3ca8c077bcbce4b456bc6775d0b7d4b824d06aec4fae783cce725c5bcca874d5

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4caf8374b9e71f5c0a0f1054c7531c56_JaffaCakes118.html
Size

26KB
MD5

4caf8374b9e71f5c0a0f1054c7531c56
SHA1

01695911e370fb997384fa944b843ba505ddf79e
SHA256

3ca8c077bcbce4b456bc6775d0b7d4b824d06aec4fae783cce725c5bcca874d5
SHA512

4cc566f47aa1531712a5d317c06188d55b56a85daa077c0b5cc657fdcf796f0b5f7d12b8c98a7ad68674c1390662bbdd29aaa0e7d7c69aa9ffc9c180d976aca8
SSDEEP

768:8m3Qr3cKJpnQeROq1Ampf986Hydo3WOx7pghbyS1Nmdl5r08YIxJ2iuhWkF9JY9e:mJ+BEUOFC6Y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4D95891-13B9-11EF-AFF6-E61A8C993A67} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422049302"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	iexplore.exe
2696	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2136	2696	iexplore.exe	28
PID 2696 wrote to memory of 2136	2696	iexplore.exe	28
PID 2696 wrote to memory of 2136	2696	iexplore.exe	28
PID 2696 wrote to memory of 2136	2696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4caf8374b9e71f5c0a0f1054c7531c56_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7f8c1ee52a7ffc30c9753f6e3086bc8

SHA1
9777da4f886b0f4a76cfed1b8805d59a1c68f550

SHA256
f7a4107a32af7a06edf20392d30655244cf19e7dc5cc8e257d473be03e6779eb

SHA512
af9cdccaf9017548abfb7710126a69d1e0ddc0839ae1378006cb96bb086664a514a485cdb630259ee034b5e6e36a1606eb2a747f75c39d32fe1f035b3e9c0fe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1334989d6e24d8886387d4f60405a5ef

SHA1
1fae6eda47731301a056c471944b50809bbf830a

SHA256
44bede78810054547a4fc593cbd09fae2cc83b1d1cb9688d2ef6d99e1f5ed2be

SHA512
d06f5f8b442a835a2eaf0bfb279de84413185d589ac32348944c684d876afdd2abe85445616d7f1e65809b127503d9997cf263543eee2e9c406d7262c20630e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a44d3ad1d7808551f545ca6b8adbbee

SHA1
7307433d57513fd2301bb91b2a3e585a82d805dd

SHA256
2c33d0b1f27cb3eb9efcc5af835cbe66d6168171570123ed13c6d97192b66ad0

SHA512
b2a489adc12108ccfeac2f783899b11dac0f5e8a97932258a3576701bc5924659bb6259d49a4c174eade85588f687980cf4763647b7735f30d6258b5fb9f4c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e4c5282c7b6f51db35f3869b55ff0af

SHA1
da27fb8a0416d484e3134ca78cb9e8fd6d67bb88

SHA256
48f68bceece459477516967fa12f74e8d19be387baaf74b5935c431a43ebf84d

SHA512
c1e32a27997e734637a85f288e9d5a0ad70cc3a032cbf480eb09ef086ce66336746656afb570a3f32df77ab1bd405d31cd519b73ad371ec42f2942e10fa8c2ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cca7f11b7083101d85c4c8b3b9f0a564

SHA1
28cdac4d04477f4a11bb6c3996f581cb8075e46b

SHA256
21ada8f9761390240ce383cabafbc698bb084ac1412798a632f2864d4f0d7f7a

SHA512
f7099ca47874b64d984a0087187e6f7d9125e0cdab38a8d990bb032796884bdbfe46799f22a766356025ecf2f4969ef5e48ed4e47eb5052cf5889ab14ed7f35f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3264bb0f3da5d3fdd76a6a969242aaf

SHA1
20855ac1ee530a1b382155fde0723994cc70e8c8

SHA256
f11e7521000b5cec55780357d5f1987084a40a3ebaf9cdfc480133982fb2dcbc

SHA512
12dadf862d99d08f4d5007be25846e2b57aa752a7c0dbc7d57b0bb876fd517f1e65c0edb57735c5643fca5643eedfdbfd9939267f8416b2a2987a5f0c9cfe584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
719594bf9f33a15d03b9ef8712da59fb

SHA1
e21c2f195ec02335cb48cde3d7e39611dae9b4c3

SHA256
01df22b7075696fc9e41e8c6a5aef40fb7be99c9b1560c6e4892994c3d3724a7

SHA512
099f6f1d46a6624eadc8f3192f482996956c26e4e08ce3401e7c16553f7f8fb81498b03e296944e61c7b8d0aec4a6518d1647ec180b55a3c2057af52398bd405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37ba477e6f84265fed4db936684f1321

SHA1
3606f90112825f8d14ccc3b7b39e173a8c16bdd8

SHA256
8a5ffda21a29e48cf951048e30c7415cb91fa7c23901d548c113a05a0d730ba7

SHA512
c2c47efa5bb08cc03295742166e78668ff3be09e7adee4b4c11789ec8ee17f0acac89fc86590175b6452c3f70a0143a9d68e719d0e0f7cf68c9509bb8ccb14b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29d4427dd6396b3fcf4542c3143d28c2

SHA1
7688314212668093fabd09772054c996f9e96ddc

SHA256
2c2c04c289ba3c5a6a6eb406ba585de5ff7e616693b51286e90c19f68c844adb

SHA512
792c63fcd09ab7ae97ea16143fd90900f842378c48799a7c09f136de18de9ef352a0f9a5823032dedb27641b9256ffeca9ff3bb33e0defb6ac195267d91b1cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08d142bdee0977674f44b2eb60850df1

SHA1
55ea7609132ccd0b62653ee8a2a772d43b8cf1f0

SHA256
21f4b429000d2a1d395a34a1a86e23ddfa585b0fee45e905ba5f6baaa634a951

SHA512
11963c6b3f61afca3719560f3b3279a2bde557995251ae53f9e298e2c72f1eaeecc21f0f83fa5aa400118398c28e6df7e146edb11d5274997458eff00b7e1a4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06da59f2979aee5f1c48821324f6196b

SHA1
5dc48b7dd7d39172764274995f3bc536a2df27ab

SHA256
e9239051108f9b479d9a102693f447df5ba6fc1ca0ad924ca7e95258e26e0b34

SHA512
b16fc8337596a11634598d17b6b0b20e27055362e875648b1db00e72e26cdd8d5c6593df428306d58ea0eaa69b5c83cb080325c8616c35baaa3721f7e8cdb5a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b003d23913631ce4c83c45406c2ff4d6

SHA1
441ff33dc2ecaf637a2a950f3d2e12d1942a3909

SHA256
711fe292fc6b050003d779892dd08252178b43c9bc7b76529df06dc9a31d4b60

SHA512
91194251706ffa7af14f3fb2ccc7014b72ae43e666eb11eb4beaddb6b8e7039090ba8239a47ebe81d2dce45aca8e0d87edcc8cd40dc82bf737a4b67a458dae33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8344.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8436.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit