6c3298adcfe7245fdf333c5cb71e940a8be67a7c4eebb026308cfbc9b59e830a

Analysis

max time kernel
136s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9273fef0f8205130304c0090ec18feb0_JaffaCakes118.html
Size

213KB
MD5

9273fef0f8205130304c0090ec18feb0
SHA1

3427662833ab2a4d8a9171e61e1923d27cd80377
SHA256

6c3298adcfe7245fdf333c5cb71e940a8be67a7c4eebb026308cfbc9b59e830a
SHA512

3296d77f598004ea25e540b795162f27b7bb155b2c3622504e859f6f5223bb7b62bc89db2ae5ccaab185f87c99d52e46d4d243d1872d73e3a4feb82f1c91dfd8
SSDEEP

3072:SPDOLGKR6TUyfkMY+BES09JXAnyrZalI+YQ:SP/5ZsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423594167"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0C1A4A1-21C6-11EF-9F07-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2500	2084	iexplore.exe	28
PID 2084 wrote to memory of 2500	2084	iexplore.exe	28
PID 2084 wrote to memory of 2500	2084	iexplore.exe	28
PID 2084 wrote to memory of 2500	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9273fef0f8205130304c0090ec18feb0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa45459160e5d88b874e59d73c88f565

SHA1
81c5c237a9212cc9775f00f3d673e99803bc0733

SHA256
fb538a5761e4e96f6cef7172d92678238e610b50d321c4b752fefd0490e900a3

SHA512
ce1b0332ceb32cc486734df6ce17ece350ff809d1e078fc70e3f074327fe0c1d42708213e5dedb6081c67d3318d9f5cb6ee13e2d42354c9d7fe3a11af2e1b048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
413b2af4ca102938590556e62b081e83

SHA1
b0199c16db4fb33016dc178698f2952a913ce511

SHA256
28f5e18c815ed69b24e215281b624f94295c4a9f76acafd5ca6a952a9f7ecc7f

SHA512
7bf6cd53bd965af0d1a941801bae3578486a6207f87428f9e3f244798c401775dfb7e46d80755c1eee36a6bb6ede0dcf8a1761fd15f62677f96e3388e47dd775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31013b9ac948e4b74eac2a2acf2c11d8

SHA1
97a325e2e47eb08ddc4aa61d4bdaff39b01ce923

SHA256
9f8dfb2fffb6bd51b86821ca7dc1ce8b7b14d2a1675fbe2f7bc7b04ff9f2f4e2

SHA512
e82dc36893ddf0514dd496fc76b81fcb008ce34869d387fd0860f8324417f9afa83694ed1644802e03ab0c4a7f5aa7b2b1da3ae4b6cb74c682d3f064972095bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bea099e4db0282c3b7c4530f0085b4ad

SHA1
68ecd04918ff25dafaee4e19ad0a62f374d59f36

SHA256
3f24a09d88b7ff3dc155ae8f9eb878a86a986dfe1f6624fabebd3864889f299e

SHA512
0e82c3982269f8a365cb155724d50406dd12c58825f3c92dd9092ac3d4eebdb01e6c9ec9eb84d99e381234fbb23069cc8d50a67472b1593a83b34d2129e31e62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d3a0314edef12302597b4cdf60a128a

SHA1
70589e517f7517b96bcd79c9d985e1bb9ec65ba8

SHA256
995bde4bc5d7b402590d7b178efead71a4003cfc1dd13d84200a7d739067b6fc

SHA512
6197bb66d3f903f2a1aca40bb525974f0d746a3bfc7bb80402b78568ccdbffbc6b3bcdb48cfffaf927b6c006274e6180868d0cb43fb759eb09540e1dfcb54035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a47809ce2e1714ea0aeee2cb9abd1b51

SHA1
abc39016d057c5ac9ce6a824389e5acac7dd4b61

SHA256
080b5b0e3e3559d479c4bc54562e676745c797a9785e848a30f0b576109fe4ab

SHA512
ff4f7b175e742ffe7a9cbe3456716bd80c78af2b66a256954bd6d9f10b7d75f728457829aed9a08a6a9922124200b0e501ce591716862c26e83c846f315c7011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec71617094da5805fbd043e1f84d781c

SHA1
a5f92702b1760c68ea85c3c96949fc7e4973377c

SHA256
410468ca27689051d0fa363a372e3b83897f78124eb1fb11b33632e38d8b6f74

SHA512
c098af0caa724328b4e19d9f1fd4569ef4a37ee46ccae48e03457998150c8164f59d41223f5910e5c8de6c07a1689aa805f6d68862284f203d425b639d092724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38402d04c3c8a8988cf1f97937b2ff07

SHA1
e94d2d83e6763af847480b1781c7031114f4e934

SHA256
d5f054e27a46f16413b2c91cd7421d1ac8fc28b1e5c6660ac2a1c428b036cdfc

SHA512
4bf171ac190c55641e80c96238aee716babfd88b8e229c59a12b4b901a431dd13c6c9f8ca37ce07608f0c8d0bc156cf28d22eb3dfb2999e6aba00c481bb5f286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a33fe997cce7c7259e1325ca31345d28

SHA1
523a2e1b552f097653bb2f3a7133456e701ed9c4

SHA256
720e90c4ee1107990faa7a05a0aa766420fcda49f1619ef6561aeef8613a3098

SHA512
30b3b1ca51f8c0ecb127e256540144e870c45394ca0de82d800adbb571c9653337440cc139a5e598194842012eb4e68113be58e6d47e6bdc5bd1c79273799ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b908b91f4d215c25f69477d3a2aab8ed

SHA1
0e3162a4636c8841ab6addf82861127dfa3e50d1

SHA256
8058ca507ea8f7e8be8690fd5c823bedbaab5f0ab4d46f1bda603652f39a1c11

SHA512
bd41e025dacef69902f2679e5005de019e8b2f9c48b8671a3db250f81acfe363ef7f1556c04f070aaebe4a3a3a840dc9ada7505288c8b84eb0a6752e8b9ccc9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a15458714d44075c046816b101a0abea

SHA1
ea8e2a3389f11a02ce0b0b5c7a2f4d519e8a3fc7

SHA256
917b0d801d7279e8981c3168b5ef668c088ae41fa178445955b091392c705375

SHA512
a8ea2c025b6f05ec1cd7886cca2f4b9d535bd33bad542a39c08f0ddd11ad4809029f607ac43a079a1b9f4897f2a3b9261538031c17f84eda44221a5e3c3cc9dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
000ed8daef82079d1e2ef9ac6ed05a23

SHA1
884ab6e1371412b44594824fdd62adcfd2957136

SHA256
eef29f8b419407c5cd5703999cb8998b5d7c46b15ad83fffda73c473ed9c33d7

SHA512
6600c71c3b78bf566362676ce9b2c70d1debb6d436e09ec4cc75f1cc086eca2caf8e0718c371cc5e42666c2dfab497e7cc0bfb0303e21f44783ce0d2696a94e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ce6b0297f571a2eb27960019136d826

SHA1
490ace08ab1b7396c213fef55ce2350494af3d77

SHA256
e2a836010b4aa908223646d7f13f47ce7fad6680e25ef7228d8ecf3cd85e364f

SHA512
1b3756128527b6905b4278a8907f32ed88c720cf7283f48ade17ec240e064aa7d4b8206740e32eb188f9a7ed9567dcef130b75d7cf561a707e409dbf143e4322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
869e0346461fe202b728b0e9e42fe2a8

SHA1
979b8d7abdaaa741aff1937f8db34273fad260f3

SHA256
85cd95166971177b3943be5efcd69eeecd2f569a05f963f86f5de6eaa63ecbd1

SHA512
c369f3f673eb76ba966a18cfed7cbda893f333606b647124d0ac860d30b12782c4a9243da0ea3f93285adf5ee1d402b7c4068b5ab67b4df5defeaad401bd129b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a18c614602ad9e075e021d1fde2d890

SHA1
964ec018070d63346dc916fe6fa6e1a7c000c6de

SHA256
7debb0fd32db63ed176021c42f7e2893b914c8ccdbc951f0c42d59734904a279

SHA512
465e80c39ac77b5750b928c47856278c489739448d5afae89f6ed97b71176837bcda6090c21b47c2e7213a6e438face4c5246b69884301469021026bac22c2e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
766926cd4c6d47215a9a5219c269325f

SHA1
fc489f61d82209b3bec11171d50dc038f248dd24

SHA256
fc3e848298994ab4f4086a6c8b6d55b28407c2833e481fb91d261df6a920b88a

SHA512
022c48cc7d647dd581186b5d6fa6231ad0acdcbf3f71567f235ddcd2da79802d0b5f49d8d267bfb8c0450f80af30e4d730be8eb925adc0b86cb39fc763a10705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de47171353455f742fab25a1ad959252

SHA1
16007da5d56355cd72cf9d44805d72fc2bb42111

SHA256
76c3c0457c5a27cb82c867734df8305cda3f414953b142e3c67e43137d6eb7c7

SHA512
df8df502596c491dbb91dbd164b0370ea34eb482dfd9f3b0909e8fe327845c87cd94de74b8573d176f9046451c967c0c5cf6fd9e7ffa10c6877ecf92414064a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c1eb45c26aa6aac04414f26d2c24e42

SHA1
9f0b4663e83153752ed16b668d4b204d71722f92

SHA256
27011dcff5d282e5ad52c68f2d27fd096f7431a79feb343ff1dd1cf5aa5ad2d4

SHA512
ef88689ad4c724fb9b9f7154d3a947c7114691739534e198de495be1f95bdf41eff1a34665e04d8c8a6c9ff942bfcd541c1a92594ce398f7f01458fa64047b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf35a35847d3d7b109012ce28573e2fa

SHA1
2bcf9755062d2bf6f1cb13fd257b5427e558bb45

SHA256
59c1bc5a25749275db835703bf7a322310a525b77f901a814067611b7f3655d2

SHA512
068d61a78dfd1b63551c16200dbea639e43cf9557d200ec895e6de13b8a64be2255415e4c093cf44b9a80edebc40f395b670517c66ba7b30f7091d2334efc7c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDCF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit