8a915f20648797ce2722a175b6cb424db7f3c78bb2582634c135340b0703a320

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

af5edde7efed661dedf175d8a3509e19_JaffaCakes118.html
Size

213KB
MD5

af5edde7efed661dedf175d8a3509e19
SHA1

aeebf459824371e97fdeb1d6e5e6ba9a7a893fbb
SHA256

8a915f20648797ce2722a175b6cb424db7f3c78bb2582634c135340b0703a320
SHA512

acf483c436b31845fcfd0ecdec1a47495749099f8f7d0c0643d8ee28d0e7652aafc5e6a1ac8a2a2e1cd6eb89871eabc92928ee26ebe87aeffbb4d5a67772c591
SSDEEP

3072:Sk/zfNXcdmqyfkMY+BES09JXAnyrZalI+YQ:SkpPPsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97EBAA81-2B35-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424631334"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af5edde7efed661dedf175d8a3509e19_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
926533f8ce0eb6972d94b895a7264fe7

SHA1
d4e31da939d267a27160d5ea32b0e60b46b98659

SHA256
c2adcfa2aaae2edb2ce386b70ed491897e6884f47c994195f5d028f7083c44db

SHA512
9fca7f0cb217926cbe097d261e293b7dff19a2d04fe4bc7f3724f5897112b01aaa32cdea937b0148e0b5abb051a760f5addba4eb5f8988338b73c25fe1d81021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dcb738b485ea5105779f2573f3b588e

SHA1
9974381baeb2eab773f69311a087f108f94be456

SHA256
7a430d4fb72089bdf0ea80baf6c24678df92f99497bb96dd1c11af92aca8022b

SHA512
71fea348c4ad692f074c5ba11d8cc2f12d754ad2c51135f1016bff179429c2dd514904616ce7b133654150329c568770a63e03757c4553dff67f496f70dd6e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f1a1234f2cad0b7296d01c2f2d5ad38

SHA1
d9a4a1fc496b313b5f67ded78c822e4a2a44bf25

SHA256
ecbd352a63fe0c4855d203ac70127eee2efad7ea51c24ab50d155253e97be1d1

SHA512
56c17087fc599c56d1eb78d3e32ab1725223e518386f667304ea4c71eafc3793543d216041b09b09d86f5a26c23e0392c8949b628c8ce90cc9da70858afcd63d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4fb90c2da921eaf3ca4eedd1afc4808

SHA1
490dfcd0b85cd64a214c8b577d055947e40dc639

SHA256
88e98ca15d072e3fa4ed267cc29f2d38726453b702424102d3f4aa7c9cb5030f

SHA512
563020802afe560314f052f1ca44eb61f7e0eccc69b391e3ad8009979dd6d0a1f9e7c9bf6ae55c07923d26b66a84a70a4965048b51f056ff0a777716ea3c9cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb55e9f37a94457dce8f21849947361b

SHA1
e47a8713f5b4ac9a6a4c86b98d57a78501933039

SHA256
79e1badd204d05883e2d27a3e7f2d1cf0f07179c0522220e290f5d9766faae22

SHA512
64e6fa71a9a4e9cf2237e9b0dae8714f6866f69de74ed75429ff819788f73a7628964faee626bf1f9de1f5dced724a4edfa7f6789af06f279aaa1e987344afe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2c25d8d68c875a55ca8d5a49b407123

SHA1
25680104b38eaae142017659c0f4802443bbdb27

SHA256
67a621b43e6c23de410d5b6053ce627da5c7c312ef3b5f15be9536ae9ce16036

SHA512
a777da2d46ce8670599f7051f5916a51cc624d6d94be3ea6b495fe3f3d4027e2df78a6a4354cc3405bcc0ac1e49e59b0e3e6da2ed421de82c1b5e85d74d1721b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62f31fc4b27b0ce8cd8ae7cec9f9ce9f

SHA1
65c5d9c9db683810e314fc45cf1f5fa6ac6fe522

SHA256
55bbf02887e6871b3fe7f4fc170967bf034768c88d03b5d81dc33ab83f65f047

SHA512
bd8b51fd0e032d50968aecf7727d37f0fe12aa56269e035757ffdf107fe9a89852445d32787c15e86c1a7d72293651cfcf3b8252a163e4fbc878819b3717849e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc4507576f686a54c1de513eaadea765

SHA1
0b3cf95fa9a9c7127d9692c6eaf651942079857e

SHA256
0fd087934b9bcf2f8903abacdf46c17b5c11cd6ff795496be82615d178170006

SHA512
e03ca0311805d24fd4280a49c147d6b3a1e6b324db800589e9cb71bf2c823abc081bbcdfddbea75709a7d928212210eea9b03f4b37dd520c51573420265c6482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0728093a59f572b6109dd21c3b7afc60

SHA1
9734824265a81ff7aed27e101cb786915da787b1

SHA256
c5f8c2d4679d3d57391337e8076df9dedacfd90754d9d202761e8dbc241f9ee5

SHA512
d1779ddb36b555af2d7b58e7d4c23bc7f62b3cb8ab1067078862cd38411eacbc155bb01a35ad9bd51570eea241785e8ace7f4b969dccec2d43c32d9fb631b155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff680e67ac15daaba4d94c0832b48ec8

SHA1
dd1902d0d4cf0aa46c297fd5d74e335cc11543a6

SHA256
829a43bf2e2b5bfe32300531f4562d6094fb928e4208f70d8e6e4f9de6655190

SHA512
99917016433530f230bd6dcfc5c2c08e3f3416f2c3d6d6547a9472760f5a12933c6d65b4d5e7867f7ef5105ca6a4ff230e21eb471209684c1e3888570504622e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf07a47799ab517348a440910210a5ed

SHA1
993edf8733cf07e8aa682e9b4d7c897eda50d00a

SHA256
31806b77c0128c84bd9496b1326840729671449b95e6b71832470b3b8b5c0649

SHA512
ae6883c2a7b2a77f30f2d76d065874f2e39d82fa8c0984eab8fc5302fa955986d21cd761252b535cbe0196b49fdc3bcd9f6cb0196f1c40f650b29908641d8f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49c8aeaa07308764a7eed4eb3dd7c79f

SHA1
b4b349291317aa12ee4859fc09a4067369c7b285

SHA256
8ebcd73a2a1cd5b50292ea2d2fcb17fd9d6f3584c81508bb31bf7f9d6f1b6e8a

SHA512
71961ad43600f12b131fb2916d65d4005cf1f90e95ed07947d1f0f50a60054ef773b2259aa51ba2d6407f6c1f9ca014c8423f42ad96b29333cafaff04f5bb6b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86ebb4b67caebe5fb803e67d5280dde5

SHA1
f032cdcfd9b2d75fda5d8a46cf5a51f174087a50

SHA256
db0fa99d513f77c9bb463f2404194900d7de6388749104ace55eb4ba85ad1271

SHA512
a33a32680b2807fccc7bb986c62607401e5223285865cd560591ae28fdaf767445e0f1172289ea7ae733f31ce4755b046f65eceb692a27b8dea8160926feb98d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5fcf0b0211fc2edb909b77ab83958c3

SHA1
973237c875c2544fe9f0f3e75267937c778e4cba

SHA256
b155da2c3a5278b9ed5e5a2915e7aaafd8712a0bceb69d877aff6ce8fc0b5826

SHA512
3b0365a7b1dd3cd14d934281c561298d89714205fd5526ba81690f2e9923d9827cd6ae91384b3a757d680ef60f3a6cabc7f8d375baf5107410f303befe6d35e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a97c82fa0ad9e82fd991af4e2b2a5a3f

SHA1
8b5ce94a5e283ea6a542ccd6d9294601c738d1d2

SHA256
bd0d3b9c6035228632b1f964535d2632cb6d6958bbad60fe15e7ed7128e3bafc

SHA512
bdcdf1573339674f6f29addf62445066f5bef94557e5c1fdd8533c96d18ef9c02a4fcd3edf170171e7660dde8194bd76f3841effebd53b7a525756a9a3d98eb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0274e1bdb66d3fc52a80ee202a8ccac

SHA1
f4b7f26ed6fc29030fa478b634739daa9e36e2f6

SHA256
cb881ffd0d60dc63c38090a4ff50da0c792867304070faa4afd94a022650f488

SHA512
e2e0ccf2498b8d809b3b91b785da0c01ac272aa713ad03e78e89af9c334721d69adc2120b5e82fef14baa2aa874ad4b3d9851c38e5c2c707b0b985e7094680d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72ebdc5d44d7f240d9a5ae799e893fcc

SHA1
59e25c233473be65fdf85c22af6130ee12667ce3

SHA256
b6b609993b759b0844c5e34ae41ac19a223b02f9444ab4e5acd384a94ef1b344

SHA512
e2a9dd83cf146adde5c99d16370a54c799ce67ec3303a49c5636bcef6af77d83fdbfc4165191c4d83a0339b0bf38ddcc09898adc904c585039c53e7aecd50247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
893a9c1044320ddb413aa56a870b827e

SHA1
6a1899cfd9a0ddc4663ccdb35c4f592405cc7d2b

SHA256
726bdf71e1ab7c8b31e17090963f5e8565efb4849dec21b624e5b99b8c928f28

SHA512
adefa1d1fb9393e5320d2a8e93653e98f73d3ed91893de3c2318e47e3aa61e73de7b11ccf65c2f74c0734620cdc87640322d78a942fafd5a876f798a82d34cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d714bcdae82a55fc50f554c7e7f46c97

SHA1
bdad1f1649b526d009f7c19cd133df2e16c3629f

SHA256
0c80a3b03e5eebda6f0c79c0abdcaf43915deda296e02d6cb10e06d7ba6af02d

SHA512
fcc58589a4ddc89c07fcb0729fc68f896caae3e1c75d8b12297fdf0eeb53b48708deebe3135618903fc7decfe3e87714c61bd73056d0b9a555777ac98dcd63b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F26.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2046.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit