78c4d8dd2534740bc434119a5c1ef48ff0dcfa6a671cb2703f63bfccb7f3ea9d

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

495183633d73ae76a9ca365b67c48f2a_JaffaCakes118.html
Size

28KB
MD5

495183633d73ae76a9ca365b67c48f2a
SHA1

d3fccee30aff25ed6bd6f19e9ba4662417c69a06
SHA256

78c4d8dd2534740bc434119a5c1ef48ff0dcfa6a671cb2703f63bfccb7f3ea9d
SHA512

a7b1c5b51b1d9925e58859ae973415dd0534a0bdb7034be8d62ace6ba294ddbbf85d63c8d0e1385f77f9cd9c7347e46a11bb7a9f9bcd646a95575c67ce2329eb
SSDEEP

192:uw4JLSTmVCkHb5nFV9qa1To8HpSiDv3/nQjxn5Q/P7nQiejuNnd2dvnQOkEntRHD:vQ/KtxessmkSTF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14AA1AA1-1337-11EF-8B56-EE69C2CE6029} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000044ac12fd2e6e91a8503a3bc8d65f318863d911bee08b473d319127e41e4b78ae000000000e800000000200002000000095cf739410e24ffc0d3457d5071fd2b6bbfc57c31743451208788fa34be8a456200000000a7b9c929972e9702276b40309baa05bd5fc744aa6a69d42ad2d954bc891f1394000000099a85653da4b1e3aa2125fea41dd75603acb7a9445cfae855e226014d304ca816426c077a48b369b27a473e9bc03c4b4dbaf8a7386eb7d813a4df8eff4521def	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000004fd7e603ac47509e05663e3fd72909ab4e459e3c51d654f391b04d102474c429000000000e80000000020000200000006ae007e6c8bb8483135f1dc8ccc36069d733305e4fe90e6c835571e58d81b44790000000d5643a0f9c2d884eca92de74a6cb906012395d021118e2763850bf743c706c8e16abafcae78115ed44576cb0ea4d3bda7ef5c93f002545f2a48fe96774eb7e8d5581d88923f840e350d5ef68f10161e6b046ca25c54961d0dc88f99cad02d22dc21aaf1c93e1a4eb731a2ab3a2698c3319717fd9c25d381b7796917f491ad9501afb64a6cdf2d22299f518b1099eb8794000000063cbec675d16a7f020cae07943433734d65a378b7bc34fe8300d50ab29a8ec9c106f64da2a0c77affdfe8c5dd43f546add4ad2091980f03fe2291d755824aaf8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421993144"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02696e943a7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2212	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2212	2184	iexplore.exe	28
PID 2184 wrote to memory of 2212	2184	iexplore.exe	28
PID 2184 wrote to memory of 2212	2184	iexplore.exe	28
PID 2184 wrote to memory of 2212	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\495183633d73ae76a9ca365b67c48f2a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
737d7e6514cb422d5e864bb964809458

SHA1
99abcbe8a2f32bd8ef909ee50a670bf07d33453a

SHA256
4c10071ce240d40b6cf98ecef9e5f2467bda3ee32f36743b571d4d9d6737a5be

SHA512
493b131e1cacb0435b6205eaf16992f55ef10309724b66540ecb7ef6f78fb2d851194d554b4b02504b246e5136fe453b94fb59cd614bb7f1a48dc66bd38158eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5e9deb3da80c406ebfa411e080dd4825

SHA1
4d93a41e7523d56c113dcbdc2b1a0d68651bb887

SHA256
0f05b61c1cb9bd57cccecd2f7c0882e5e6a512a1e085f08e2ff7a30045003def

SHA512
e3a42198a45261b2106e66a3f52527b7d5ae58b44f99b7212616e3f83b2079d183c13fe08cb5602cd4b076c81935f1a21fd929bf85d66d70c73291bf85485979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
35f831b7fd37e9e7872c05100c8f75a6

SHA1
61796fa14894546ac8b6c4d9ccb26e19812d6821

SHA256
c1dab51cbca8bd4e3e3677b4d3dd05de0928af668fdd3f4c57efdcb38703ecef

SHA512
f5f9d7ea34341ec89e34fc29202ec0b1e006e75abc55765b6280f1fe39b57df2fd96824349be822dc219c3708f9b753f92f6507933542a8a3b78b3fdc6a47053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ffac9813342a36382ca0ebbb253fc090

SHA1
c89a5375c0826443513e28fdfb8af30472654332

SHA256
52905bd2be26fa3e94a3d9880cb69427b35233f578f144e379ab4e9b68b68550

SHA512
2c0165668199ef88e9123e2b2d27159a2192dc9d4d2835ce3022839e6e455dfd6eac13cc60a0e344857b7c435248d4435308dbdcd8fedac397cad0810071878a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b7236a327f3b8eaa071950ab64d4c44f

SHA1
1227c8e9d012bdfb1944c5bd48ebf573d75b8358

SHA256
b8f5993542bb0f870c6d2624c12eef74c47bd3c4fe3ce4c78bfd7fdbd3a7c07d

SHA512
ef99f19188c69fe9b3989e6ae55ec95317957b2041ad0e5571405431a7c19ff2454765706592511c62f660b961e43927cfab089219e6b49d2f75b3e8a05555ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ee2f2054a4251b87ba1efe2dbba53c60

SHA1
666f92ebea82eaf48d693c63155f0b8bfbbfe437

SHA256
d52783eb2a3df23fada3146ee4e5bf0c997ddf44804c2326043fc7c356f05f41

SHA512
d2e5bd7c027df8d5c7d9928d12d401caefacb4804bd4882eb6b767b013b866c75a1f0ee38fb319a22d3b9678188cb588f810e1663eee6b3eff8f4e45af710d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1dd4e1eb0167906333ed027f533c30ff

SHA1
7fddcac29fd0740decebe405c4bf78adfd96672a

SHA256
11ca14ffc8bded891472c99c16dbfbabd4f0d72a455eae6b1ce68e2ff09f79e2

SHA512
789e8b7ed7c6f5a00db1a13a915fbb0270d3a5221aa3fcaaa17675a93e45f60ffb5ee2390e2ef69b1549c43aa753348a572bf9b33e9d465bcc937609617cc2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d64702dfb0e14fdff1af8e88377a3793

SHA1
2795cb2d32c5457ff7b05fdc7494bfcd6e0562c0

SHA256
7166990d2a317c40e93686e32d09bef8a0210b25a899000570cf3c43c1ec14b6

SHA512
82622505ca4f5712a3148ec68d98f74a994bb2358c31ba8695ba6e6fd61513c963bb695a5b0a1a8e59401abaf7df9be38d6fe6f5f39c7523d8e0c3f948d10c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
75d1c4aab838fa1353a99b63adffb9d6

SHA1
d64d50ff447116e40d68b271c560fe7685d8fc46

SHA256
078afb99f5b84f4b8e01c7fd816069d29f37c0b30945bf688cbb768d7ec7eb7c

SHA512
d01e8194d291a27c6f958e66dcb6de09c1ef3a93a4a2810e49bacadce72352854e99e0ee82ef3703445cc2584577edbf62c6ab1a43858886fc7c09c762d0b6bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0867666b079d203e6b566d11af3abce7

SHA1
65cba43abfb59a5b947b1458ea3ffe031542969f

SHA256
8d5fc67c9f8283ff042bf2bb10bd17e7d3bb0492c13b1e66eff8baeca386dacf

SHA512
b126cb497d81909ccca8174b645933c19291dc926ce7922bca81e9e925d290787e01b337bc9c46a33af7403328c4f43075c4c4c6d833c54187707f7c523c8527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
703e57f9b1a5a4d97e4f6d6e9257af1b

SHA1
086e7e78b2874b076788c8b73a21f5a88596c93c

SHA256
a3e6fcb33b8f26a133d93201e7829253c78baf7b8fb3e1c08b05f518ba9507c8

SHA512
64c9be67f19b208d6b80b741a029273adf59dc83ff40d00307c79c61cf76778e5803021647eecbdcda70f001a38cbb751f8af6aff9149f5539e53a75e596c3db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c27665275d92ae96e8dc46a6190f7379

SHA1
ea13f498e60c7aa05289056d63e12d582fe4d407

SHA256
ab0a0334748a4a425b43cdebaf327f63965f063d37b634daaf83c86f65a57f04

SHA512
a7805fa6aa22d5a576a606b347bd02d4eb6a1f8771927f959f179aad28cac72270a33406f044ae01bfafbd9d5a6a3ce788b83481342cace70dc8ea6265c52d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2704.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2891.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit