c04d045e47fb7c3dbd7c629216
SSDEEP

3072:S8kEtdoY6FOcwWsahPy2HjAHJk1KNZN8vi:qFOcwChLApk1KNZN/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28E0C281-1EAE-11EF-ACCC-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423253752"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2492	1736	iexplore.exe	28
PID 1736 wrote to memory of 2492	1736	iexplore.exe	28
PID 1736 wrote to memory of 2492	1736	iexplore.exe	28
PID 1736 wrote to memory of 2492	1736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84fc0bdb263b8e8ec1db876dd2824ab9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fcaa3d304630cbe1caf3f63c2b9af8c6

SHA1
8c5ab028ae99bbed94932ddb77e7a66e10570f74

SHA256
8edb2991d7d33e7ccd255491bb215f5a3ecec5c49abde8f9476794ccf53e26fb

SHA512
f6342a14d4adc42f19299892abf983855ab17645963fe795de9a30d91780430e17c8ce606b24a55baa063848e27b1e5d14a02d0efd6507c8b93c6c9707b2f7a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36eb809dd31daa81d498465fec62cb4e

SHA1
28e2077429813394e844418087836b771d896797

SHA256
f96d8fbf8943e0ddcd785cf3e0b9b9c29d417eecc2920f876db120f77dfaeed1

SHA512
f4ee1abb502c1ab90456beedef60cd031d5baffb5724ad1ae0ad65c9268b42772dd525004ca08d520ba9f98cc2f2ac586e653ec8e185cd0e2e9f47bee882aa04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32c6ce16b79b0dc53858aa59fc436ad8

SHA1
5b3c17638e1392d8b31ad9ff34b8995abe4dfdaa

SHA256
5f74186168ad7b367359f20aaa0c1557ba10f768a8b8f34b186fcc01f1673b14

SHA512
de481c61c77ad32cea957d10407cdfcea0f90378caf6b02f1efb06284c0c1fc10f131453050b8f3ebc800b30aba2d32d49d3598cfc21ea2856d44b90978d0775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d734b75400bf525ef6a1da3cb99095d5

SHA1
746149fba1a4f3146632733bfee888708ea9bd0b

SHA256
1086d9c6c0e84758520137b4f2e205dddcc872727be6e5bc2963d0fbc096e9f5

SHA512
3a2b376685092e7f9094cb6bfc19d6c819bdd9bf0795b41855f12754a4e6b2a84a3ee3d613a18680ef35a2f6da18ee13741f78f4612e9b9d1ac4191bd9f53e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
763427f80968812868bf91b2b9f02136

SHA1
779e1f4e2f2bc440be19f7f0e657d726dc76c59a

SHA256
64e87348e4604d20c4c9db7559e48349a8c309e0baab699cbe916d84384f6333

SHA512
c0b0c7580465a384feb938a13e4424c13547dfef79e6b8cef4bee2459943b64568ef33bf5d044113e621ff8f3b1110c009f908d9adadc12a53cadd6c2c72cfb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
849964bdee2d6e19bb6d642cc46c6a70

SHA1
caa67243932e8e0006f65ea50b56fbcf9133fafd

SHA256
68a75c5ff1c2c359d0469707bcf6408644763de4ede5b2119d5fc6c1e41cbe3b

SHA512
2bd9ad7204b7cb76c9605adad6d950ca33d6ec774994b8f3fabb16d88d6f33f29a5f92c8c3f2aa2d6945e8ff3f88d7338eca897493cf78107871d7c0f00ce969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77b8e7c3b513116f6d434d4832fbc444

SHA1
3d24ffbb6c041e144c139eb0d6659db8944d8dce

SHA256
010fa4f9a5535db9dd1ab2479c0c5edd18af41536c4796797b787e12ab78ddb2

SHA512
9b2a35712a9b56b288588ba753c613232d465ecc48c540a36123c062513008ab0e93491a76b16b7e20077f314a0a5b7d78709d77ca0e5ebc5bbf7727149f8403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
add53b4de975121529a3cf1b48a25740

SHA1
2c3a8c11297fc43ca963ec55ffdc4380cc852657

SHA256
b5a6d686336f56d0ca9de0255e0436e9791a68cc848c0e2ff822b259a6cb0db4

SHA512
38565334400dfc6edb655ab8d81f17d15f72429f160f83d2e669bcd15a19fa7e548868df15e471590c1aad0abdf81287ea3ae925b3b33bd12176caa3617389d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f884e6751e6d5f1fbc54194e8f02dcb6

SHA1
b6eef5a9edda917d677dce8b167dcca4c3376f98

SHA256
3891df1257ea26f4365aa623be03a8742747abc1323821a88f20fa3bae0822e3

SHA512
3b111dfe090bd790cbb3d53f9c992ff638ae1cc99eab75b95db18372e59f48e386902c05ce4ac8ed621d6baccbded74ea5f9e4979b7fa9e9368708478b8d2098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f3dccf52f3458dd530f504e36ba31b2

SHA1
7d2c5e4cbf30f0eb7f40a26d31467415a4013630

SHA256
26136e6baa2f14f28051fad01cd0669607d780e13fb59137b96f662d2b121a10

SHA512
bbc0aafb5f5695888e512049a343a8633e28be15422c57cd20ae5295443c622f7915e9520288cb74428708c3f99ec9eb1c13df721bc16b65fd4a2c82725789b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b578cf80ac0bb9fd834cbe3e8ec0b22e

SHA1
8ded8f7d7847dd5e8b29da5fc5519c23363c4330

SHA256
117057743e7c655d76bbd64d23ef77e61d0fe50434cf43541c81cd4cab65fbfc

SHA512
add60d6714695dde537c9f2f49c514925fc02f62c72eafcea173605765653f59570821870d621dffc90cea5cf2c83bb7a55f10e5adcfddbf8b6c917c94b4f0b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
74b391816529de438d2eb844d2cbe248

SHA1
e773dc6a8a0d0880de16e256907c0b4e87951e36

SHA256
144e0d8e6a145880c856ab26f87ec551f5ce586139655843626bcede1c3084c9

SHA512
d95ffcd41e2bc97596c1e5020b6db57847316d2b0ae61cd0f842ef392f3cf1b6fe3ab0f637469b29606dd9b3e65b6f64cbc50569a9b60575c58c94d36d9880af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab693E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6951.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C05.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit