5a478faf6b5109298fea530bb8e7b0f520d081ee5f90268a9bed027f326e3f22

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b6dcae0d115e683b6e58f5441f3d651_JaffaCakes118.html
Size

213KB
MD5

9b6dcae0d115e683b6e58f5441f3d651
SHA1

ff420476603cab4118ab53f12fcfea6125f87536
SHA256

5a478faf6b5109298fea530bb8e7b0f520d081ee5f90268a9bed027f326e3f22
SHA512

63598f1c915ebf8b9b66b7f850385f01534b89469e752c0e6bc3bc50b49d887b41bab332e4db1f3ca03aabcc40593ed5926f95b57654ab88b4d2575069bff655
SSDEEP

3072:SoMbxoY9GyDyfkMY+BES09JXAnyrZalI+YQ:SozemsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424299903"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9D22A61-2831-11EF-8951-5E4183A8FC47} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
948	iexplore.exe
948	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 2164	948	iexplore.exe	28
PID 948 wrote to memory of 2164	948	iexplore.exe	28
PID 948 wrote to memory of 2164	948	iexplore.exe	28
PID 948 wrote to memory of 2164	948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9b6dcae0d115e683b6e58f5441f3d651_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
378d82aba93d5cbe8dd172e8231b2500

SHA1
bd73af2f621cf4e2337bedeb0b3334cb31cc9fd0

SHA256
9ab8205e4af74761740fce50713cb3a084961a7b51ffa1a15e1c1fcf743ce144

SHA512
5d5138d6202978d87a23b13fc1ac364ee48c51c62b158e4db094b70fa984cabcad6bc4bd8c89f3d1c02ba95f6104736e1517a851fff4a0e5255601e27c3b369d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
269e3758317e863fe0079355533a747e

SHA1
fe138ffdbaa36de882cbf05cf13b9064c1001af6

SHA256
03c9b22b6f161505b4321bc709a378c81418536edd1db70adedf38ce31e0f099

SHA512
58002ed5c2336b255633bc875802256dd0ca8a3a8dbcc821d0fe44374122ccf64a6b4ba933a9ffa90f884efd235cc27ba3544f6f1becc21d9ca197e5d2bd6b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
982f412ccc8229e5d35160d1815abc6a

SHA1
4e0cbd140921247ba2e55411923572231494d3c8

SHA256
d525d128b47d4ec1fb130476433ae1195f9f09c62c1a22d42415ad20338a944f

SHA512
1722cc26885be6d0af768df86fd5556721e9a4c34478e11c19c6ea3f30d88244534a0d8afa63bc3186fae7a5416aa68f5f165aaf3a3909086a38c6db595c42e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aacfca48a9f0c64d6ba3b385d4326473

SHA1
495aeb35bf07cf0e11ab1e12818d921519799d8a

SHA256
4888c9207a5f52c46d6e6afc94e47b5e8770c57493a346fb6533cfdf11fa3af3

SHA512
41b71bef1dee0c9491d2d741536a8efb08e2a32c89ce9c5b3fa8a969c1c708d285bf430cc8da590ba591827de982ba13cf5048c65541677db8d8a43a7028985a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c0e18020ee607c8729487709e0699f6

SHA1
af3341b099f136d9228cee518d212a0a00697416

SHA256
c43154e2c7c5e3d4460362a55778e487b0c977affe419a36b9fad59a88308d71

SHA512
c6fa29e654f5f483e8823f21478732376d2244e0c186cfa6ee794316df370b9040b67c53465827f4da9ee7f4dfe561e248e02ce48768fc44f28bee822e6bcd46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9d1aaa75f82db1e0340544da7300716

SHA1
055fe245333178a81b434e9eb8dc651ab8963b19

SHA256
855a53bb9448f91aa29ef32d2c40a9afbb43943aa568f48b6a3db5ace4eddc08

SHA512
c9ea4a809d18018ee66feec83a860bf9cc44198794bd87fc3c3404fda2b8b1efdab87e6a98e5676fe1800ca4a1feb3cd1b5d8d37560b72f14604225de3a58a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd7c55fcafd31488e282a5bf76253fba

SHA1
ede442a381cade5c6aa3b00034033cf842aaa94c

SHA256
2ca3de9d0518f8434fed16699d3a17982ec3ef77821231c1ec1191c96d2e14bc

SHA512
45f297ba537abee469ca6842e526956d3111f18e57b01a60cbefc0b8ca4819120676f5ed0759d4c6b9caca71b1a5411f0d53697ed971a30fbf4ca1926d638dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a2c6d127c130bc88da00652ca7fbaf7

SHA1
5c65804f40307e4f819db0b29590949946a53b10

SHA256
fb5a4af308a0b74271d47562b23a8674e207351d61d46a521957b7cdfb5901b1

SHA512
f39d66f91e9742654d2315d97645e670efcb7d6afd674977a6eafc86d308416f4b3254a0d4ae0977ce4bafd0fb59ff983ef821216cb03c0e0fbcfc6dde563f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b90327801243afc2d1736a2c4a4c82e

SHA1
9c6e37e47c66ea4eb41f0c5d0ef5cb367f9dcc02

SHA256
34cf1639005e6515efbbda9fbb809fef4f4c7e20bee857023d659604d5173abe

SHA512
681b84c3884fc609322f7dd9ca73e4b4c9edeaf1ef81d9918ad77f5f3ec0272fdf70a2c95b38e1b70bb6b983fbfbffd93dd900940b1e26986afa6194a76f12bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d8298fb5941363538c394e00d4eb061

SHA1
526d5b4d4bd231f704f201b613858293961c48bf

SHA256
89d72856c04bfebaf431fc919beb549664d9b5988ae99ddb23f0e3351bda1943

SHA512
50992dfc5c3a1c5bfaed1f6a5c6d6d3effe649ef57b6db1547beb13791bf1cda7d846f21c781d2a38ba60261993d29e50a0eec10dd926f9be59eac372ece3fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
306d21a711083080ff557a99977afe92

SHA1
f88ff092f4867b05b556271e2d2a72f99ecf507a

SHA256
7dc7f730c11455bffd250282107baeac5e528ab252a619382902350621e5cb82

SHA512
e495e9a1d6985bbb5eb0dd8a69e0e440310a08d9a30f4b686374774d732e803ddf81c9c904a3e2ccd8b0c179fea46bbe780f19115f8e946b90f1a6f421d0c319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8bcabd81325e57f702fb3cab24cacc05

SHA1
9c1ac0b726797e06bb355e2909443d6a3fcadb05

SHA256
681fac858fa39afc0e8ab0fa6dc42149a0a489c8015d5991026ce8b49fa169da

SHA512
302c3abe317c7590e5864a898a863dfe17ab54815cf014de312534ddf300a870fa1985817174fda5cc82afc81c09f0f9fed80b317e50db899b8987bf95d0aee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D07.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit