c34a5572ef214609295faead5dc0c96b13bb3989956ee9f823cdce550a3fe6e4

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0b8cf559ca0730d68a98cf3be6470c5e_JaffaCakes118.html
Size

21KB
MD5

0b8cf559ca0730d68a98cf3be6470c5e
SHA1

53c6d2c2d6c20279a120600a333fa53efb83579d
SHA256

c34a5572ef214609295faead5dc0c96b13bb3989956ee9f823cdce550a3fe6e4
SHA512

996d7176baf0ca463402d121758284516cd20e64eb8ea4ff20fb33a0bed9287bc227f8db18aa7658fb8c235724acca2858de93c16b1dd5d81599385db91024ac
SSDEEP

384:5tF9t2WAnkD01pR29lRVJJ3nDql6eIF0zLBXrPBprJ:d2H0lf3DqlvBXHt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5798B61-328A-11EF-B587-FED6C5E8D4AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606a668a97c6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000015d051c6db38ac62f81d1e85dc1e7a3065c69fb540399cdb8789c22e06707fc4000000000e80000000020000200000003987c8bcfa3c708705c498f3dea8435d94ba34cb3ecdd8f37370629d317fe0c020000000db2553fad4d10ae0223eafec53ad0d2e83b57489d152a08675a4e37bef151ee04000000063da3d4f79dae4442220af15df8df1024b3f30177a2704507f4f35691f127367be2a2281c8add1f09cc25e92303af9eb749f9a44df7d7b98ddacd58676d493d5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005c7b04b470994a265a202d3579c483af497de22da6d89897480fca9911c26689000000000e800000000200002000000069ef754cbe56414c69a0ec639b8462a718f3b19d15beebfb672ac946676cf1a0900000000749242a4103abc95294675abc0dbb2c41652516a8fdc7ca97c5d4475524e138e5aa5245c96efe94f76c86f8ad93284d31b36dd555091bccb05d54f80e00260b2b3a335a0eb7827d9cdde7ec8e3beb36f934f46dc5c560560889c58726920bc3bfc8ebfd2fb8e19f768609023c62bc49609d61bdd82a938fe0d2784a0ce7861f2e15895ed10dbe4dc3815c933bc30de2400000002221ed936b2d9c25bc4a19d97800752e27256ee14fd97a6efb266c6418ff26628410af8481c518b89f3e6e1a73649c557e45c0d1f46d36e4315fdd4c25517d84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425437548"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1240	iexplore.exe
1240	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2128	1240	iexplore.exe	28
PID 1240 wrote to memory of 2128	1240	iexplore.exe	28
PID 1240 wrote to memory of 2128	1240	iexplore.exe	28
PID 1240 wrote to memory of 2128	1240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b8cf559ca0730d68a98cf3be6470c5e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e74b6bbd26ec0b9d9beec83a4a21f776

SHA1
ffd04aaef64e80442257a771788dd4bdfd1b0c30

SHA256
be052c7d0f580ee33c2c08dd9f646c270051202a6eb96fec6cebd8a865e31451

SHA512
77038a629a2ad2ecc33ce054b29d86c9d0e1ebb59ce49bde965409e81272a3addfa7d97d8d1c681127e67b4fe827c38fdfce000cdb818d99c38ff513a407b58f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b8b6481d4e1916665e4d5142e2738ce

SHA1
f0dec858265cb01caebfebfd87b40b506636d025

SHA256
c2fa41927ee444f846f770ee0b9adea3c792d2cce2c7312fcab19200c2b36d12

SHA512
a1c040677ee63b63469a9e321b4b70d815880772c49e80869fda227277e2ea49fd77b8c385c4e097eef6d55b6126389bc32f98a42b208e2ee132da4d75cbdc16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd2dbb0891618f7a8ba7515138591a41

SHA1
2281bbc0a33ed07ff7ccfaa8996f64dee100723a

SHA256
7df097ce511487eb6985dea9ca213f2157a55ff3c5620014e00a900521c418a1

SHA512
207ba2b8d9ba109cce9fd012b00fc02738de27582c06a4c3a316c529fc441c71655ffa1e2105f433478fef67e16647774985f92332480ba8a93809f5f113c4a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cab0b833db04198255e766bcef684a1

SHA1
fd954753866a874c0dd520447efa1bcf314e67ed

SHA256
068db3c0cc80d708c67a964a3c421aaa7f4788d5995d1a797a12ccbcd8334328

SHA512
259787d1ce33cdcc5edf10b81fae04ecf830d014b3ab707f19cbfe331f7b8def0bdefd2e1ff79a370b518b51ab6ace8ad5f05be0acc6590a291ffe1b3c3e55ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa9dfbe8555c3590aa1f34608299a001

SHA1
93d69fe08c6f7d1f52903d3f3c90ec9ea97b881d

SHA256
242d58c5609fcac2785ecd01998ec809c68f0ba747460c03dec947375cc967ac

SHA512
ec573ed4bf4d80b9d0065d7c849fdf7c3d76cca8608cb181549d28d5854462f3a6d604c3ca122995e21c256543c573d21c552b5f0629ab0a529d8b10e0ac2901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b87e3982023ac5fd381e19734ba1df16

SHA1
d5adf4620f2a86a6fbe24b0b1ead447679e629b9

SHA256
1e48dc3daf9a26820dc82637006bc3054c0c190be068a2340bfd9e3ed8527774

SHA512
7c17632624c2402b4a1d88b1331d943c19b910e72ef2f1b4f2a1c44d4eb331cd3672b231c2a68673847ec36ddb36453018dc50204902f8e9dba4e61e466601af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
749c7da5fdf07e73de1328f7512e5430

SHA1
a48c4f8718d6fe696e56340af80c905704d0aeb9

SHA256
8b62bb0c276d47903253607d3a6168d74849615b2f18df748520e8f413e7b1f9

SHA512
0a4c614855a3591ad95f4d97350ac69ae2203c138763c56399d29365b22b1eb0d635ebff8efc8e991fd663fca2054d1fb51f3bbfa3c79699217984fdb4ed35e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf0bf23b46554026dad343a3c9861ebe

SHA1
21581e039d98015288ff0da59b87dbee03096afe

SHA256
aec916f8c898ded8a14789dc693514f9fe3b740c724753c7cb56c8ef2a0b198d

SHA512
4dd2310e350c13847db91525ead98d3355903546eca87e49f3fd42ecd4b68ba2f7c3c64b7da69d3eb556974081730c75ace6d0391954f92e68652179e2234e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28275739d999c42e5f2fa614f7791b5b

SHA1
350865b2a760e4a7a2868fe41524a3c492feaab8

SHA256
5e65df16b83d610b74654d7b5f18452f6e31e8a7550de7edf78132e277e33bcf

SHA512
65d763e4b97213bd2ac56a80a985e701aa5ce42c27c932b8600c98deef1141257eecda068174c85657d948b4961dcbe2f337d7811a3276e2e634d396db0dc113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02c8a813d73e85d0a6418acc5980115a

SHA1
633b45937908a651397f03f2d102147f1059e35f

SHA256
b0cd3b201a6ff8bc95157df33665cba882cfba6169f7350fab12d7e0d72524de

SHA512
cdf8f864f6ef4ffae14f71887ec247ebaf79ac6174d4569bfa3e35a8c476b231b1771451977b80466545756a89ade618a2dbceac6972eef47797c7ecaf72a1fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b5f5062f1acea1acb1a935b7aa1a338

SHA1
ab596d80903d510f9bca1865a36a3e04daf9ee05

SHA256
3b7bf6c687323e3c74d50ef7a2ea28371d9f8ca09c3258ec19fe1c1d21f13ab7

SHA512
1787e569ca76c61fd286836a17c02493b271af1dc647e7c611fa927cf80ed9f463ca061643b6ff68ae26f307b7d52900f5a5afcc70d5d65b531d1c7ab652db07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
252f73c92653c7e7d787d93251e53700

SHA1
9f85f3dcee436ed08e792da61dd13503ee250a82

SHA256
1720b97ef8e32ceb0cee517ec8ad7dcd8c1e89c14752f7a1015c046f44a45b40

SHA512
0d19fb00e586bc8509adc576354031f8298ff484571991bea6ef8057605c0268caadd61e09becba9325d8fdbde9fd44d562f61d6245e85edb83afd1f40139730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbd09258ce28ce07f1508766a16f0bb4

SHA1
6c8a483ed9edc323d8946fb7a8d15798a4454929

SHA256
08e319bb0c5ed4f18db6a5f80ccac4dc482797b1c9726f0a9b3145c0c8c36730

SHA512
9951fe42ee8f1376fc298730e13ec9d1a46fa050fc146ddbe55accdff4c4b8394e912bf8ab91be03929ed34a1aa76661a901246ab67c5b1aa6ea3021c879b3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
399463840e1ef2702e43c0a40dd10397

SHA1
1fb3403e91edaf85af7afdc7baf85c30ea62512c

SHA256
a2771b07163792cd6a71b2abedf5ee95a0b1302d066c2e117b9b40b1f95e4918

SHA512
ea3575dbe4049d68d544b6e0fd59a3f1df7564a227ab0c3ed63954cbf6474423d4f1eb941f65a43f0017628928801c30274aed42ae9202f28189c6a23585a2fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
769b5ca29d09cbe6a3c06e1577934234

SHA1
1760920baa29237e3178669a7661123219323c84

SHA256
8f388b365949d074b79f179392ccbe129a0dc7b5365af009129495f4ab182bec

SHA512
b464d203a69a27ef4afe6f34a96246b0390182eb83c9ef4e46480c231e097bf9823dab6c37b4d272aadfca6ac2cfee3a3600969963ec0b4ba4140b9f6564e915

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34BE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit