78117c603cac2336574b66e66df7808902f4223738d86d29d1039ceaff3fcbcd

Analysis

max time kernel
135s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cca7d1be3bc96e0070459f5f7879f40_JaffaCakes118.html
Size

346KB
MD5

4cca7d1be3bc96e0070459f5f7879f40
SHA1

bc12fb62ef5844e42867cc54180123745f89d569
SHA256

78117c603cac2336574b66e66df7808902f4223738d86d29d1039ceaff3fcbcd
SHA512

0085e1717d345fd41cffe40c8c9925a45e3dcd71303d884dcb767b4fb50a0774f30121b43cfd3c0a4fa9c9fc4fa0c4ed75d8d8fa16adbff3ed21ec73c8c8b47e
SSDEEP

6144:S0sMYod+X3oI+YRLsMYod+X3oI+Y/sMYod+X3oI+YQ:35d+X3X5d+X3d5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04d1e55cba7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422051308"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FC15F61-13BE-11EF-A692-6A83D32C515E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000db9ac3cb19786c93123a936148a42a42ea7a0ee8022c479767a565816d813a74000000000e8000000002000020000000cfb103b57a88e5d701f6a6d866c34f0cb64088266316d725acc242c81692956320000000a29e244d7748f014049e557ad470074d0f7efd81f5dfdf2c25031cbbacfb4c954000000018881b432ab69674ba1cb5eb4f2a49ecd5411fc3e7c510ee26be25094362c13322bb807e9f7f2d99513458f1b0433a4357f5ba29f7493a8ab496f784b0fe9659	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a304ee8f486e71797ca90255c5d78361d08ca94ed775167c0ad3c6d134e31e95000000000e800000000200002000000082dbea93a4ebdb43e2bda8f45a18ffd6ea8a4295ab1d518be1530c86aeeee806900000003bfb9c9eaecc5762f6f6beda842b17aaf89ce66ef9d85d976bac0d00444b24a55fca91e8b121d47eb4dccea1d89a1917ef5e1634a27c1f37a31944e4e7b18356b79f708ddfe09cb45996685007897719561268e31035faf2e0c15ea42ee127aea6fe6bd03a2bb02144091dd2491be4c39faa0a43236c219ba16d4f772141b3a2fd9de2e1b5a5296d61ed4283bbb4bd0d400000007e1bdc6f9e1d03ed3bb7ac978024a9b228be20f272e585dc6c47ba70040fab81c0f186b1c35de71e5e2f443998df4e2ece123e54fd575d6a8d253523317951d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2612	3024	iexplore.exe	28
PID 3024 wrote to memory of 2612	3024	iexplore.exe	28
PID 3024 wrote to memory of 2612	3024	iexplore.exe	28
PID 3024 wrote to memory of 2612	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4cca7d1be3bc96e0070459f5f7879f40_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2953228f4132b9f4dad35f3b17574aa1

SHA1
9a167fe0dfb7fb662396850d9a1d38ec48bb4c8f

SHA256
49b4573b282f894291287a03458d915368367063f2e4ab2fdb2c57efc926b9b9

SHA512
3c1854c06ec34d322ef82cfe772ee98fa4341f99958d3e1ca0c25701c6650024d9b5260d458c8f5a6f6de98f9a79831c5fb71512e04a6766647c91dbf02d0966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02fc98a579ecb0bc6d5dadb6bb69c2af

SHA1
2931f2ec35d2dfe33411d8972ff0be4427f30de7

SHA256
ac0560659eb0d40ab24d37f72d8696bc557b8a695e114dbc1d9c7a1ac788c4f0

SHA512
b3b345e1881a11ba05b7d45b06cd9f18320529c2e4337b9c892e6727fa8d51f152e9ea0f4f1f4762c5204c4417098182d9bc716808934cb786abd89dbb6b18d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
194bd99c832786bcb7bee8aa66779cb0

SHA1
34fb16faa28a4cdbf1fe6430c845672e277b3e20

SHA256
8d4d0c789b28f264d8dae2045c949572babc33f8fc96f1c26af1c55f40a9ae08

SHA512
099d4868618d3cf7e0aea2f4860fd5a6b82de8b0fe2fd3ccb4761990b3b3ac9fdb06bba312946807deaef015448e0e7b2a0933e5d197b21ecc1ae84f234f1ae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efe48ca4fb59762be796b2a1aeae7af3

SHA1
1827867dbd5809f4dfbd7df17652b4f9523a1e61

SHA256
639fbf288037fc3c69f010022d969543598859084342d84dcd0287ab8d0108e6

SHA512
0738f1a35ee69149520389efca30d80a81279b5ed8fd1eb2c15c36f592647e6919a65001db5a1ec55eaa4c958a32986339668b78453f49c405cc66eb3c2db68b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deb79bb09b2ae94d4ebbc051cf41f756

SHA1
454515023a4e7f160fe149ffc7c231b4ff145d6c

SHA256
c6ece51ba1f021c194951a61914291a9cdf0a685ff6ef241a8e2700160f5a7f6

SHA512
591ec01ae3d949a656f0c0493e6322d120063d28585f7e5c2eeccffcda0c6e32af1c4f591d9a6e3621a87472161e1b52d1e23072d3327921d5acde1c15365edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59411ba5a14b82fcb2f22ecabd8782a5

SHA1
8381d23417f567ccdf33ef7812c4306882e5c21c

SHA256
57273c7faaf72948ac9b28945e33a10eaf4a0b988e223aa0233a8ab6aae0f22c

SHA512
8ce0de74cdbf863df3bc0577e167d6007ea1c9a0cb3dbb63c94d2fa4dbfd4cd57cdfcf4f1b6ecaa4a5c67e68fa2bdeca425b88939459df05f30a4d7abfb78257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1298332fa6b0939918ec61345ec2581a

SHA1
de0fba12a99f8a88ee20a700da3920e2216fb63d

SHA256
43fbb80df1db9f75459956f754a8dffa121d3e3fcc060adb7bd0ce00852fe0bf

SHA512
6d81aa0afb6dca642233ff92a1418b5c59c193069bfa2bf8d5ebe859c527489d23b9b491029299867d10214a3621ad1a3a06c75b589308d4ca133eaecdb75596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a705bd36b0d0082bc0cb59b4e36084ae

SHA1
884b6200164d578f1d4f523f9232cf6638499b1c

SHA256
ca696cb19857ba2d08b2285459424cbcf015289a397c81948d821a3b1772e689

SHA512
3f6090062f6a66cfa4a1295b75a6a0026511a002583d6655f78f95f4a5787be87e5b8ccc57dbf12a1b2d2f950e946669d6bd55eba74359a39e9a2ca7b0261167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e697da6e0bfc855c481ba491dd453202

SHA1
5d522ea8facccd989a055347ace795f0c4d49ab5

SHA256
208dfeda3fb9dbb84a522be9a9561d27a867bb6326e211227009c27ecd325acc

SHA512
03efd6bba247132eee1b492516626fead4815df22b98537312fdcbb14c8affe70a162124b5d7255e0003234df24e8a829e63f41b00ce993ddd59c4de4df11f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
732a8e8ed86a7127e2f30de06493b380

SHA1
70f9f6e9051096554731293cb2112cce7df828a3

SHA256
4c0d55d2a1e9e6a6e86276d4a9f75d89d875d71d3c985272460b9f7edaad8d44

SHA512
93f1c653baf9acd335bde070da8a8d01d217fecc98df16f17013fda25caa0058cec7b349b2c04cefe4e3076bcf0adab5e653d9f3387aff4aaf9c0dff67fe4761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
699310017746816a832325580afaca21

SHA1
c4c3f8e0fdc7af74675f8c898ec3cde5f86456e4

SHA256
263e35f12ec4de3c4db71400f55e1e828477badac871083cfbbba0c1cbc98285

SHA512
073849ad5a1e51e97405e62d17aa7b9b3713e7b077003520c789e26a6f163334202fa19acafb92d884702b23ce02b7e38a892fa3a2502442858ad4d6a782b0b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32a983fdfdb1b112acc698c05535494e

SHA1
0b7b010c010ab9c9af3997f49bc5536162bd3883

SHA256
217c751ea303f164df570ce742d3568a4a4df27ff494775efadc7c2fd2de0214

SHA512
935e2a967985486c4e36c8bf8c6ee4aafc6addf6c7afb9b5cab0836ac4c3ae57b51884cf493dc877a82bfe72223d51008ea32efa019ad4010563c59239fce03d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
064b32c22ea0a159d2e06ef9f904f098

SHA1
39a6c8935d3da53c54867d8586beb7582d8196be

SHA256
631360aff65f07d6b649e6ad0fe003d9171e59c9c9731e09b8b76bed6cebbf4c

SHA512
a7e7ba15e3d2e7ec54c3a7d737b9994fab253fa08390a8fc12ee5836bf7d42fce8409a46d346027d1b1e6a10b62f339747ca777662be09d522abd9f385a936f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b6cbcadc4c9a0d5a67fd0f88ed9946a

SHA1
fd203ab67433ce5bbb1b5cce85ffd85b841b80e4

SHA256
9a8a08bc7dd13a91453d14625de13557fe6a386cf38122a811a1109af9d0c67d

SHA512
75079ba54e3ab44237a6848b590ac736994845f90210764aad60cd7b611317250f45e5ebb6466e50f32849d3df3ecd46351e986d0fd99f8b290b0c64296da5fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8402.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84F3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit