6cf7310a4cc4bd0f18d161ceee471a5b3143fa90399ee7718b1436bf9771712b

Analysis

max time kernel
121s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ef65c8c5edacd54c074626d44e514d0_JaffaCakes118.html
Size

37KB
MD5

8ef65c8c5edacd54c074626d44e514d0
SHA1

f4331281c9527ce0c770120645c824703251aa61
SHA256

6cf7310a4cc4bd0f18d161ceee471a5b3143fa90399ee7718b1436bf9771712b
SHA512

e4ee8801e067a3694b5d99491b05cd9a942ce588f63c31a58d37295cd76cd90cd71a6fc0661843f47a01dc51cf6d1016bb556bde4d188efd2565debd33651a48
SSDEEP

768:xQ3rGzXkC/xGn9DO0vXE75HxPlGZLn9hkny0+wn9A:xQ3rk/xGn9DO0vXE75HxPlGJn9hkn1+T

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D3C8B81-210B-11EF-995F-5A791E92BC44} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423513711"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3036	2952	iexplore.exe	28
PID 2952 wrote to memory of 3036	2952	iexplore.exe	28
PID 2952 wrote to memory of 3036	2952	iexplore.exe	28
PID 2952 wrote to memory of 3036	2952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ef65c8c5edacd54c074626d44e514d0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
acef08ba08a35fb69f255a5a6fa865b0

SHA1
3194bbf630be668fe57cd4ab7879d93355ee021c

SHA256
0f0748e7c6e335bc96b7302df3859b9bbe5e7a2b57fc865a0195af4ea4545ca2

SHA512
7f4736a25dcab79861067f3615dba5929fce07a61edf679c5f6fc4ef990f704ad3047a2731da9ce29604cf8925020f24f00d8f470be2edd7bca01d1756a9517e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9cba1efe1a57f45b82b67392c5bc678

SHA1
fba59a2a3c9a698530b4a86d7f6f73615bbf847c

SHA256
9a0535c0d7b1f29f6ec4ca418f949a3866e0b3c94a86cb60c66a960e5995e84e

SHA512
2d8ca9881c5be5726f2ea2b09619333cff8a05bf6d92976fb73bca6f6a163a958777bee91b448014889201f0500422a8a6e507e461bc240e2efd3c5e7fdc7eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
130bf01dd7291a1b5565eafe3fad3fdf

SHA1
1022ba429a0037cf7544bb77ee181562e02b223f

SHA256
85221e04c5c665a49f802dc8d1ce7d543c95c239dd111e2f01c15f634aee52a3

SHA512
cd5e0d323640c388e5f083a43bab147cfa0875bd200846e718a122e453824725066214972aa46e0dac12c0df727e8ecb9404551d010bce4fe8bab891632b227a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32f275e8f4c49e7f7b4503251e1f9815

SHA1
02179c6008e3aad72a0098041c78aa4f69b1a7ba

SHA256
632401b331e568223b701fd91350b8549c7ff05c63e35e4a8ca574f245e7fc19

SHA512
e25142c42c8b96ee0fa8c4a0df8d7ae5ab4f1c8fc9a655f566f94964f16151c236cfac65211a08ed44729bfd12ba8a46b9100547049aacb9d02997e453a8b6a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f031b9445d45de168f4418501fd0e5d

SHA1
1bb94d08c215caf777491c175ffaaf4c5f8cb93b

SHA256
33625c042d7c499c4e4e10acdd2ff249b5873be8c706fd679d6d1fe7761ccc28

SHA512
fe2f4c96d93eb0e8ea3030ef51f30cbcb71df5b50b5d5e3f7a0992a86e8cc84cc4e4f3bc0d5dc27445e6186fc79ce2edb2e56f1ee72d23694c53e41aa9c04369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56ffe0e265c05ad1cc878c28bc653946

SHA1
7449af3a6f3a74fbfa568618e4402926c693ba20

SHA256
f68008cc269585e30ede5b79ff480cbfc395bedff6c33d0c7906dc95911c6d78

SHA512
13794dd6702b9f15eb7a25f6089ebcc8dc3ab700b6bd606ec08f9d89599c7c8e96ad79d1d2c01fb17eaed58e6e29cb336cb8ada6c14ad33cced7b3baa43348bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
189cd250a3b9e3de071e903684e22e96

SHA1
eb7f967108ef7a90a47642b12e0ccc2fe24442d3

SHA256
31e5d8dc9a75c84dfd571dbf2f4fb1ec11828c2bcf173b3745a9a0dae92fbfcd

SHA512
712923024a68a8c3e15332ba16cad70057d65d163271c1d230cc9c6a0062bf3e8e2b95dd53647b19955f219cbaf0f13c1c202a2de78ca2bf39dc2e7fe017a3d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f00246c8c175fa54a6d13c882fcbb885

SHA1
08a8248d5805f450de64929c9243989b6e384491

SHA256
0bd8e2f6b7153910efdf33501a46504302eba062dc1ab36ccd29f62cc0bcec47

SHA512
b454040216d8b5b2e11b4ce1aaffd9e6f1ce66319ced5b5b681b0e5cb790360cead8340db30979c0fb59dc5558688f1463dd8fcc399930eef51a4a848a44fa60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
340fa293f05a47674c9ad705d48dbb4b

SHA1
8f35e7b159ca85a1dad272551ae7f60fe1cb2a64

SHA256
492ec8f2c2eb08a6d2b2f4417c0d97fe278f18cc28e3b2e49a12b7b00d49457f

SHA512
1d0f5c9d1d62127bfe80c7f4e2b754df67155d0b3853127d12c20e224bf41b9660801f321e5d9811f1f4070e25714a9bde43fadf480c700fb43bc9a233a3682c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4c11c2474fa7111d52dedbe1ea79803

SHA1
253a7b64709ca1269a74bbb7219bcb7abe3a7915

SHA256
3dbea3d31cab3151245bb0a011867aaeab2b944c95d77c8f7e0c6e86d7fe41ca

SHA512
b9a7709eb6f257e5890571b7754e0129135023bf7a020de8578d51c42c8f8a147b47ebb07bb61520df5e4836a5d0ded18b8c9b1b8cfe28ba80b89ab4fcb2495c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b246815db0b98d34a7c7c2df6ac58b1d

SHA1
63caf2967c0be4d8adfbdac4ec486281acae66cb

SHA256
96081ea90ea7c4ccd14068c7a1d1d8405ba9ed5a316c469754cfcca3f371cb89

SHA512
761a6b48f7d89bcc838451244fed64531003ef2e9576ad07d17e87aca3fb558ecf703307d82b6387be4f207711ca9589ff5bb10039d253fbb0744de226f20c3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44ca57ee60ec5b70c5ecf2d52292ab1c

SHA1
c543ac4a39d2d6a4b1ce52f3ffabc5ee002b4d80

SHA256
8c58437d9c83688535b92a936d4149fa036db9180c9cd7193f79fc056c0fce64

SHA512
ea3f76faf92da7abb8a843a7294ed2e2d7074c15e731d27018b1fa567657abb04f0a94bc873e87d3824995bcb4ae89f1e87e9ce74fc68cfc022b881e070871e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a9592e0d62563b65e875ef7fabb0c8e

SHA1
8d0fc67f9d1409f1f3ac1fb3a74e1a3ea22954f1

SHA256
7e35e8ac6ba4a323859591fa562a7d8e3f1172851eeeeb365b4f3e7d853edae3

SHA512
64ad51e2e6b4dd9b628e47bcb03c91f91e3f035a4561cbf925d2e1d5c64fa3e99f7ceddf811cb79748546f53a95089937a5ce4f3c8646f8869cec235349ed828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
412507f2fd621782e78d390b06464a98

SHA1
9a0f128a750a597333c9f15d57892b0765c0ea7b

SHA256
a90b28ac0e9091d4079ae7bada3599d5da35ae7fb37be913c827b6d6a85f04da

SHA512
8c3eaf123fa8423a8668f56982fa94ab50fa4491abf4816b7ab18404d9d6d9175b8f78b90c738c5d7a0bab37396280447797b8429afb00b5ec7edc081587afd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A66.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B57.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit