b959ddf3909da239aec4d033662331cc0ed29230494fe198e9100c5fd7965609

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a05000cfe32bd6cd8c4dca33af8419d6_JaffaCakes118.html
Size

47KB
MD5

a05000cfe32bd6cd8c4dca33af8419d6
SHA1

4c27e3d789433be67bd7aa1740ea0946902e2fcb
SHA256

b959ddf3909da239aec4d033662331cc0ed29230494fe198e9100c5fd7965609
SHA512

795b0a05fc9c32d68a2a3def7487552c7ce384fff9496f862160cc218e883df364a67e5d26f622608fbbc6289e19b10bbec14fc34739b3f0b7982dd1aa48812d
SSDEEP

768:Hi36MqA516vji6rpugghH3LtS+3ue/oNKNyJHKN+SYIe2whett81sBtfesrItBJ/:Hi36LA5AXrJghH3JS2P/7NyH6FYIe2wR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11FCD071-28A6-11EF-8554-DE288D05BF47} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424349788"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2260	1684	iexplore.exe	28
PID 1684 wrote to memory of 2260	1684	iexplore.exe	28
PID 1684 wrote to memory of 2260	1684	iexplore.exe	28
PID 1684 wrote to memory of 2260	1684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a05000cfe32bd6cd8c4dca33af8419d6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f675e6f77898c84c22a880e80099434f

SHA1
c732d7b932c8435122ff973aadb9eade47575c29

SHA256
348f72904bc447206d4f0cdd950376e14731663749315e187bed9fc161a3c029

SHA512
b1eaab14f5b996fe1dd068f32907375f07f6b79e308b38f72307aa1670de9a9e1fa02e6f1ad05c8a11ca0e3644a918f653c42051405030e1be8ced0721b3d326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5835c38fb6532d31f433ffe2eca92931

SHA1
9f583581d73371efa0b1ec68b1ec6ab087fabfb6

SHA256
0b499ee4b2a42c98ca0f74be46d7f646e682cf1455a7cab32ae0237501452a5a

SHA512
205e571d5aca66de250e39e98389f9468d476a6a8d1a4f8a4194ce9b865a45c8af0105dcacfce6c7a4bbd7182315db27d4457cb7b69fa57f65c33d29de8ea334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba5566ac673dbf0f5b30839b302bc5df

SHA1
c2ab0d3ced6e60ba3b797363624e806cad93e43e

SHA256
cdd3409a1c2f0d2abf64d609c147320fcda90ead4c491ca93d815dc863625421

SHA512
726c842c4f8cb171f433741825ee3474322a7ed46176c850099d4dfe86b76978ccd0959896bd46b1d721ee7290e5cac9f4a8ec761a2839db70e03c6f8ee4b209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dd947f93e8c10a22d725d5bbd248de4

SHA1
5d9255a4846d7e1d9c359c78474e1fb46d04cdc7

SHA256
bcbf9b2fddcd74826f4517d1ae61a675fed56b06d7653ac56e5637afa129660c

SHA512
1039746483445acfd3ce3473f5d47d5a371fd790838ef3def3aeab727ad7f5ea6701e310ad45f216539340f3d4f707002503d1fce1fd4008fcaafb9d8af382ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f16fff6e7200db5d46f45d0dcae8a856

SHA1
6475531f8574fc9bbe357a98b055cca8d750398f

SHA256
95e4c1252d6853597db9e4db45bedccaaa9e1fb30c1468a0ba3d76beceb20fa6

SHA512
a6a74ef727a187e41e74e6b7a4f0573c4c751688d06e9c228e018275f2d47cd3d1908e14bdb56dabc11465ce24d949d64cfe1a117296e874e1737e609dd14faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddbcb18105b3c0a93eb3731bb42ebce0

SHA1
1801a62b60787636dc24c44c6b0e0825d893bc92

SHA256
d1949c12f231a7077e0a864155a233e0455c756c7cf0f1c28215c008468ceb2c

SHA512
c371d567b2fec46b89d6a4862d13a7734e806c3f73f670ef0deca6288dcfec980a317f8b4c7c486405f21a0d4e5823531f7dc09979a90bb5cb31c7e742980613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eeca47da2ec7dec703f9354f6c3f5432

SHA1
fb367d86855adbc52c3949c4bbdc911bfe9c3323

SHA256
7dc77fc9724d0c3ce46851c61e830c8d4763382bdfe34d16e227f730fdb22958

SHA512
1423736fa7d6b3a53ba926c8b4c806a6450e5780dd3da85282f0a6a83c5f557a948865fa0a4e2518e8faece8e98869526f79865d3a6f47fc020eda739c279147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
510fe89355c64a8616b315cfa0ece30c

SHA1
cf98962719caeaf0274d25d5020c09bb4be2ee1e

SHA256
aef940302fa124c2356a3d132c2bd7af820b8402337d47001e66df029f3e7bec

SHA512
1f243669a7396959fc8bc77238069263fc06fb0f01c45c41b0d3b1276db0675ce81f63073cb7df5cd02dc62a38f0928d4a919912d1ae5a18f601ceeec0623bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f80831fc7cdb4f2b40a8802d5be4903e

SHA1
c343fd16d4d0ceb1ca7f53121be22704ca55c766

SHA256
cc059620e844d36a61006998155198f447ca1f3b1c8ee2b210853204e4b0e804

SHA512
5d4f888b37256f165694ad335eb547f7b5975b68a16e17d4b35f0c1b5ee3e2aae4590aa75631ee419380e480f7006e429c3edce4049677332fd8e3b41c748e25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bc5e6e1523c72ff8abcbce7cafb78c6

SHA1
816ce6a418af3473528774afb29d3235ac267f02

SHA256
d991f931322b8373aded9d0485cb688208b880c9fd6a901680ea6fa6f7fd95a5

SHA512
ef664fb9d84679e3553f24f462cf74ec5b254fad20facebe3a15b57758093bc9b5aa9dff3f90099856dc69b2137a3579f44b282e711933bc3c936ea70e5429cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cbdb28756f1e3d51e3b8c7fec7d5aac

SHA1
8efa4953e91140d1c0ec23735811b61d67333f57

SHA256
2fe833b3b1827adcf4f783d24ad000bacfc15af2d8629f361ce08da66aafe343

SHA512
097e3349914884331a5eadca05aa9a6ef5176640d9bfe0c9446da490b6385f4bc164634ade41bfa1962ebefc2226ba8ba009f0ae43d383f0ec7b7d1d6a515da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
180a02871061ed3ab8095ca0aac59465

SHA1
3cbfd99225f74010152aef97caa86757ef1b4021

SHA256
e32d2e47f75c93901005138c04419b36d600434156748416107a312c9aa5531a

SHA512
8b672aa1b2af7341394e95eb5a42b24deecdb8ee1eab4b5c9938ab699aed6c4acaef5b6fa4624fc7c8f8876526d107f7d7bc939f7013684e1a9f37d536318d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7d9063f5e73ba04ec42dc8f33eb9d09

SHA1
9bee62925ce9d1f4e0242a713e367aae8f3cd0c9

SHA256
01bc67b9b860d3f8c6476f4fb2a5e112746934cb3108b318315c5994f2325b78

SHA512
957064e76c40d4e193615b2fea0217a78d6622d5249faff8ae05ac63bdb23268ffde0d34d7392c5a9fb0e5a14d9a1d606d6c51d63e9cec857088f55534c837fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2084f9af1a6b686b1daa2c84191f54f3

SHA1
1af0d0c04be7c594809a480592d0e9dd805c4c59

SHA256
a73ec3e58632182db7081f883467bf34a5ac2b67177ea875d61044f26ad5e686

SHA512
e40ebc5268b1a36e3441328acb568e23a9a69cb072969fe97df8160bc41ae654b2dc98b272852ff745a7febe3182a2b90d72c7037f7fb88accdb0d3953df0692

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDEF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit