78bf20a4ce1b764fde39536e2b086fa9cc351504b8056b704613f4bbebdf97ee

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1fea3e5c47c17292246641a42fa0de2a_JaffaCakes118.html
Size

19KB
MD5

1fea3e5c47c17292246641a42fa0de2a
SHA1

1c263a65c38a46737bb0ac14c72122ac3813473c
SHA256

78bf20a4ce1b764fde39536e2b086fa9cc351504b8056b704613f4bbebdf97ee
SHA512

901738cb54961c5177af95b9dbc96c4778f9c30c240eb0844ab8085552f022dd5a69446c00a960b675f9528b9c5c7063f711d5484aa0f17976810c67ae204b2c
SSDEEP

384:rhJITEu118Sizn1yyLVyUm17yuy0yxxyMc5yUMqyW65OyXN3eq5:rhJITErSizn1y6ylyuy0yxxyryMy9OyZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80dd60eb51a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421229498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009ad49a9894972c11bab56d99145b73170b437e0136d10d04c89e57c407ed2e32000000000e8000000002000020000000b587b82752292e2ba3beef5e3391112667dab4de759fff74b03a3272e5082b7220000000705e6ec64c0b6f8abe2d79d1e558adbfdc02d59d1a5f0fecb07fa1d5d2f3e32940000000a580d9824319f8997cca55eed07be7831c094c3ed5ad526340557a7481ade680ae84600303b8a81082ba8cb5669c6e0516fcf005ca3d7a0b8131992015226dfc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000043d05f55c45511b3c7f8b4ae4ea52669c206cadc4866f396d82494110f6fa21a000000000e8000000002000020000000eb04aee57914efbadaa0ea81cb415bb31af2993316912a0c866340f9eb73fd48900000004c6c30b7afc4df2417bee804649bd8dddb48cd1045dd7489b0b58eb61ea312d5869b10cb06729606e7a8389367a45a24af9d0cf1889c16f42af1fee48c9829ac0d5b3725e46ea1e572f4bdc95ed4309e8d9ae34ed578ae35c718509dff4816b87a6d1625b2af9d02a3cff5b2858348b9efb4aeb3a33aa7a3267804af15ed56e30956259daf85c0f2db24ea9f954e9abf4000000087685d535d7460209db404ea154f24245ff4d56fd48fa2a92352578644f3ba5d866b5d9b3373f9c1f505cf700d353f28d5d430efda5547726fa6ed985e142342	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14D4ECB1-0C45-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2984	2300	iexplore.exe	28
PID 2300 wrote to memory of 2984	2300	iexplore.exe	28
PID 2300 wrote to memory of 2984	2300	iexplore.exe	28
PID 2300 wrote to memory of 2984	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fea3e5c47c17292246641a42fa0de2a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d8c6eb9eb3ec951cc1df1808ec8b44

SHA1
4c0643570e1e5a781b25a12ae03d05e552dfc9da

SHA256
78c8ba4b3b769e1b200f1f11fe4d23bd48fc5ac2fff07ebe6b1fd62bce92f911

SHA512
82cbe575905ecf0e04524bcf5ce7215b879e9ba189cb2ab95ef21f412825cfbeef329bc5e7684040a20f215548b0e490db81009ceae534b5f9d8c1295e37ab3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bb2217e49caeb30243e16439b5dc293

SHA1
02856c052cb3d26bfa012126d51a35723c02f47f

SHA256
30c2b1fcd30d53adfb80bb741b84f6a17a5da79c2a3212e860cc8cb012fcd32f

SHA512
5fa4000d33f21f6c193eb2f1f62b6b5832c6fc3a03d1fb4869ac2b49ff6e51720893ca30b1ca55dfc5aa29fb54815d9d28e005e9523d52cc15e1839f3b0d11d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce806d9c4996eca92b7ae7d6424496bb

SHA1
92d991bfa23d6ef3f517a70474065e1ad52037c8

SHA256
d2cfe18b294d3b93565c2f370140f0288a6880c4853725ec936f64b96620531d

SHA512
fa3a12ef52ab6583f1fb18f9713037b56e7fc66fd703220d4e9018ca4ec312528495fea2d9ad2e72b6a013f3e3f05de350a133922e8032cc42f096e33127131f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a9a57c82fe85730256396d7550f83bc

SHA1
96728b29b91f5a8eff1c6d6e1ca40c5fea64c1fc

SHA256
9e8d12d80b69574c68ad6c96abebee2de4abb854dc2739eb069fafaa1c7e2f58

SHA512
2bf562f7e25d9a889b7b826437580e588c11528f247ffc89b3e5349ca7fee50c36118073d8de5462616608fc01350b9529316e47be6907512ef72da77f673b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77f448c4e314cd3378cca36f5995289b

SHA1
feb5492071972a398f8e66539eac473f0b5fcecb

SHA256
9d04c678381d49c48f2b3e6fb659faf2c44a8d4d98b2cf3cd0698a9623d8ec76

SHA512
eb70fd22d692b92bf5d413b3f146b870452e1cbda5239d202350b1ce034a2ad3cf59a9d1f22d1aa3c8b832fcbbc46b9faf66cd5a6ceb49e7f2b18157e0d6efca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2bfde90b288de0c3d87869b48dd0164

SHA1
e8acb4b7256c149d2d5d390618f3e7aa6c4bc569

SHA256
035248267baae63224c111ee2bd40eeed65c812d067e59f300c830022b936573

SHA512
61444f707f4f198fa2d4c46369a227718a1592f48707816c7ccd42f98969ebfa1c51d4b05d2c193f164e7d2b617b19d3c31676e21b116aecf67108ce82c40098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c76ec6e22b0a127d5808e678812c6792

SHA1
32d8f2a37a56a164f54cfeb0137dc99b337dfb27

SHA256
a57b31006b9b83124a1628105158f29622f7eb691fd9ef8e936f5fd2a0b29487

SHA512
6abd28f5c97fc5c3ae1179e432685fb1b564e0d63515932a07ef3c2269450bd5f6ef7d2f8cf450f2552238c1d750fea19c43e8b18c4bb1b647c8077b0bfb2662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e633a918f35dbaafc924c6e20c218a2

SHA1
6283f61b4a6f17d94ca30e0f612e4b6d30e51654

SHA256
8c2284b2cceece479959200e3a78ee4f97b324cae3bb1cce5d6807b584926dca

SHA512
715a425393f1de1c8220b30dd6e054bf58865d6e0946c851125a2b236c00dd952e1bb754cd1b93dc9771bca2a3a41f665a6a4d3d43c17c752b0571b9b3debb6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e076aea61faee4b8ba0f307449bf62df

SHA1
3fe3055c991a47f8557ade62e9ab0bb69fc7ab34

SHA256
633a6c77753db720edba958b31fc8b82f9e8a31310bb99a036bf57042814250c

SHA512
44604c87450a5a863168385200f7fc2b73ab15fdee997197852fc4e675a7077decbc97ae49155fd32239b11198888cf14f7e6eeb806282779c6af94f8109fd58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00391f3dd15a55cc8c90978c8b9ef1cf

SHA1
fac6024975f0333701dfd95070d8b16613d09d5f

SHA256
a0984199f7a1b6f96ff8fa7f9ebf1a21be26617acd18de81faae630fc9a734f8

SHA512
f3e3b71c3a90f094f0627539e3db8b56cb1fa374340ffc36cff1d436d0393f63677d9d1ba2ac5b1e74ed9f37dc7c66db690cd31df825e06e4ec4c1bfba6f9a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b5e5aa02376251b25aad5e93911d042

SHA1
4a438192f57df6865956fd736363b90417c6918b

SHA256
1508b05ffa2d08a432ff634f22f7c2f3270c0094c8236be7f8ca3e0e96a46abf

SHA512
589af1facedfb4b6f7ffe6d42b97640972877cea044d4b185c2a31da97fd5e52c727bfd8b217769c0bc1cdd2ca55f79a68e0e41562a237ef7fe0204713af33e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4492f6c0f9c49ad8bc2a6523e3597247

SHA1
73f1fc184f90bf0b35b37b041416ff4a4fb6778c

SHA256
e712d3e5ab34163783c88cd83034390649abef6cd752fb9b669ccabb8cd4185a

SHA512
a363b5cd9019983c96cbfaa22ee12218ce965d93fd2d566ccc7850d81866938f5c263acc1ea7f8465c497e9c1e91107aede8818c3d9fd51a3e35f08501a5f790

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab371A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar378A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit