f279d61dbc60a3dd2e6bb61460c31dc647dd3d93fdcac31cf574febb6c86ca48

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85af239caeb18776e2a2b7b864e091b5_JaffaCakes118.html
Size

24KB
MD5

85af239caeb18776e2a2b7b864e091b5
SHA1

57452c097670aa1c971d3c0e59eb7a4f3c91937c
SHA256

f279d61dbc60a3dd2e6bb61460c31dc647dd3d93fdcac31cf574febb6c86ca48
SHA512

32a4f6b6a8b85c679bd31eb67bd3e47587d8b5f513ee17842575b07a6049225f7bb34ded2bfadd2de9cf10f839e8dacebaa692fd23c4fc4791a84ba1823bd182
SSDEEP

384:1P3q01AuaUXmZe+MmnAq9B8PA1NnY5PRxzbk:1PaZwmGmn79B8P3nBo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423282944"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{216AA1D1-1EF2-11EF-910D-CE7E212FECBD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2376	2220	iexplore.exe	28
PID 2220 wrote to memory of 2376	2220	iexplore.exe	28
PID 2220 wrote to memory of 2376	2220	iexplore.exe	28
PID 2220 wrote to memory of 2376	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85af239caeb18776e2a2b7b864e091b5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5f7b3d39d69aa269c5b5b30d8d6fc32b

SHA1
e1eba09862c5543c67f185e999a2ef94d139aaee

SHA256
0d488dc6f46f46e3ced5842b488c50b881f50fbebb1f0e33478705107c6b3d38

SHA512
35ca26504439b89947e1928fd0867303a9577bf71bcbac2e9c95c2eee5831ffed8af7a18725943a460dc1d7fb89c6c43c2af08221649d01cdade054e8937f2af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
589430c3b19490dcf8fcc0c348483e0e

SHA1
41ff5e0d2401b06645d26dd7197de4d3ad37c499

SHA256
f1459c86ae591f4c1ad8685e76aac48650158c64a3a3e89ac95cf8bc58561845

SHA512
7b59a44f28eba658039a351d4de0dc69b6d2c3b043316e410fc8502390c5a0846b153db2c720f42b8a986942834d4937f31884a4c6542bc3132082631498ed03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0eab5167fff950eb7fb2d67a53c4952e

SHA1
73096b866bfb42b993ec2ca832effb46ff918606

SHA256
c03d7a14046fa543ffec191810aad8e8e166501abc80044505d12a31c4d3dc4c

SHA512
07cfc5f22d40c10e321c575fe19d708fd4d14cb60aa0501a44aa72bf40f23745f105aa9632d6a57de38ae536ee81137111682787b86975e78e7d2b79ed4670bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1441dfa9480e17feb6bd3c5c56ff2908

SHA1
09a2037ca90b2a5295acca96866356d09d6c399c

SHA256
6e5028a11e4cf87adc1dcf3243be0e17ab9d61ee03505695e1973871ae672772

SHA512
cd781b4808c964038f137fda24d425274cd63ec89d774f4726f0fa8a086cd549643c21468d4a409063c0e016e4b29735f53baffe428cab8efecb2e5975899efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2d181ebf619d139ea50d32bb17af50

SHA1
e9841fde2f4ef40515b7d58c8c1d51def4b7fcd8

SHA256
c1912085d447a9dc1bf4d9e44a582f03ff34bea6e9b5be46ca373583d937bce4

SHA512
1e94d98f4c1426356e1b810c7c7f84314aba682670538eecc91c977e6f75a8685c21ba1074dc1919b217390e6dcd8e7a5aa63eed4b85087502dbc015851285c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c8f89ebbf3404953adb25d110ab0a92

SHA1
546e0607b3263f01c3b7cf6b005263058f6e5009

SHA256
f6ecab494dfda4cde5b98519e45011e5dd0066dabce33524765c33408ccd8a0a

SHA512
3fdc999f14ea383719b630e433b173a632d583160e37d2a3ced25c1973d43bbacb6f13e9607546c07f9c94ea31930b01402310f2ffa53b65b05d7b3d3453283e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
866ea4be2958952a6015ff95c48c4a6a

SHA1
c722323224ba7f5191268d8a29df466f0a8694f0

SHA256
c647ff55436d1aa3fd373decbacd936129200ea2bb4d7fd519f2cf9871d2fefb

SHA512
51e11be95b9bd884d56baab6e8e2bbae8d51a34d9a92d350ef1385492fe5d6ddab23c9ee4f4c8e127e3758603cbe57f1c26a8ab89887bf1ef710e3d328fe9bf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62f6cc617af82831f5889601add0b934

SHA1
36c6bf7b1ac35b4315f1284ab13f459a7a2d3ffb

SHA256
0cf5336ce23974057ab96d5c015161ee4f14cdced71feeeddfaec5c8c7b5da42

SHA512
7782d5ae72d8788b3acfe96919b3f484ef3bf215bde8604472eb35140e8b6e79c1b2f0cb3a8c5b149468e76f8b338c4b1d8b7d827e4ace4d1567953153c18283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93de0496790b32e1935adb4a45129764

SHA1
b81f61f3320263952862bc91456723c99b3bbf70

SHA256
8494123fadde0eadbb37c8758b242ba5507f63113bf84309dc641332a3f56573

SHA512
dbdcf9107c532b275466e8affe25fe24b034b42302cafa143828044bf1cf1362d01d62537e66c5d74376d4c522a95a63ba8a15b4b2fc473b782a1d57c1142b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abb66c6faa0f5fee5eba21dc3670a9f3

SHA1
5ca6634f945df88d8aed42487b5ce26db2210fca

SHA256
366b0b6645c4f17720eb38b2af37ac2e69f84f334a5e69368c6d613edf6e85d1

SHA512
9b3a66a3b4aa11fc3c39a428e226886aec42b69baeac7627f46fe9c0a54df82510469125006f3648bc5bacb39da2bb9554af130f86e123e11eec1e410d7269f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a5e3d4060499f3d413f6cb8ed8b1622

SHA1
e97a3159ac1e3038feffba00e861a40f825280fb

SHA256
ecf3138f01c7662d20e0a04da0d7e501a968024e93fe6b65d81ad1ef2ab17cfb

SHA512
6deb1415dbdd1302ca30b8a86708ec7c0e6da5edc3db780e6139ac12471788d649ed538691f9cb16e1628144b0635ecf098b77ef38f4020c609e467a1569db82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bcbf81059e5525c5ba0d98502766bb1

SHA1
906e9fff9af2d83c722466987a2a8cc87167f764

SHA256
e5c5622ed9b08f38cebb9d919dee697dfc922db1919a1c4440cee9b3c7bcc224

SHA512
44fcca06c86a597b8f1a2c67d5eea8561f422ad8e327b481074f556df9c68e7f79230a9d815373a65da5d0a3d0db5e8120d915495731668059e36859612ecae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bd201c658166fddc0156ef13e12f565a

SHA1
8a747e67995437d0a2f2989df72ad8bd4ab4cb4f

SHA256
a07ce2cb9d9f47a52a37259b79463022ad3b21cba5286eec30a7884b5cb41313

SHA512
a46a46ec6354cef1b8182d56eaa39a9dd30a066cb66e236888463a44f0ee6a78d0eb0a2e26854d9124c99abad6b50521f7b3ef00013478ce385cb173567395f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11AD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1347.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit