6446b79ffe2ecc6a71ce5a5d09e028eb69598eda8425ddaa09540ee4d4503e73

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9cc3241ec8945c8cc01a9ec6fe335966_JaffaCakes118.html
Size

213KB
MD5

9cc3241ec8945c8cc01a9ec6fe335966
SHA1

63ed215bee83dae39acdb404aec9f564b204fb90
SHA256

6446b79ffe2ecc6a71ce5a5d09e028eb69598eda8425ddaa09540ee4d4503e73
SHA512

6438adf7c3fc9de25e1824274362b1cc114998a2ababf8c2ff6025d4d0cee42d4910a40fc21698f153136602296459dfd9513fa6cbff9502746285d024bd1bae
SSDEEP

3072:SvgvM67J2g0aV+gSyfkMY+BES09JXAnyrZalI+YQ:SvON2g0TgXsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424235851"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA485471-279C-11EF-A41C-62A1B34EBED1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1744	2084	iexplore.exe	28
PID 2084 wrote to memory of 1744	2084	iexplore.exe	28
PID 2084 wrote to memory of 1744	2084	iexplore.exe	28
PID 2084 wrote to memory of 1744	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9cc3241ec8945c8cc01a9ec6fe335966_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0aa9be5bc8e726a0f804d7829f244ecd

SHA1
b24a4d96f5a0d9361e9fa041033e26437cee911e

SHA256
9dd004877587c33c8fafadfebf609aa297db2e29b84c38f2e00347fe948cfebd

SHA512
365cd2820144256ef4895f85fed433e11049b108ea2cb8fe40c4d70fc31e84d0e3b99f3615a539b76bf25f022591370d79d064e9d0db539b752702b29aff3b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66859cbc9ddfeef112de4a28647dbb21

SHA1
4f3fa445da121589ebd93e1ab5b4e499bbfeef01

SHA256
ce3e51e1460e94c251a0043041a3f86d90a6b4f2a63d50fbf9bd3f442b64f67c

SHA512
23649a255b799fc7782abde7e664b783087916d7f6485bdd517c7cb17bed2960376a5a3a91b7d06f62ba95875082e7fcd6422285dd403bfd741b903f1ad75c12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b24cbe61d9fdc57e7306c0510261ed8b

SHA1
6594f9fd8ee826d633e8e893a5beb7632ada326e

SHA256
ffc251519179946276fc95e47418d27d1ba52a49a63868c73ac7f928786f80ed

SHA512
c54ff5d27e72141fed9e5c50c40481eef98d34497905e7ceef4baf6ff93c7c97a0e86d3792e08ee55512593bd919352edb450bcdc2b3e57a590dd861f1adf577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23e3d119f25dd861fbd8dd33853bb957

SHA1
b2e3322525004e2eac3efdcdae0e83ec15205221

SHA256
f0775e5aea8935d7f7dcf54c1810d7adb7018c662d26eba403e1b18a2dee9c2b

SHA512
f9b038f51e0cba5c0c77b1b8a9912f582625e85edef076b106e14d3fdba46e4060554e68304b77a4b1f8bd13cfbcfd4b298cd5d906bcecd5139bc783750b12e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77fa2eaf10e7dd237992837594be8099

SHA1
da3671a7169305e53f3aeb615f328f311f63d11c

SHA256
3ea676a58796011836aea4f16079ec05a6a06179b79aab5bd18d98c7e739464d

SHA512
a409b9b43c8eac5261bad3ff598ff778ad60ead0234a4a555e17519680530d44e6043386204062c2573231f8a2948c8f250644713254af0330da98302cfb0537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d33ed72156328ee7ee7cce7da910474

SHA1
abd5f2d054b4979e1b9ef630008190f844d1a899

SHA256
639742dc140a75aa7cf79ce099a1294e63baa45f3d9f6a614b840b6af7556c19

SHA512
d92fe69eeec86d20cbe52e8f031863103998ee1e9375f6e5fdc1f60ac8487f93624a256f4b49fe1e087b38394f7bca5ee7e6cf2f864d547c4e697f911101a043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6896f73336bb9db104c37fb1e1abc20a

SHA1
cc8da9a86db062c55af319f84ae0f9a230d76f38

SHA256
359982e5be7b12f9845d4527d198db4bd90ea13c5f7d71b62481e6339b1df39d

SHA512
fe0ee43936cefe5f865c1bedfd405e59937e8842977c9ceca3ff754befa7d9f812e2a857e59718e76c6354709f59cd614ee11ca9a9cc96ea8c8019a41640bc51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9e567f52afd4b269b75f1613e4a055c

SHA1
e9f6c6affd0eedd680cef843bf1ab6bad983e74f

SHA256
8c1a1895b833789e5f837534c3ca1f399fe9226e8c543267d10c2f75fbb87e8a

SHA512
a6db33cfaed35674ee55b4ed3c5f867d9156df5e8397151db2f13008e4efa7af3de2b71d14532b117461fdf1a247f3d131f8b12e90c92986323c2e1bce059dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dc864fcd5cc2c1f44f2192eb24b8275

SHA1
40bb6f8622db203c81a28cc7f715a25c997d2056

SHA256
49dc1d6c859e37e4c41225e391b232baae0bec96df50d27bf611a2114d8961da

SHA512
2aa5db52add66ca01b99ee45f8f795ee1a8a722e413bf53da970be06603e91caa9f148ddb41a3a7a1ca5f396deedca0217f1537b0bece013291b8704e65143df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c45e54f0d5c5c07587de7bf671a5e6cc

SHA1
5f06d9730a0881800c251f97a321846347d8a8d1

SHA256
0462cd0307b3e0795a24b7dcc3ffd0b87ad07aab7785329b5e11300a73ef8690

SHA512
da124418e50930d060629b3ddd47b84ab4cf2c7568a5e6f041d327a7d66ab7f4b92d3c2525789031d45e0ac9b6ffe549e46f2cd6930ec3a23cd896458d1f97c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecfbc24beb0760accdb739409cd16d0a

SHA1
83810a21f9203626b0620d1d985fdbd8bee183f9

SHA256
27d266968611c027a511e07721bbc8aa49070a25c0b97edc4dea9cab53bb4a62

SHA512
6fdcf1f0a069abc07dd149e283e42b6ba256fde234cf83b526723f3cabf078dce68aac7dcdbcf93890c2643015141a5477c41afadba195bdcbf916c5ec50c323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc8208cd18282c9b4c323740c953e7fc

SHA1
28a60c9752d87a72f912c716ebb5dc28d02798bb

SHA256
78e66b78453b110d183c733f510baff023482150a7389bd0a904147d7203646d

SHA512
c52033151d99397b101f1f1d556ffe8c00b6e522ab3f2a93967df313842d0aad1832a721f9172444cb728049c13400fa4bc796ceb2fe39078032a516634ed28a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2456469763a0f3e1bea4dc94dd210495

SHA1
1a841d772b5cda9ac4da8a44a26efef1c4822628

SHA256
8918eebb9218bbb1e81fef3a556e17acea1d3c007ef40366d849c36cc37bf582

SHA512
a2e517fb5f63ebe66fc78f9e42f3b6c690a78f0f8e03f6e7da84d36e3863bf76b681e6f5ab96b44100665e6f2bfdca1041dd7090417b106d8d989283bc791bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c1a3ba600f0b6dc82f075694c000d36

SHA1
c4e5926547bd3612edcd6a8b2d211fa4643ea18a

SHA256
cd6a31bc5b8deb2da0c4b1fbc65b36f0339246de120e4ca693f73f5d5b80530f

SHA512
4a20ad97a13fd77d1c8f1403d544c2f845386c6b2645cead3930476c3f19beeb30afb64d5c58132aeaa07899793048a87d813e3842f9504a15cfcc0033699757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b14f7a76a56e072a3eb5aa7aa6330342

SHA1
806a38151b22e5e111dad149d1aadf86765f4b2b

SHA256
7619fa05e02751339ea5968f1c9f022135450869fc70f69ab2bd9bbe4f3adf23

SHA512
87a89675fcd530a4eab7f2a415df4bbb45f80b38c4e750132c043255e8e69df5f600b681d1320439033d67bbb9466a70441b8cbf82e01b0811e0d30108e488d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcd106d1214b1a045ef90336ea95ce26

SHA1
10bbc25f632335c925592b5561f795179c252e61

SHA256
742802a4c44fd83cdaac16d1ebbbdc5f5ea71d6db77f7f48267e48cb15232dbb

SHA512
93bef61458777edcd083fee31b5148a595371cef723d01c2028c9e2ae0cd8f7dba9026b63bbc37a4c5224a2ea01334bcdc1305e1f54c476a9efdb7e0db0d0088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b62ec1f1118b5c39032d68d93f666d4b

SHA1
6d0eaf5e940f01cfc39a2c6ca3c745e5c215c271

SHA256
b9590c049c5e9194d196b2bccda7f53538144a0ac23dfb479f73b225e4db56e2

SHA512
47a03b21a84d27d553909464aa55808b7f0373012aa05cba7df612abe33b020f29fef31db75be140d3885c31016bb280a1dde98e56c5fe25735693001b7793bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3948a46ac1154952dc439daa32666900

SHA1
4dc6e5a93b5e962de47b3927c6b86a970978f64c

SHA256
c9ab32db42193f033597f4f9314b4e3a5178e2026e4773392986739d5c27c707

SHA512
41b30297bf39be758fbb31a47544734d647473b7038fefa078975a378d77e123108101de747947bcc46b6d6c407ddf37d25e02e3c65e1343bcb1162812a8d423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
434bb5c62a3c67772d599c91447cd00a

SHA1
35147d814249d6cd74913dcfe0c539df7d267e53

SHA256
f595e1bb72588335472db672c21f4bf5454c8c5f6ac5770bdc1b72d06f389ddb

SHA512
1c83cc2cebe45ce48ccaeec5d998eff1ec67548bdf735e18c497f7d7a51dac91212b0162ff1d99e61a2bc52d8388b731550f13bb735128f2e19cb5c9153a5f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE55.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF36.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit