61f91d6ca1f9c517a6caaff97602d6e83d2f080c05ed32e0ba860087d3335118

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24d40d0e31dbe1e8f57ada1673068181_JaffaCakes118.html
Size

345KB
MD5

24d40d0e31dbe1e8f57ada1673068181
SHA1

fdf66d04c6bb8406bfdd64bc05076fb806988279
SHA256

61f91d6ca1f9c517a6caaff97602d6e83d2f080c05ed32e0ba860087d3335118
SHA512

5c09217f8be2514bd671ca9a951f630765953c61804e1c3bdef8d33f38473345cf2edaed20953ab216458b3f28fe484eb6f6cf5b22838e440b3ea50b74a2a41a
SSDEEP

6144:S2sMYod+X3oI+YYsMYod+X3oI+YtsMYod+X3oI+YQ:Z5d+X305d+X3n5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81B899C1-39C8-11EF-BC57-569FD5A164C1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426233749"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1132	iexplore.exe
1132	iexplore.exe
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1188	1132	iexplore.exe	28
PID 1132 wrote to memory of 1188	1132	iexplore.exe	28
PID 1132 wrote to memory of 1188	1132	iexplore.exe	28
PID 1132 wrote to memory of 1188	1132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24d40d0e31dbe1e8f57ada1673068181_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
961df3d45db68f8178ad89cb791f19a9

SHA1
931ac90b96ce5ed0b02dcc1590f8da97ac149f89

SHA256
7964b35b2a794ab12450f2f72441a8ace2a4042547cfd552d881e527dc86b3a1

SHA512
220a08f94bf0dbccf2298c4408ab3b843bff058f08b6826c80f139e7b06f2b643770f889b3013a3c7aecaa4fdc2b7faef825961e3f95c87ec6d40b060c0a67c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cecfc2e5fbf6d72ddc58864e00a9876

SHA1
bb76e1d0fcac8d7971cd15fdb7e0ba2de17e2099

SHA256
bcc20e417580b24b99978e2c8cafdb71f7c7b9aea87fb4e124d6e522a1d927de

SHA512
ab4740cd53d49ae14c5fbe50139184e4edeb31a0d48faa96b01dd8769e7c2a522a5b7dae956b9c5fda97597f093420c18b75be7ae294084d13b0e08f349caf29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d86fefc94fd44bfbfcd46a41b00230b6

SHA1
a577cbcf253014a3b19a12a9e82ec19a75a0326d

SHA256
4aaadd77d3cf272eeb1c1c79f998c9afe568bba53de8de37641cc61094b32445

SHA512
d19f641dd17788feaf418893865e484cd828662eb7090e1f2bf957e5e1d4a8ae70404e5c396edfdf6ddb6cb829a21fdd99f8929b2a310637a39c94c01b77dc09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91031348ce17bb13ed2e665220705b49

SHA1
be2d7d47241dca8fb61038e6fb683a4b4ab0573a

SHA256
43ea3a20dba69c8e4a5ae996b4627bfe03e0185deab0890266f70c495754997f

SHA512
9f1dcca27c53c120ef043409d31c715d460df5cb867c20cd76cd14471dfc2e5a7659fdd065eb900a3aec559ca11466a8c0434c5bea197a97b169d17c2026c8ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad1a1cd9ed015110ee65b0e21a2b83f5

SHA1
7ae0cef42d69f9a48ca6a1574800670f74a02611

SHA256
8522b7d6d1633b276d1863e55e2dd943a46833d5a5d04589850405a2b4e23419

SHA512
0b95bc5efc7e12d6213622f3ba2f86711087f2b4aea448f2e10b785334e4c34853a91017023278cf1c936cfcc14d84e2645a9d1538ec127277d7d4a248b289fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5262415f582d17d02bc1d69b90fd1559

SHA1
f79a6070c09bbcb904ba7fd7bbfe10ba23947050

SHA256
05a7ac28d97a44631a15d3bf1ee74ac82dd5f6558b3e56398237ef3851b85a00

SHA512
bc81f09a177b1f211c1aaa6f70cc9d60eb181666090a7c09a576012cf647d63977f0878fd0792c8984d06490e2ece25f91056eca0ac5e90bc51f3b9ad7bdf2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
488947bd67ba01ac0087b46d3bc86434

SHA1
7a08157cbf7de3fdde0266ed7a740da50676e1f4

SHA256
36c6fe3d5dfc7e57e809789ee5bd74147cbd4c7e90adec3a3fe46a2bbc76e858

SHA512
72ebd2b563a043a9141d3c4ce0ae65e646ab0771b636547a472e38b4c6a0c6591e6291b81debe4e5805efe0b3b3b8b624878c379ab31b46269c91add8af78c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27180b4919d4a44df6dc7156ea03f1b1

SHA1
615861ae0af151f5fc0bf31ce427ab254d1f5726

SHA256
05a3127bcca5af91c014e542cf2a1c945b6aa6b96f21c4eb580e6d4ad6f12a9e

SHA512
be82fd6b392ca42f973aa84f7189297bee8c2b6d786605983dc7379f82892546c41a3e18b86a0dea70b873210fa8b1588f48e56f2ddaa02afc6cf765c579c162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fa8f4a6f458d711703aea928337c57e

SHA1
46543388ef93dea35d207996359192739c935a22

SHA256
8d7ac213203dad2ee52a6c1e723448df439d97c76484c0c03d8fc691ffca2490

SHA512
4454401f3267a382221e482a224eef7052ec2fbc446ce3ac473a7537d2a316f03845182572460337cd49d78b5062e325bc13e92853011c6afd0ad415727770c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
547fcf22c7805879507487df2e16de00

SHA1
fed3a10ff84cb1b807c8776177dafd0033576e06

SHA256
6f33dbcdec44e28f4bf450bab51ca24a9d50b992e06a6ee86b49a8c49be40865

SHA512
2e7277ba2d1db8fc2ec69ab61bcbf81e0f602b3dbb46fe58adb8f81cbebc4a5a6e2f13404236a7f6b776bb027203de45d3f67567b2de65f18fc265e237e7f779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
57d82ce768ce0182e5b48394eaf9786f

SHA1
a678d3078382ae9971ad0ed1420e334853685645

SHA256
5575275b0935a24bd866870a797d07b3cde6e2331c2ebdfcf5dee7222727402b

SHA512
028007a49212b3e80aa156e6fc788f44ec1678cc03b3e82a90b6bd96e7e02f8f5950581470c5fb3528059c55072d6d1d7861f24d6e547bbe45e8fd0b15d86b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2221.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2233.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23CF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit