c00e0a9ddf55ed4769592c02d58ac83c40fb52dc24ce6f7fcf3879c7effbd4fe

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

928cd9f47be407298d57eb5ffd768062_JaffaCakes118.html
Size

23KB
MD5

928cd9f47be407298d57eb5ffd768062
SHA1

88b08fb75f3c799762caf9d3a8b38425c89fd6fd
SHA256

c00e0a9ddf55ed4769592c02d58ac83c40fb52dc24ce6f7fcf3879c7effbd4fe
SHA512

65aaa57e9f2e22e433a16614aef8ce25eb1349c4d90dd2a6b92c74b1f152ce9e17ce420fc198933c49dd6300b8d48b33a6cfaea5280573e72f5350d492f1bedd
SSDEEP

192:uwvjb5nJCnQjxn5Q/8nQieXNnGnQOkEntMPunQTbnNnQtBXvvMB3qnYnQ7tnEYqH:/Q/yUdB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423596363"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDB6DFD1-21CB-11EF-910D-CE7E212FECBD} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2000	2220	iexplore.exe	28
PID 2220 wrote to memory of 2000	2220	iexplore.exe	28
PID 2220 wrote to memory of 2000	2220	iexplore.exe	28
PID 2220 wrote to memory of 2000	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\928cd9f47be407298d57eb5ffd768062_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f0b486c1788708486da081fae3cfbea7

SHA1
47b6ab4f67aa377ba7d745a3ad98dd8b7181a7f6

SHA256
0f9740052c32f0020771788bdde410ec56b4cafcd597feeb068aa6f2d90ddfad

SHA512
d5980356304de713ce549ee16811cfa979a562f809d5931d5e29f872ab2d3bde0b2a1c2f7a3502c2f6a89ec5ca3005ebcdcb6e95da4bf8f768a7406b797cfd37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa63bf7b8bd52828da30f02938f9546d

SHA1
94d84008ca5693a89b91d73054d0d45fdb32e516

SHA256
a2cf62eb44c42072d6941a181f32ccdfcc667057c3ca0b3ca07d4dd0a85d841c

SHA512
75aff076e5f9fe2e2e239704165638dd57a32b11bac62dfc5d145c93323d620dc0eebd83d4a807b2f7eeea991fbb0e11f07082b858b3ec840ee5d5df28160d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78c563d64c757485d286675c82493d1c

SHA1
ff1911094b54e9e8c1d0caa05aa7a391ecd6138b

SHA256
f199cdabbadb2fce1f4790429489af56072aa5ee091bd710abcd0de5ab3308a2

SHA512
0ef5ddbdb8dac733df507301f9862b52910146edf8a6522ce6d0d542e01f417f41c4194cdf7cd54e684485217ce6c33069a516096bf0850cdd48cc86572314dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9965a5ebd7adb55f19e19aa519861789

SHA1
f12592e6d362a42c5bdde4e4954f2a916104986d

SHA256
5b657340996aef0f81f195249bab4cb77ecf6ed59bddc489d422dec20aa20c4b

SHA512
e924aebdbf861ee3e9e1ea6cf1a0c292473625001d9a1f453a1cb7e70895d15a22b1855b893d8edb09743d4949d2b2a3a1313f09bcc5cc437b2dd6a27eb5699b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0657cd58301bd5625434b759adaaab88

SHA1
add003c3b1db1a720ccf92283717b46e93c62e36

SHA256
a57d41e5072c00cc8d1b45f45196d3a0903da32faff638d92b5830edfc95ae17

SHA512
ec6922035563dce65a04beace622e31d0a31feed6a77ce3f6b2e886ffb42bf13448e2113c07bf972d5a5b793ce135ee15f774346816fa98ece951eb482c798c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d301f57df41810f881acf63438aa6c1a

SHA1
f8b73d66470c9df16f5fa5f82fb8881cb7ff3dbf

SHA256
b991efd7cc2e85b87c9ef4d20724da5075454474437d0fa31ac0aababed3b86c

SHA512
e114f5c0e41ceec4490b67bf197c2526b2e6e5ac8a90a4f82f464b430a2038815a825229233de798063aefff40b59fc8c5ce85a0877a6612933c1f4efea05715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e872370d530ab08befb698e6183daa6

SHA1
472d41a9c6aa9ea449a22c8c7246d8d0704e1b3f

SHA256
cd63a9bf246628d1a4f1b07e1a7a15fd13bcc9ce4933e164e8bb3149c35adb94

SHA512
dd2eb8eacafe7df1e5e8fb93b196ef9fda335d531e40f5e25488cc41156787851c64eee9774f6b7de070f2f01fb5e97e278bf95d87df5f66dbc8d032715d26fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c646a02928098d99ead726e4bf022ad

SHA1
7f221dcf46c210fc69b01427e735bd6a69a2b15c

SHA256
f214b6678ea9fddb3fd65ac84031fcc5a22fd67cd059fb2d858832329d2073a7

SHA512
6c1285e3f98d1e33a55641c5390e4a0ed58928e19a5148f40d32647bf0247e1e93d3a73fb846e1d89a2b924060b56172f28cd9b51e29b1e2adbf11dca8061830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3976075668e880ed561f7ff7c11536b

SHA1
d96b4d37a7b5662bde91020f43b5b876350a8d5a

SHA256
2197d6565800f3c2755aa073847e5b5348a903f85cec684613830209cfcb86ac

SHA512
469fd38694289e421cd876f002e0fc25eab84add2f52c0585039b6d9593dcc11ce5be453684d8aa864fb8660bc2c86b8523e2f37a843f66fab4114b2169df42f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a12b2fbd6d4e2e1494d8a214cc331658

SHA1
0b0913a8830a012b13584a756fd5bad7b691170e

SHA256
ac64140f2663a0c232683354e632c776f1a05e82a947c19997ff2874df81ab23

SHA512
3b5ddbf416e9f8533d36ca0a7c6f7c34fd012cc78664a90034fe06e1a272c0e3d793ae1119ab646ea073d966a8c08f1175007ce2f929d6d2b3a9c83a629a0690

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF61.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit