97121a7153e84d5a30b9f43853a9bf2395fea87b730277f7804291f6950ccf0f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

23c82229607a1aef7ce33c1ebee410c3_JaffaCakes118.html
Size

78KB
MD5

23c82229607a1aef7ce33c1ebee410c3
SHA1

43a2a65ccacccb350bfeb1d1f7eb401d2f70599c
SHA256

97121a7153e84d5a30b9f43853a9bf2395fea87b730277f7804291f6950ccf0f
SHA512

e219aea37584f082f22d5579b6ddf2ef61a012855a74c5b6332f9b94dfefb33e52701bf82ff4c38c16ac02e7a6f333550e1ab0e64354c5dfb3810c848b3ba2ef
SSDEEP

768:Cvh7ye2sH/MXgyjCKocQwfuS/7GlIuKzNyGsaMWxS+unXmO:CvhybiXB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36B95721-3991-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426210000"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1636	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23c82229607a1aef7ce33c1ebee410c3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
db42f790f072782fef3c51cef1c648e0

SHA1
26d2264f6b7b4816e90468b1c12e720ecbbb15bb

SHA256
7347bed12f8a2631be709b783287b2428e231d0606ee5be0febc87aa6331bb88

SHA512
3d1c231820c831a99384050a81e8f3b2b8eb107defd9f9811c807ef879a8322c330d9b90e98a5fedb0d9911c71fb63c676d6f912a6f5d17294c9e0b9d21ee100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3522361f164fc27cb486fa71df7a16bf

SHA1
62a0092b5feaa67e952394a4e89f303c6998b97e

SHA256
56f6f095af6f0885c38e90638b7a04161115893ff2c9548454165ec6a78f4400

SHA512
1796b30d81eb99a2997aa6445dbc2f45b72b55e7c5f8c7c62e32d289ccab900098f6a65ec1dc8369aa42ef96216198b9248b352156bf2b56f8d4c2263b6813aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0006ca411b6df9f8574e35b58377d73

SHA1
f52b4121f27a6dc0a77e8ac008abb8b56d8339fd

SHA256
6fe4b3b05dc5e7ab578468c9c84a5bf2bcb6ec6882ef07909bec77433b6f903c

SHA512
66638ab7868cfdbf9c1c74e6df17ea374c12bed530d8aa75715e672db7fabb58178f970080cfdd0fe24aa6d6e7647cf59784a8e96660c638c35db052fab13acc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44bb8437f5aa954938acd512efd6daf4

SHA1
dc436b42b869d44aa461b877083b42ff60e757ea

SHA256
efa39d8dc747e5eed9a9858ac5cd3c11cc533ee7071a59eca573386e71fbf187

SHA512
0b04d24a90023310ffd3b52550041f666b24bd49edf4d997e27b622506ae85b8ddd373cc58ca202742cb74ae977322634e465ba7c2459356be432a0ac693c8b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94375df9d4123b157b88f33b290d05f8

SHA1
14cac4664534a2c487590f96088cf52c74da115a

SHA256
2eb7a3d886479e4ee98df6612c12188389cb037ff45ba8cbbe7f2651246f9df7

SHA512
6fb2e8c36aaa5a01323d767c324341dc2cc5d80a795cee47f23a77b766a27975f33d8097a33657335caff7c262ae043fe9e399cbadfcaeb377846f33b5006967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1096e5eb65a932a258fd0b9c04d50de

SHA1
4f65df9a04e99521a67dcb4d5e2f97618f92adad

SHA256
a7b76c948f4fa8cb2d8d99d51e8f94a0c00011d30ae4ee2d9ad044c64b4179d6

SHA512
ed382bf8175ce32e5a9fbe73ab575413a141a49412076feab1a5e3876dd4ab281b10a8e4ca5259ea0ed834d52397125c84e16657f10c38a151d3a0d2e31e713b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51665eb5402d80483437d350f4e0577e

SHA1
121130945cfa60b1577103fe8e11240ce636881c

SHA256
40ce01ed7679eb079ffa0c9525cd2d2147acc27d9676f6b9b5c06243becffe19

SHA512
70e6642ee2204ad3e4f949551b514d959124eab6b3b741c781f42bddfecdab91e032cc9be37a4981f2c177efd2733c6639202c7bdd171e3c541cae20803c04c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a76dd80f147b0bdfc1c3d3128b5b85f

SHA1
454136b8344cc88def44653d371f9fd51ed708a8

SHA256
1dc00b114be25ca7b3c4b491e71c8291a616a04ee5dc44a1091dae3b1d2c6451

SHA512
a78537bd9abf53deeef6dffc8e7b3a1872c96322e8bcc806624cfed15a89be5e5ae0651d0d6617392d49113ebf646f5682e532ec09f413b3ab6b4a30049eea74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc63e1d85546c02311cea94b135ab4e1

SHA1
d345b14fb5e6252d145916daa7e635f2c4fffeea

SHA256
baa8abfaed563c4754efdc931e52d8671804ae9a9b919e71348cbabd127dfe26

SHA512
ec5d17776572213d597dacc05d91ee9fc4f7a06c3b869f629f9d511f86f160172f0a6bdcd78959860310090c97fb7efbafe20f76434d84404b859b1b5922d80e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1268530f0c57e412bbfc6d2bff13045f

SHA1
fb56e19f5840a4ec977c4ffefa614d558a341540

SHA256
e90497e80b4ae2227a70b5f3c42690dfc85c225b2bcf16117a34ca8667aa9416

SHA512
5eb8540665460f532b521e485c415c0570990eb9355f61650402069ca52ef333749c60dc060be25959c8af706e1a05192fce2e99ecf31c47ceb5eea47570c79a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c38b4567e0f62fab205a917c1d5b1a

SHA1
d52e2b6daa97d340f40ff3d1f8fe6a584f3f29d6

SHA256
721cef4e06d0f28ec6373669633d6ff88a452ac76d598944bcc91e69c2410c03

SHA512
b2362a34c5b11d5a0f6e318c0613f36e8d6e19550af1bf3e166f4f3e5bb5010698ceba7b4302473ac83f5fcea8ab1271bb8544675be3d1aa477226b3d84fc2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4212a1bbecaaeb8714f0808876f7f935

SHA1
8eabab853795f065455351a9c802eb2f10bc5336

SHA256
1d3372323a198911a7d301839e31cd3f411cc8fd9456cd10807c4a604ec26b74

SHA512
aa5a60bb1a5b450ac6f40609564fb8f2e91f02059c689f0b55d8f11a5441dca01231a2d5e08b1aa72ac5cee11718687dfbfb31d6b19256ee505b1bbe1ea79244

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit