0c61c624da5b7bf62ec6c835e0c6421bbe00bb3a9fabf4031a1fc29fe0f3bd7d

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9703b624b692963a499065e4313abb7c_JaffaCakes118.html
Size

27KB
MD5

9703b624b692963a499065e4313abb7c
SHA1

fb043981f627dae33380645d63b028693e5272d4
SHA256

0c61c624da5b7bf62ec6c835e0c6421bbe00bb3a9fabf4031a1fc29fe0f3bd7d
SHA512

3a87be0805570dc6d487cf4156829ccfb805b3816f69b98877de26b369340aa5ec0070017f64e38c876b1f6b45423c0e26b423b60a3bc61cce1caa71d0d78593
SSDEEP

768:Y7S6w8gj/Z/rU6bXK+y6BxECP2W1kX/AkgLk7JTSwGyijOyXIXlrV9KX:Y73wN/Z/rU6bXK+y6BxEu2W1kX/AkgL3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F486661-22E4-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423716788"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1312	1932	iexplore.exe	28
PID 1932 wrote to memory of 1312	1932	iexplore.exe	28
PID 1932 wrote to memory of 1312	1932	iexplore.exe	28
PID 1932 wrote to memory of 1312	1932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9703b624b692963a499065e4313abb7c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b3e5c1ab7b4eda081c56da75fee65b6d

SHA1
b4b37b0b6cd1285bcb7887e2cd340052e8f898c6

SHA256
e79b73281553fcb5d4d954840aea99e609e9b59f321658a1a3a5ecc7aab0155b

SHA512
cf98ad74a287c938beb53e0f85a6a65065f40165f326e0884f3d0934a92486cae76090bca9858822599dcb96862c54611ceb06e27c18bc6133701988791e5b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a7106f65f4eb26c983c130a037b58f27

SHA1
9266872e58cdd378c35f909fade69d2514ef5697

SHA256
6719dac395d1c45a64269fb63462c63e63f1ed43e3bd9eabb5c2dd79ac2ca97f

SHA512
5f522f914fea3243f58d93116fa989bdbdad84cd7b05eaa6210801cb566b09e3ce430e38f293d24487bca9e3b0045f218146fdf339071624ce3ee17091690773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2296020f77728f07d6f69590648812a0

SHA1
314b34fd71c0423a0912975c575471e9119e9d71

SHA256
1a4534822ad00044b851b80a849e2e5a2cdf16a1fdd4c3f2a24353e96c8d6ab4

SHA512
03a24863a3c95d8e136b98b10c923e0628c805df062807093e90a1f678eddc5f53d7a0fc804981054f9e574075386c0510bcbab377cac66b8472ce0d1c170c39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f98b1b2fc4040849c64eaec79dd69e48

SHA1
93f4d264f6ab7eec086516133fa4c286b875a05d

SHA256
53179ec4862568f9a0a54142e434d63aece6d6dbb357bb5c0c8e9686855adf70

SHA512
e2f8da4b0682b806f8003166a6b4e53e0f08e644fa9ae078b691d9aa8f9bc09942bc883b17f62d2a158a61c3acd0e9672fe1a37a249d93bf1d835bb0295e623f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cffad5773956a98546296699122d4a6f

SHA1
a725043793f16e672babdb314457d80608c413a5

SHA256
6fa38847be24831ba44b723ee4fa55daa59f86303803411555ae8a9978862016

SHA512
dca6baf5393e3c06bc3e63feac1a3aff62529ed195a97582c61e788d9b415a4cf2d3cf1562595046b1bd1c19c847f461ad44add00bf93d98b3c6f2c55dbc9392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d7ea9066dda55668c02ef53c2c9f4c0b

SHA1
255080357711998cf29473e3a9c500fe598e4f5f

SHA256
de33190ee686d8ee89f7c26ead79cf5a4b09c43512b5cf4a87d0124e46fa7f0c

SHA512
a41a0cbdd7018974b42c90629c47687f4b5806d8a7b29f2726c94877189d7d1f8fd993d5154d569ca82ffbeb60110bd7efc065a36d34bff22d6191415a843ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
24d82e71b0f91990e8ac1f0518147ca3

SHA1
78628549cfa9ab852ee58fb4f0ac0ff731ccbd50

SHA256
5fd07b96a9622a2f6db878aaa0053827465db81cea8284ae99ae24148464fb05

SHA512
709c2e46ddc275e48cae44ff5efd97bfba6156d9779a207266c09108be7c1e28d6222864e2ec918cf0888c781c45e2156fb6f5d6fe628def7c90799cecbfde53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
702388afde68fe28bbbd84dd9fabbd1b

SHA1
697cd498a812d3aef74bd329b60bf25cfd0dd9b5

SHA256
64e9914e1ec9dc73cdd47988a37c350cc11d9ee938016923c5c616f77db41b31

SHA512
e82694cf746d75856eb5cc0859f3fa0dc55637fac7a2a8ce55a3e06b217ed5ac8a332a226471f712f144d080b39b269f88f1a38b3ed1470b5ac060f785ca7916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c029d470b09a0b129e6b16d248ba250f

SHA1
686a24063fef35f549ce03999aa93bbb607e6ffa

SHA256
d29f39e8c5f3c4c29f69d40739f8f296541ea3f54b60aca40340ac26a025c5ab

SHA512
9354cbd89a3f7facd5b1fe813057984d7d33eb0295372e4a17a4c5d54f70c522ed0207164943546c333fe985dc84554cfa33e6de3a64e1e1c1781d7e8518ccad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
564378ab094b7da415bab4bff87a7a69

SHA1
03637af36d19844429af189500a3ff8dceec11cc

SHA256
7b1d712f5c2ed65cb465c6a921229f3423b2e521a375c45bba690f3591a84161

SHA512
e000ed1a37a05e5bd9b75f3b57bf6c7a5f8fd870902d942812951da7f82fbae80a7dcacb48ea4bc0c80a243d29f2e120f34d5922bf37a7beb17377352c03198a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b09f5d01a31528b75bacd5fb457aa63e

SHA1
926ae50bf9deb068ff7aea01bda2ede035cbd186

SHA256
c4e492a9d87be8302eac2c004b5db2692bc0fe76b63d724b09b7479d68ab8b18

SHA512
250c406d0de02c87c55d0594fded007c25427ec590aec6f9c259fa3ec819814315df91911a50051dfc54ba59ae018ec0acf1e4429837eba6f54044550c0a276e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
038b74352fefdc64cc93c757e4263c18

SHA1
b7f0b0fe289dab45a2aa7280108757386fd4f970

SHA256
4dc4aeb12098e12450f4335cfa68573dacba5d445f16dede54b31a43ba85f7c7

SHA512
514d6d0e033c0d702b8461657114b722c755358f89f8aff68280bd31efa437cd47cb6e8009e28a41a3cd06cde45e42d3a4e6a085f7fb905840e6e771353b9c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9036.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit