b62a3752e8d5eec13e984be16bc9c4c75a0a59e5c6c7cb76ecd50abd6d691628

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4284ec7b3a90aa043fa46ab2cbf56f4a_JaffaCakes118.html
Size

213KB
MD5

4284ec7b3a90aa043fa46ab2cbf56f4a
SHA1

d05585f9e936626e7671a92650a19dec96d15b22
SHA256

b62a3752e8d5eec13e984be16bc9c4c75a0a59e5c6c7cb76ecd50abd6d691628
SHA512

98de48b57eeaf0604447b4657338847b6d587e809ec45c5a756398b41767ce14e8ad143439e1841aaea81e6ad9128d09fe9ade619bfeadcdeea404dc5a138914
SSDEEP

3072:S6JeUJmqexMeyfkMY+BES09JXAnyrZalI+YQ:S6rmM7sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4B67891-1220-11EF-AE27-76C100907C10} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421873558"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2052	iexplore.exe
2052	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2480	2052	iexplore.exe	28
PID 2052 wrote to memory of 2480	2052	iexplore.exe	28
PID 2052 wrote to memory of 2480	2052	iexplore.exe	28
PID 2052 wrote to memory of 2480	2052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4284ec7b3a90aa043fa46ab2cbf56f4a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
743653012a60baddb49edada7a8ec5f2

SHA1
f59d7884a05b6bb72bd602a22133b38f1f28d20d

SHA256
141a5941c2960da63c0c442f58ebe61e41ba281cb047881134b9100f66200b07

SHA512
48ecb6d7ad21a588c90f39899cd429dec62f9aa6ab878b50212c2a3d0558d596d05a335adf44bdfcade78a83548be98a5c10702d16115c5e89e76c1abfa58066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85358d26aad30a143918ec7c30065a9b

SHA1
e38302bf916a109259bdf4e3876b3f719a4642e9

SHA256
54e4e3b4d17d858423974823b6799836f31894a74ef3f989f01baa834cdef775

SHA512
c99d055663aaaf69b8ddbf15f9e99315ca6d92a0d2f46c949d70860ff98a6285199ebde3ea717aa3ef0f90457609d5d220bca440c9cf2c49f288ce57c5039849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c26d89b66da019ad8bce74ccbb98c483

SHA1
b7de046875d511056e78b854ba1a77ec9d9b09d0

SHA256
8c440a696c0b1e64155c906af98d301fedf9172fc647685e6778c614b526f55d

SHA512
edfe9dbb5cc8703f7ead405381062a6ab60f656857b569a5e42d1b666c1f36795a54c32c64db3160d8ce44fb21cb07d3383ec5d9a4d55b28859a33deb3103dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
262db0a434144d83df77f0849019839d

SHA1
ffb6c8115a13e30849fef28255d0f29f7bc46855

SHA256
76d3469c67612263d571580a9686cb3379943690bc0b7fe1502e5a874ea6d842

SHA512
c69ff0051ed00d2123fa07121e23da412dcd41c2bd9fbb3c472977348bb8c975c5b7b152905a72e7e9e92d6c59da21f15cda9262b9d5d4c8b009ee12676f5fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16b66f2316584fe2591fc3638ee1407c

SHA1
82a8116d40c5b61297957e0a50eb710316dbb7d5

SHA256
b0726cc3cfd50ec855d3800cf54b2b258771607a6e9f2311fbd5dac8468596b3

SHA512
1d3cf99bd64efaa2c637a4d427f8abf5c8d96730e54301c96ef20dd7f45081f0d0294eddfa120063f189873124bfca022171e473b7f9b98bf8c4ff14c28fcda6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14a389747cdc795255cd0446bd33e1ed

SHA1
60c48b9f6dc04a3b477380c0e1e4b41cc705914b

SHA256
612796c8c8e5188e33014c914799da916a73c195b7fed43c4c126b756ceccd8e

SHA512
b2f82470c2d0859e67d6194a11b4f3dc82bf8ac1d58173d4a542a67c6258806ea4a47959a8783570626edccce036d029f9452d1bfea429e5bed461b1fe9b56ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed349d7269abe97a61b58d962a510964

SHA1
3d64d2e6ba4593ad8e446b0e7a14a437bfe7b5e1

SHA256
1743b086ed3972a14b50f8176e68ff16d41755087256d1bcb8ecddab53335742

SHA512
edbedabc97b45d767f9869e4ab19662852b1309f0b8f6223d4dec43e5883bc29f2e7db56e342bdf18539170bfe31fa50a3f15a151d85949790c474310852830f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c86c43113a21df9c38dd0c4c82d7f94

SHA1
fcd9a28bc6bbb243043007d8c74ac7a8578b7143

SHA256
3a84230de5620f69bcbe2eba41f66af1b1366fb2ccb03c22604747b72cc6f375

SHA512
163bd6d76b53276df5c2ed053d5f33f07063ff2aab518e8c16f1caca7f8de4019af715c1eb68e0900741d29e8dac695294a3cd0327b32f7f004d381710aa6f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fb7324664ed18fe66e7b1aacea73540

SHA1
ba2c88795276b8c04778af205ac01b212a4ffb6f

SHA256
809148b1accc2125b3b2598cbdd3fd9cc851cbfa9fc6cd6fc86b3a08de3a4f47

SHA512
04916154e57d7e6f318f48cbde5ba4b74938f2084069bbde247b2610bf69f44e3797878b56c99ade9fff6b4b8f4f803c3259439b3c1d981fef9ef504e36ab05a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c21dd3e3e3eda39f273d359d2fcbae7

SHA1
bd923ddd86718dadb30a0ad9d63f158528452419

SHA256
f9c1183a1a721085d582ff7a4ebf945a312e6b60084347191ab9ce6fc8f26493

SHA512
2796d00602d7606d844fabc9db5f19b594eb80ebd1ad7924f2f8604a56ef08dd7ce5120fe0a9b2aa529d4246ea74691aa4c649e05966dfe58b7e41074d57a6cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c547ee4ef5107a512a2439fcb6efa5a

SHA1
7bef0c34380e3f662d2729be1062668ff83d2ba8

SHA256
815b74f3df48490e950b3f4eaf37c54acb78d25b8086674214b2b40062c2af77

SHA512
5256cdb9372fa135e578340b1855d8375b1f9103fd26f0e54a40ba1d0150ec55aa9a8cf1b5074c18f9bb1d05d2f2d6f6aff1a596760a53fbe5cd1a1b38fd24e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcf06956121c0e554a0ff41e856c0461

SHA1
41e6be26a3389a6060bb836ddda20841412d2659

SHA256
849c658e9e0fb754cc0846701f9ed17eaf8551e06b520dcdafec9b4709fa6e74

SHA512
725aa1699fd51d2276b760ab63a150b46eee78404237d9bd77da6593641f8f0b2a6ac79274981b868b6c80633372eafcc034de018f460e722deddb9d44b32cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f35535a38222580693da6b10b1ff4111

SHA1
19706a5c9db9aad4c69d0061cc7d507d7aaeed58

SHA256
9c87001919902f4204eb5cdca9429f96b99317700907e98b36b9eafb66680d7d

SHA512
ac65699d447117f361b49d700eb27e494548d74de7c65d7766491db2fdae6565e35f69f1dc64b891289007244f88ef0da65f12cc8f0c3c866a175eac59395daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a6182d09e2517f43c0d24ba2993a530

SHA1
fb11835f098fcda72cb1f9d586dfb5ce37fb58be

SHA256
c6eabbcf1283bf0c1c76e07886fa27f364469d646b4e2ee1c5eb7fd38aef2f9d

SHA512
ec9d8d14fc781a4c8f33d0f257af0b827f2538bdbfa9f8ff953697b7b178d6e0f9a863997dcc4974872aa868feea07f16b255644cb16ad510c3e4fe92c4af8d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ee929a2d885c32b535d14389ef54bf6

SHA1
c0977a68d38d21df80698d7dc53f7dd11d554f62

SHA256
94ed2c3fdf9d8d777c642d1fa5f6bc9baa64173b7993e963af4fc87c02a956ef

SHA512
422f1afc0eec4fdaa7f6a6312569978fc89d2683899b2a3972e768068e3f827a01f8f66235f31f9e0647d5807f9f82b4ae4def17a67fd98c943395550a4fb5a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e0c76c7d410fb66a583ba7c66b46bcd

SHA1
986fac81e78d9584f1c1dba9c0da7fd31a009a57

SHA256
6651f1a7de61ed7fe3c02573312c5c4982c42e6f89878832a307ce2e1288ca23

SHA512
9d9460fcb982105964cdf0f03eb845c5761a8ab429f570d4cf2c1d6e2407dc0fd1258cf59491bde1c62ddfb99f0b85c73d575ce40491bd6499794a350d68d751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c269c332c7a8b8e95d8ecbdd67eed16

SHA1
aa67562c82a0d88a878475ca235282167bd439cd

SHA256
cc7ebd8e0047b3da13aa61230b39244820992d76aaa0f898900310f3fa1a4301

SHA512
5da7d42a2fe7ebb3d52cfc488c389ea6a1fa86e07b2bbab335d3b58180d7e3be90f867cd322a8e20cb3293e6853d853a3da0826b93aa15d2ab82bd091940523f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC42.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1856.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit