eaca78b67c00fe82bdac0a75ab99e227284271a03923fee757d88626dc352035

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4850659c138615c68d4fe3d36bf5795d_JaffaCakes118.html
Size

152KB
MD5

4850659c138615c68d4fe3d36bf5795d
SHA1

676c1251a2169dc915059cad898c105afeffbd7c
SHA256

eaca78b67c00fe82bdac0a75ab99e227284271a03923fee757d88626dc352035
SHA512

51fb45f3681ff8d47932cffed4c517fb68aca0becdf76a63b1597e64c504871d2ad049584aa63d957604af91a194abae38528bcc25d4a4bab1bcabd54cf855af
SSDEEP

3072:SNoFrtgReQyC2KhTohIRePKU1SdRK1GUOyfkMY+BES09JXAnyrZalI+YQ:SN+rtgReQyC2KhTohIRePKU1SdRK1nsC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002ec85da05404f8332c64204cdd92ccea4d386fcd7366a9b5699ad8001d544b4b000000000e80000000020000200000009703dc4f1f0215a96c84a9980689cb01b0bd54ada6de31d7734e265093f4349290000000988989db4e2f60ee811666fc1a50553c2e47bdda1e7863844dfab0b33deca4d9f2985325f848a49a154feb2ca8d0fa98d3bfc0e9dc112463d23e9d34f31f73e1bbe028a80c8e1406a5d3e336b21c7b83a8c4410d7fd60138b5ec65634351eb7f30f277d91639712d40b575dc2ffe35a9b85d2cd19842e0a4f18d101c256788bfece90638ba7fd72b56533e64ad9614814000000001fcc1dffd7ea2987d7ea89a478bc9216f55c1437ecd0996dfb903d3320858388874f01aabff2325fa30c57a41dd610f50a566fa1a09d623bc971a84a1d05b1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000095d961dc3ded2dc9bd9be54f66db515faecdc394a63ed1ed6b54fd8fb04bedb5000000000e800000000200002000000056caa71d9ca1879bf8bf97e48349e0f1a8dd9fa25499e8e21a0d10d8524cda3220000000070a68726be35dee6ccad287a2e8b13ade0be74e5b34eaada8f0f796248c18a8400000007d4657a1e921891557ebb9877a487195b2d77955b5e2c3828c30dd1d52e96e7ebc16417de6028da82314c4a535c4fce73d460154876524dd48dccaf68fea3697	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4270CC1-1309-11EF-BDA8-6EB0E89E4FD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a329fb16a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421973762"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2560	2932	iexplore.exe	28
PID 2932 wrote to memory of 2560	2932	iexplore.exe	28
PID 2932 wrote to memory of 2560	2932	iexplore.exe	28
PID 2932 wrote to memory of 2560	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4850659c138615c68d4fe3d36bf5795d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7722679854ca954cb6104e136d996f52

SHA1
a68ce56b83735d358b35e9908e989d9801088d6f

SHA256
6cdaf9766617b7a704ae7ed577645c3416be29687072eceaac2a63d7ea3d11f9

SHA512
54c7cc24c54ad55ac137e4175ed91332c48389d150efe8281db5eb0f92452ade4b367cf5cd98943f451437234c244be41d4e21c4be4e262e2ad97ece12d15cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f3da6221a82cd8146cfe03254e9c1bb

SHA1
d242e20ba448f1571367203abfc9ceb06e0425b1

SHA256
b51eb86dda9b8331c8d0d648dd5f929da2f694af5585e354ae23c08b2a5a2439

SHA512
7bcd371263a9274ce1fda6492f2c569c2a73e1ed6d6a3e5883af467cbf773a85360ae6cd240f6a6a8c70f95a103f3bb11d3107f59c3480e29472a2acb6f778ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06662fa6051830cd960ed0e1c5edd8db

SHA1
bf3f90d053f004c47f32b10e106262444a1eee57

SHA256
d692f5d1c7819bf2fb82cfa3c27ba642e35664d02656dde191f63c4d08399dbc

SHA512
d4c58f00a022189d496b85061bc51358cee4649038925765c610c690b7d2c519cc7ffaf71ec85c3630193a7214122dee57e53c00d7e5bcb271b88ecd21a381a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1179e02f230308c1984161dba27664d2

SHA1
522e4bfef07cc910bf13286997974ee928b1e6dd

SHA256
8aa94e879290e5ff8f84814c41a7e283d1a81496bec7b739e6068452e2317d51

SHA512
eba92ae72c63c52ac46b9998727474336a0cd72e84936ff8d315a9cf8cd33628286bdcf8158a31a436fa918077363d9ed906ae0d24591ce69ef7706fafb50ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
011711ffa3681334b207bdd6c8380c11

SHA1
9a8c3dbb85469a155dea03ac4cc240290994fe52

SHA256
2431d58d6ca406ae1ef15608e31bfa4b0e6fe28ed1ef8bc5b4cb21f30a033371

SHA512
81afb8a35ad74685c534da871e71e93446781ed88b6fd005204bbe9e4dce60aaf05948080bc2c0ce13381fd074e3bae18277106aaa69753dd1612c0e64e7aa97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fb1a90c220f476a75827c1e35580e57

SHA1
525a6bff065fc710b3457f1f1e3b671ede41854d

SHA256
674d8ddf5e54e8a859908568e5bd722bc060320dc7d02a6e216a1041f673f235

SHA512
63da867a540c63eac28d7ab9de43f8c5989f24d75b2778633cfda5b35c75c5951d2850922e0061dd6af9f9f1408e2a1671c4514f9af63061c964649a43dcb542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f95a12e522dc6a8a451973a07ca09107

SHA1
9991b1ec9554531a99eae4bafea1b5021188bccb

SHA256
486f856f4af5c320c73476e9de38d20c22d209678ff5198cff2d020612b00840

SHA512
3f51f26e92905988efa730094a280e5371fb821d38d71c9ffd085112cbcb533c84412862d3120b8e6749bcf9ef496dcfe482fd05f8e689f733baa5b53f324619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7141c8b7d1b467eb8cbf525745280450

SHA1
2e82be4672969f03ce69651652a0dfc8ae24231e

SHA256
7865d9208987b14fc203c0f5c2167f3a3838840233f8820a00716f535a5a2334

SHA512
5875bb495bc8af969f9835e73d0ca302576ac4461e9594a4e244cc3c0395915214d332b8ad81becb1b1c53f71b487c0f7e5a777dab0f9b909135003ab48d8a68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06fe868e797187d5b1b6131bf61149b8

SHA1
5ded80d607f93e549393ec906c1a06fe41365c52

SHA256
7116bf542ad7bc13d01433a93344fe8d9b0588202e572ddb6c48a75f92880333

SHA512
b27b0cb5ad09fd615d93a327220d7d6b5916d5c35ec5bdf15b30c0ac562f3f4f333af840e943f6d7c88da182fc590ee3ed1e756970c841406c9bf638e6ea0112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dd0c55a9346818148b0ff594cdd0424

SHA1
1b6d4846aabe9f36a1a67ded0807d5d2bebbc23b

SHA256
e743f68c9aa793211646b3e6af44c733c36550097b21675c349092ca29d7c7b4

SHA512
2a21fc770d781c4d7dc39eac1676e87b541c683e92ff900874311750f745af4fcf1eb2649a09240ffb422e638afed1d14b37a72efc65f7b6bd4026799755185b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae83b181a18ce9af01a318f75e2dd70b

SHA1
5cfb39edaab892e8bf0642e8aea40de912d4e8d3

SHA256
787f2aed26e73a42bfbfedaa89219b92c021d7a2c525fd4e25d2f8ac6058c84b

SHA512
20abf7d415ca2a949507ab018fe549d15f7d68c74861c2970dc22e840cff0f0e781b6bb17c8657ff7b32415b56db5d9a608531bc94ebf3354066d642b6fec95c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2acb9a1fccb870c482501aacbbd1f56c

SHA1
37a6b8d126f5158e0455a37e178d16f90d8536a6

SHA256
7d440d4f93b8442edba44fb37234fdf06c454ba5f84f2bddd57b8721f3e907eb

SHA512
5680320ec3bf2f40d18cfb0b0d897cf541d9d70f12a562d24c714ecb7735f4ce2f68cbc24a1abeada8affcae7943e328e8d18f857712aaaa54b647b9d688ba11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f702dcf439fbf0e7695f051bc6b1524

SHA1
c328a9028250681b8cb519904ae54843126f80e1

SHA256
b9fdb9ab20a81bbd7af25d646534fb815a662d1003a10f862b9ff1a19fb1b0c4

SHA512
d9e261231aa6166394c4640f40bc262879c7a37e3b4c6e931efe08c242a40554b8bbc1ec54a674da247eced6f63a8bd1b6d5de6bf9d6cb4cd6490eee1faa0416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e59740d89b4baad453b4f30bc1979a1

SHA1
909b5b3779a81fd9f6d128dc6e96170a9c5d465a

SHA256
27950daba4704d1423af79ef799473186d2df6ab055a46f7c09b9216f3043ef9

SHA512
265de474edd6c3a8f84491ea668fa6e4f9cfc3a9cfd41de284e99be4496b91bc8eb45c737934a81692f785dc60e48715328c4f50e986dc4c3365aee80d295d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18E0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar197F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit