dd044f7f4ec83aed5477fe317a0dd2e8d54a8de9ef9a032c371b98bc26a3e8de

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ec5bdbcbef7961dace8f6c45d6a8927_JaffaCakes118.html
Size

139KB
MD5

3ec5bdbcbef7961dace8f6c45d6a8927
SHA1

93b85dc6e6d3e98f6f60486b1e842594f256b437
SHA256

dd044f7f4ec83aed5477fe317a0dd2e8d54a8de9ef9a032c371b98bc26a3e8de
SHA512

f8fd230dc56b56c3b474a66c11faacb252bb9e496099afbe93d4da75195f4d9e4eef72e79b9bd12b4f8a086a624714df0934bf4ea2fca9a4c404bc72a84f2df9
SSDEEP

1536:lOQf9iW0nF7W6XiNAsjzs9IRKzWLdvKK0MkfqWBRZiijE:B90nieqWEwE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421753892"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06A88FB1-110A-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1548	iexplore.exe
1548	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2560	1548	iexplore.exe	28
PID 1548 wrote to memory of 2560	1548	iexplore.exe	28
PID 1548 wrote to memory of 2560	1548	iexplore.exe	28
PID 1548 wrote to memory of 2560	1548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ec5bdbcbef7961dace8f6c45d6a8927_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8538458be4b355339fe95073cbdbbc80

SHA1
23703202a1f81635333a996c69855d3e2bf2886a

SHA256
b18a89a5a65ce57ff394ef7d42f27895bb5b40f63b8360b28626476306b49f0e

SHA512
b8ed8307fe94a1dae608cae77eb9754baf74d9b456f2f470edbff03267a889fddcd39614617d0b2efb17d3561cbe97188a13505080b2640693e698bff8f22341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73b4d04a0c6b68919b6af0033b3e84a9

SHA1
d0b9aef3ca23a38bf730661ef68a638eb44e3044

SHA256
0ac313432ff431956e57821c95e7096d17d0ac222c6c2acb0c203b2412e84b95

SHA512
bba81109fa0726b86af303174c587446a8238127e1f68e5723637b3fc50577c590826e0fae3c20a171ec2d6654772aba6c9b39059797037ac4c32dc7186dd8d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39231db87d5d6c925bd729f366ba8cdf

SHA1
d531950a1de9979be2dec5fe6f7adc6db5705fe7

SHA256
1a1a096106458152a7a61f941cfe47496722209ce3814387b14d9825749095f2

SHA512
b68b91ae4abd5155746491c7add5ab3836b3db744ae7e0e91ffdd62c7f4c56eea0c96acf28fa1f1d40b085bb18e602b07991dd54375bfea7d666d0cd26957ea2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f135c79d5613d7e5eb6fb4d615244051

SHA1
7f129724994fb42a5c7be7544a9554e4f6b7e037

SHA256
76ee94ddc0d57d0bf4b16792581e4352411034b840fa3880e81d9e77c7d5b1ad

SHA512
93537979f475828ce4e72f83681143e8116d9fbefbdcf74046853251af786e5ef31ca43169a8d5a248e57cebdd72d949e9e686f85893bccdc9393a65f9c8e471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d3041bee0c7b991ad4c393bbd559f51

SHA1
1fcbea8acb453bb72ec54ddbf3a477c9e5f914a8

SHA256
c2708edc878dbd59a343d9d78d030158263dc7d51a674b26b5ba4934d90c4ecb

SHA512
f57760edea48b39a5e894bd98fe70658e6d352be3b6f1617ec758f1068b79e730cf5d146be48d0d050f4f3b34f074ebc2aa2dbac7b8c6cc28864f97b3efc78b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b39707a0aac51723e174c9cecd65f3

SHA1
a1f251b1873b2dfe384e22d84b82b47f8df6d9b3

SHA256
0a762bfb722bf9dd74d067c16e9036f80575cc6fc193ebddb5454f18dc6aa29c

SHA512
bcc3c8dee9fb0c622a547846415e555de1783e8ad32b1a90c97bf4b78526eb14d668943a4f22ebf8fe2e95196a8a263af15716c125e02895791c7a44d4856e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc24411f1ce93c437fa4361ba6117a7f

SHA1
c36ceb7db10f3c57d24656b1fc7c354bec90340d

SHA256
ca27d307bb6174fcb07feec7fde0347c6c6e1f940e17d445fd4ba6a6965a5740

SHA512
a21e3f8a58f461d35a085320d5152e0634bb69865fd8e9731a2a6a5f1e3206d57c8c83f8ecba31cc015aaff0a818a28e20678d9266ae1489c200b086b39cfe69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c454fc4d80cec0f9f01aa575af4c59c

SHA1
92cad57302ee2911b01589cca19de6c4a627d478

SHA256
d5f541e4b8fb8d2eebc67d22228b413e328ebe75bab264b9e51e3a5510eb494e

SHA512
c702dbea56ed068d855815d1635458f9ba84721657f8b4b530a7ba55c3e3c5a2a95705b7ecb31ae94d714dafded3f9444888b0cf02b91992ce2de8c8426769bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
583d3ecee838bbeba2a5a09c3ad26b01

SHA1
b08fa8baa50d765fa58dbb8fb62239536e368c53

SHA256
f812f48fc2580133f43f99dcb99418cec5f5114f9452902f0276436d618c5d43

SHA512
75698fb0e370bc8f46bbcc3ffefcdcf20a74893708030f865c4a184a24c874366bccac046a84c6ebf9e99e8e85e53012400d26a6e537b2e35ba560886e1935e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99c340db982583093a192b8dd2570641

SHA1
2d37dd5fcc0d09b1903e239245081092516c8c69

SHA256
838ad10a90f0123de272d2471099ce2a90ba7b542946e0b0b34288231af508d8

SHA512
dd70f850042189fdff163a4022cd24e7446149a0b8b15c0d5383367d7f77d0fd1b11255f8413f1a7173f1f6e5c4fc3a8c5254c3262ca15a2e4c041839f4bdbee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc581fbf574b062697a396bef0bd6d64

SHA1
8434eab51f554bb6105df924b3e66b792e25c0c4

SHA256
437984bd11e2977cd197832ef15016e26e2252a43884ef5a5fc6b60443bdf761

SHA512
0afdabfd603ffff1c1fc502ab9f6ba7d1590980f3a23e2123526b8803e5ce9e29dd384bc529fc5f8f7a16e865a66cbfc1f79cc9a6f8a68b16419865c9718bad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b96ee309db20ebfb7a74b26068ffbf18

SHA1
1ef38049965e7049196966df577cc6a26a34946a

SHA256
7d406141b44efd8c23bd604aec50e8288b20499633a483691740085b6bb9a17c

SHA512
3db6ddf862e96b3afe9ff3598d359fb0ed40141ad472a73a7ffc3d9052b01ec19308b8a8f02332e10ab0d1c9fec04d5cff8c2a52738d45479be28315c402d87f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8ba4bd9fef93cbb64c62d9802d95a4b

SHA1
3bbe572008a823b421efc410e35df7ef6239b206

SHA256
3f6bc6c01ad340f06bd2ca75910ccf38f9da1ae1b57ccf076c87b7035774370c

SHA512
d811988fb01f6635aa7cb930586622f2e9d4fa780f0c60a98f5f2c4f25152da15054a43783f7345af96e6300e2bce0cd3ec97300f5675bc619157cbc6c195e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8c340937ac344569209a3fd4a54afa26

SHA1
68308b9b3346adec0de403dc2aaf93fd19fd01c6

SHA256
05f030cb4cb60e333cffc0d92dc1a2a7500b7a2876631f72cbebdeca986a7806

SHA512
8e34e86e62dd5a9f08d1e031ec122625513f7708724e2da77d135d6e54b285d28eccc0d2eb24f319ac4715bb9f4d72b90a1b1cded3fc5b109d4097077bc99f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\cb=gapi[1].js

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8009.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8169.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit