4397e0a64ebcc26bdd923ed6af537218a03c53887e25e05c8f4bce28042847a0

Analysis

max time kernel
95s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fde242381184ba446e7207ecfbb61494_JaffaCakes118.html
Size

44KB
MD5

fde242381184ba446e7207ecfbb61494
SHA1

96e190ea8c75bedd3aebe5aa255e4e6bd4ea247d
SHA256

4397e0a64ebcc26bdd923ed6af537218a03c53887e25e05c8f4bce28042847a0
SHA512

1c5afd1c1bd9a1106f4955bc60ae88755d7da5c78b01baf5dbd2edcc10c2f7069e3cc5c49aa3f785c164fb3b01f6241faede2d6729db044c069ea7276382abf6
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2oMB2Yuelg4dUAZaxHq/fUtqbAi5+tu/TYW5t5ujiEz:mZJt3ZelgF1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419817106"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FFE7951-FF6C-11EE-B5EE-F6E8909E8427} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2960	2088	iexplore.exe	28
PID 2088 wrote to memory of 2960	2088	iexplore.exe	28
PID 2088 wrote to memory of 2960	2088	iexplore.exe	28
PID 2088 wrote to memory of 2960	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fde242381184ba446e7207ecfbb61494_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
022f6050ba6fc43176d1d55dddc54f9d

SHA1
79fd5c0221e61115bbd2efe05234c7895cd30649

SHA256
13e6ef7957aa7b550b099905bddfd2e9e5a3ab42135fc60b7d8a4d6eeeaf0031

SHA512
1c9ad6f6b92a123a5243681ca4636bd47f98f18f57297f253d96d1bf76697f25adf67d501a6edb7f3789a8b71040f0e8512dd5fc91543b295b910bff036dce97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cf92bc7a6b1f8835739b8a7a8a5675e

SHA1
f85cb8cadc7e3aae06a4e48e7069db9d48941f67

SHA256
a6bcc7f8c221f5cdc33fd742c7dabbc59f41b548653ad0a765f0520c7a5747cf

SHA512
bf8a7c3cf91fdf086a5c0fd073820af5ad9cbf3d1b3d6dd1f865b2a94f7816b53ed2f216a3d7fb36865dc5401a0920768154f029a51f0c2679429ae3e8f7a26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fe0b3f5392b568d2d62062c384be7f3

SHA1
c3ff73001767664027acfec6ca5dca4522a541d8

SHA256
472176bfa930483ea1cf9f9b83449af70b2d5158a0285e3e0c4738d4afd21420

SHA512
b9fe6a684820db0bb92880f9df37a103331b88b4fe825ffcc4e18308ff72dbe7ad849f3632c4f6a41cb8526a7f2553d48eb566aa698fc73cb9f85dfc590d3b4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7409af1c4d457b77d8f6a01f67d944b9

SHA1
9633ea624108255b886c492b73b8666fb5265d5b

SHA256
2dff2d5e61cfaaec9a81f2b498af7cf428089c4accc28ec1050a18cd0ac689ef

SHA512
1721780e24117f28306284faf6f48da491c312021a3be080429f0c2eb5bbc555b264a64b74db128169df701b75bdf2ffdb8de69696e0abd4e40178568b4d91f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77d74839dc43ab302c3e1407769f17cc

SHA1
d24eb91087905fc0f9f773a064adbb39152a7cf8

SHA256
66eed8f9fe1f9146deecc19f3b441ca4db2076e0e88d031e806f7c7a440765d0

SHA512
6bcce71bf70bc7e7e2a1b15478a8d41c4f9af0b53f9dd100a1a6059c13c36fbd5c2f3a1f4a1c55feae4f53443deac7fcb95d69544c1aca25845d371a37c7b90a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52cb651824a0f79ba0ca1ee660641532

SHA1
9403db7f5747b023661bc0df5eaf53947ce22691

SHA256
a55be9a426e988164f116df8da63d8fe5ed5c1881a0d8c09885e313344333223

SHA512
7c081537f2bcbf45c991fbaa43b8bc5cc20dc41f65ffa343ff90d58aa91a565e9f107af157bdc69107d314d42c1bdfe33cbae2f251835f073f7616dcf1dd1e39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc1936a7c837e3b205c68c8fea1ba8fb

SHA1
1bd5e77a302604b5e2f60c3b698420b39f62160a

SHA256
6a44282529e4d864fbe3f741c9aef644e2ccb18103f09f9973582cecd1ecfc2d

SHA512
608347df29d87b00390a1e34f3423d30f9353ce015d7026a1177b331028a1d1c994e5f83c79bf645c863c87cdb9941aac88d11fb240965054b1a3e3aa4693ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
710b4f8cdce85a0a165e9c046092ade5

SHA1
53128f12500533f68ec34d73755f30f321b13327

SHA256
091f254fcd9325434dee955a16e221af1b291be4b9ce188cbb9952c4479888cb

SHA512
3a7e23693ecbbd91a8d2e2fb6774ade1f46af8692ceb5409098e352d4669805824c8978005766743ce5fd684e82cfb2a9942657eaaacd629cf93687c47c79b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa8c83495f778681b41fec9907633dc0

SHA1
dffe31db415de6575654fcf0361366186b331b0e

SHA256
99088a7e231379d1d6519475010d3db9c0913a8f78384c9e38b57eb745bb7cca

SHA512
ab3f77dcd484343312cdd2034cd733a25f8dd9af37dcc116f5c98ffa52e0addaba5590ca0331fa133523f2a4ee5db05471ead5b1d0847ee6a1b63edfd8064aad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67bc6fd53e6265afb9fade31b8a86f68

SHA1
e099f292a21c877640087062c2c642bbe566f7be

SHA256
d03951d1715604b448d4f5b0309ab054b6acd3934760121a5b018f1f11e28016

SHA512
be36d436aae4ef362ba62729782d1114f76dd649418496b917dedc901f206bdb0cb7322eef95f07630ff6a3afbda17096b7ad6fee050d855293af30ffae74059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f354c51ac51fe02913ef33a58d33f201

SHA1
30cc94b52b52d932ff6bbba0fc1785792a36a3de

SHA256
6ea49e4ae70e850aff66f20e9ca7535f0ec2fddf36dc30784a1b1f46ae440cee

SHA512
3bc0e9652190a209237bb2ea5880154094bb2758c7dce39daf72b7926d67efe1c41e881cb91f3f0f869433a3db6af19ac3bc267bed1e8d7ff4ebe3abadf92346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar125D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit