d6f950cb8f4ce081473eef673a714d30591c867f4f7897a0926cfe248a126649

Analysis

max time kernel
143s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4bf8c2384688de06aff2949b34b54299_JaffaCakes118.html
Size

51KB
MD5

4bf8c2384688de06aff2949b34b54299
SHA1

6ceab9614ec645b525f5458dccea71e5f1e23303
SHA256

d6f950cb8f4ce081473eef673a714d30591c867f4f7897a0926cfe248a126649
SHA512

1fe3a8df13d38d7566a9ba48696a4aaac03492f1549cf6d44b61ffe6d042324adc3afb76cb1ceb1382be3d0b6fcc16e11de5c6ad280e9f24b78c833ce12ac2cf
SSDEEP

1536:SddfaYT//msnzNm9F18HRudesnzNm9F18HVAvMU/rivHHkqPaFuUGLCGM1UqHe0U:SddfaYT//msn4cudesn4UHHkqPaFuUyH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{651AE051-13A0-11EF-ADEA-C2931B856BB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422038375"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2664	1680	iexplore.exe	28
PID 1680 wrote to memory of 2664	1680	iexplore.exe	28
PID 1680 wrote to memory of 2664	1680	iexplore.exe	28
PID 1680 wrote to memory of 2664	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4bf8c2384688de06aff2949b34b54299_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
081daeaa297a55096b391200d5308145

SHA1
29a0b613af9704e79a689ab1aba3f004ff796ce8

SHA256
10cdbd429ed92f0970315b988bb6ba09d208d9d07911dc5c36136891076ff839

SHA512
23d775d0615cf6141ad94124d81b70cf92c72795ec14156be8e24483de20bc3902ac6c2661caa849388324f00ddb7b4acebc2bed378e7f9921ddc18eab81c304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe1868449c8a67869b194a493ba03cdc

SHA1
07a205e783a6020f277fc94faa9e3f6764e17c55

SHA256
b9847ceef678b6c312168da17a62e3b3acb830628f707538f5e63c0b6d8d1d14

SHA512
498fa6a548d2eec2719458e6b6547082b2dc0e4fbedd2ee4d418195f2c2172586087149ee2ed50d838e14d9acdf912c249c5ac34814c7e104092e84768a18401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04a065f027d1c7f6deb251849ff7f12b

SHA1
30e0361d5ef4b95650115f873be0e6ea4768550c

SHA256
e49080463c80bf2ff234bb5a78c5b1bacfe37758c5de588b17954b042b373903

SHA512
f240e6a4aef1a8645b99dfeab963ef5a5f0eafc3d5c24ed47188df73256e1aee5284c391c5ebb4e1ef0c82eb9cf7a600b791e947c5838af94f14db358d6c9d94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aa8451bbbd09bc9c65a78c318199927

SHA1
260c19b4da665a6aa2b3cfd0068e59b9eb8b0be8

SHA256
262ec337b2e3c1337f0fefca20ab111837f78363013734be896d49c0524e3742

SHA512
c25953c26a1cb9de2e7626615e4809cd13a5bbcadc556cdade06f989ec9d4699cdbfcabb1d6fb4103824ac5cf6dc8d50f66a5af196757844d6d0832607859028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
120a957fc6bd95b58152ca81763a97b5

SHA1
c990a213bda50203096a0dc48d3bd21b015d1555

SHA256
3e364faae21acb929740687e587eb32d4a398a6100826e309b183b6a0cf4b15b

SHA512
57e83b66e17844ae5a5cc119d015562df82581192e7fc4bcf53621168942d1f39ea0c7f954a6ec3e54346e6c17be38b73a7e124535df9480b4e4c0a801989789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a91b44ef3c5378330983032e04a65e39

SHA1
036024a0730a0d65737dd6d65848a90dae109679

SHA256
6da62a8810efbeb3b55fc21b20108280e68c005c3270a73f8d549f3d0b986583

SHA512
2f40575d6b2af84103b3673aa0b819fa3afbe9b91908c13176fd67b151f7310e6bf9202808ae1b8555be90fa3e0b245e015165cc93e3449b26e4f42be2f91857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74ff8128be71bcffac85f11a8b95454f

SHA1
7fd49a6d9e898ebd6a3a15482b31c90a6a0cdebb

SHA256
c960c6b8ab92ccd23266a2f7b1ad638de4ce3525f4136742600f6f5b86b151bc

SHA512
8f39c1127e5f6334b34f49c63561e742a12d917c03be07cde17a5f450927cf8dabbccf0646fe02e924ba35f79553bc734045ddd0508a253d459f8952ee5c34b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18499bca4b9f2d1a5fa3c955225b5280

SHA1
5fce6b35fca2edcbe04ab6d3c69cb2fe9fceed6e

SHA256
5c30264c5b0a45ac262b384f92bf43e10ba39fc4cc2574b11534c4b4b223a84d

SHA512
13e2106d012ebce20fe571eda51287d5b089314864941648ef69fa4530d7ec75dfee1907e0f2a858716962cd885cc1d4184154edb14f28fa350a9ceb3dc3282b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56b6115f581d16e51be14e5507fa6ea1

SHA1
e13b7c67ba0bc9aed07f57c2d4e52f331a6655e9

SHA256
12b2678661e4c1ec24b1fb342d08568df0ef89531157fd99ed71b06c8a1d4717

SHA512
f1eac62edb5f00495591a68787d8713fce9c1950f5e86a4d9db364f8e133f276235158c82840e9a04e9a6560dffc47243b73b350206939dedb124bfe49334730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc528495ddde5ebbe5d5660dccbaa74f

SHA1
36734bad5cf4df34ed908d67eca5c45cdd78f4e4

SHA256
c366238db7c895dcab56f29312c81123fa53b751e9ee3bea1abce09ef24c90f4

SHA512
52adc44dc29c03a873ef4db540665e5b8712a8fa1071513d0b57114fff928b9aabdec536991b6a2635a892ac7708b5d8c394d09ef49432e161e8954a322eb8bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec99a47c2d587995a5f1f540ca82c940

SHA1
647542e1e565223b8dd35595314344315a9df0e9

SHA256
7ec70cb8add5beda8a044bc65f9e4c5e3f07853e979f64291c124d1ba481b54f

SHA512
286fc2c5bd747fb6e4df9df5da372a73cb6ff3b71ee59a82a4f5a5fb5e0f1d37f9d9716d33a7d2c30aa29883032656f8b3cb5ae25200da56f1eac91879e16788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f65dca314e3aad97a30366d8836e8291

SHA1
c89d5bda22f35e18531a42ba3659a6fbed8e6cd8

SHA256
edfd5d5859d26d1e8187a30e35960e686aed5ef1e3feb30f20e8c4961b9458c0

SHA512
58c713756694091a7b86590c87efe3e99ceb610e74e33bc081eeaa30f76f3cbd3988db86913bdf0cebb0000a517d04ce42d4caaa60ede7c78578d596a6e896fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\WeiboShow[3].htm

Filesize
241B

MD5
f5ba896d004fc2ad25e2efb56b129b57

SHA1
f4f586a75c24d595aebac0d105fbf989b7f723fe

SHA256
5551cf9ff3d42d87dcd453c15951f650effe152236573faf7e3fa6813343bb7e

SHA512
7431e23775359b0a0d7cad2990b3890d14ff203a8113e404b0439ca9f5019021ed395b5f2c9e4b5ba59a398659578205bcb5c92ebd3f8629b70ab8d97f5713fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\WeiboShow[2].htm

Filesize
20B

MD5
7029066c27ac6f5ef18d660d5741979a

SHA1
46c6643f07aa7f6bfe7118de926b86defc5087c4

SHA256
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2

SHA512
7e8e93f4a89ce7fae011403e14a1d53544c6e6f6b6010d61129dc27937806d2b03802610d7999eab33a4c36b0f9e001d9d76001b8354087634c1aa9c740c536f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AD3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B05.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit