735e58c33e162986b68ba22eb371434ce0b2bb577fbb1e955e0cf47d84eb57e7

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 06:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9a251c7038fface3817f4995cf851fe9_JaffaCakes118.html
Size

214KB
MD5

9a251c7038fface3817f4995cf851fe9
SHA1

e657fcd9c347bb709f9c4bf31e47303ea2be09dc
SHA256

735e58c33e162986b68ba22eb371434ce0b2bb577fbb1e955e0cf47d84eb57e7
SHA512

b38e7124e1673319e64e03453d9de1a75ab1358323a9987ab3d69133a15392eedb96156c8d48f668a3b747b0fc9f27fe40fed37c378171de54f9bed30407f2cf
SSDEEP

3072:nrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJZ:rz9VxLY7iAVLTBQJlZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423817296"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{440600F1-23CE-11EF-BB1E-6A387CD8C53E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2348	2280	iexplore.exe	28
PID 2280 wrote to memory of 2348	2280	iexplore.exe	28
PID 2280 wrote to memory of 2348	2280	iexplore.exe	28
PID 2280 wrote to memory of 2348	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9a251c7038fface3817f4995cf851fe9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5163a67ded6fcde7520a0352e3ea63f9

SHA1
8efbf218461756c4400e6d5b9728030d2ca3fed0

SHA256
0987d07b721aaa5bee1462c9a3f8c7bcd69cfb28cd5b259e08e3dffa16311fee

SHA512
8eedbdc40639bc8f646839c3035c17c2244dceab361f6cd97329ec04e8a12190a0742695950e3003ef6611c6bfe4958fcabe3c28e330f7e5bb59bd6f1dacfd17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2cc13c425b880865d0a001cc3e4aa21

SHA1
ffe94f0a34f1555312f4b97973efdd67f5d35f17

SHA256
a96b3d9faa83b92b85cea29ff70e6bd7242a94ba2054de65d2f917b656549313

SHA512
98273243cb8d0141f858d1dd4cdd8d5d9de202d376c79b137604859a719ab49dd88eb57a9433ed54c80f4add1d5817cef312330e94ba5adb8a585717533ed596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaa000e0bfb8d9029f301216ecae0db1

SHA1
eebd5c8c11168b3341f254769b53c0a8d1536218

SHA256
c3272a2dae133347a9efcfcb46f593be07129a77e6dc8c8c2955a5784445e632

SHA512
4d7cab6d6d1065ddece128fde3e7acaf38cb9d18016c7188aa0ba7162d506840528454855c6444d43ebfa5ffd42f58dc9bd79ee7fb08632983fc45ab978eca5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0c54fca87852257df32e22ba39cd380

SHA1
86e9d13b8cfe79aa0a5328e24833192f8295305b

SHA256
10c221b11c08b461588acf44f43f268f1c3935b414dba1caf7aa017a024500c9

SHA512
0ab836c08e62c36b33ffed4874c883b3dea643f7123530dbc7b7c14b6538b8fb981a900e6816ca641bf8f3dd30cc0f686c5680ad2983632c569013d66b12a472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
355e1e1d8725d0bf679b80e9ec394a68

SHA1
446e2d42c42f4afd020c7f45128986108e9699a7

SHA256
48b01cc325e9001f943ecd0f307c48724526f9694d6781b5c2ddab2ba349ec05

SHA512
77b6c8fce516178ab05de8548c832494817aba61bda82cfcb67feb69c2061e1cc6bf14bfde5b35e132ce63eef007811435de17000a0288e67fd5bc7f6c0d8ddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce6d6b6fae796a3d1514b6c3269d1f12

SHA1
9fdbea377492541e77f0beaf5b6f9b8c114beaa9

SHA256
204b0dab3a3e0ababe127ae502e4651db826d135c893172cbfa7a2bdc52563a1

SHA512
dd2327f0912d81bd83446a18f71caeac5454015efbd66797b1aab3c4687cfee43726481f568ed8fbcc2300c14ee7ed135dffa80f04de5c79d93fdaf001223448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
075a889171b3d6f1bd4aff87d3cf2047

SHA1
f35ce2077e03c2416ce1006e66bd7bb94b72093b

SHA256
3069b8a6ba4b074c77f021b5512e185039e7009f39ea308c85f087d80160c689

SHA512
60da9b7f00f73b253574326335577daa2f4d849ebd3bdae364c91e7a65eec8709076fa9bec45ceab8a94093614a6ca76d70498c41260ee2f199c0a6c7930f815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd315ab44bceccc7a03968123ed1282b

SHA1
202b97de2f9df757037e15772443e98c6b5ef9ed

SHA256
7ccab1b561c26141ba002867e01598e4b6ddf9dfc2ce350316b26fec3eb30697

SHA512
90cc94922ee4031d9eb4e07238b142da36d6360f590a3ef38854dbe17feefa2055b73b98f8dc5f6b73c1e6fa5003b9aaf41f6c84dd8eb5985a9d05eb39c9d5b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df090c78858c90ebb0b071a60a33a639

SHA1
c3a4932048beffb86b38c7c84561f4a2298ae3a7

SHA256
f5ed9c24f2e6de52005bcca3ca7a15c5675fb06b08d824436a7271f9f50368da

SHA512
f6c847c5bdcd26ce53c716eea4be7afe57ee319ae578a0780d74d61370d0dae64e828e6634b1863cc16e3d16b0175a4507df7993272ebaf86d51037d3d6662d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63e12f49755f7b13bf826db80be4be72

SHA1
233fbffe8d430fad2e86bfecb2a179182d73fc7b

SHA256
c7f85229ee91e8162b8960d420881881c777b7865b546070e6fcd542b13187c7

SHA512
7396d8a33ccc4278f38f477ec586396d5bb427f31c731f3b4aa486ac1c38a0ca91fd42b336ab582630b782bf0cb1480823b17d9c7aeca0a435f3c8310e97cf84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1113.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11D5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit