938ec0e485b52a2c1dfa2f9338cdf463071e881196182d26d4f7bc2bad990dec

Analysis

max time kernel
137s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c2747d47616aca63222a395574cf7a5_JaffaCakes118.html
Size

52KB
MD5

6c2747d47616aca63222a395574cf7a5
SHA1

a29e72dcbe5f29aad544362297502d2b92e74f8f
SHA256

938ec0e485b52a2c1dfa2f9338cdf463071e881196182d26d4f7bc2bad990dec
SHA512

3c9228fb5c8e0e6d2d7dcf3a225854caed8c189ca59aa8a61b7586eb0ff6b1d4f0510e1207f5d835f2bc530a692fe12bb8e073c0151f262b93b0b32cbd3300e8
SSDEEP

1536:Sd2aYT//ysnzNm9F18Hk9snzNm9F18HVAvBUfZFQOr6AxHWdJKnhLTgcvKRn2+Qs:Sd2aYT//ysn4T9sn4g/6S2S9Rk1FH9Ec

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422657907"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9521591-1942-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2528	1760	iexplore.exe	28
PID 1760 wrote to memory of 2528	1760	iexplore.exe	28
PID 1760 wrote to memory of 2528	1760	iexplore.exe	28
PID 1760 wrote to memory of 2528	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c2747d47616aca63222a395574cf7a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c231fc7fb0c698407ba71401c9767aca

SHA1
34470353b6529f29364b64cbbdb2a55e9ae3b95b

SHA256
9a4503f5e8405f2ffa03edc9bb6ba7af7564ef0ca27106087adc0cc70afd2656

SHA512
f984ac84833b31cd4de1fea56c983efafd882bc6e33e7cfb5071d77b77458eb789a883816e4b1e707c0b4f4b6afda262f7418b80f165c0400eede03058ff7b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc46fada82544a1d3366a1826364b44

SHA1
707f072f9d1f44161b7beed9a3f2d12065fac863

SHA256
8d94156b60e9ea16b884b06ab187d832596f229d3e9a2e004ada77e8c47cc9b4

SHA512
74af0dc5fe43cfc6b9431715abdbd2f324b34584f79841bdda4946521c0c02b10f752913611026df1497fb87e8aa839d2978a895716f100024b486b172eb0b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
849d53cbcf4aa47d217250093f03de36

SHA1
d3e0d007ae5f3492236cd30a493e3be8cb8feae6

SHA256
c36ef07cfd78c30154ca2aaa545777434b9b00eec2d0e7c00d51482f7f0c7a64

SHA512
78f9ec0854bbe4c9c364c080945632a0011df1b8e22a1ad0537c352957eb0bbc822c15ec57fdf6e607cdfd5e7b22db8f1e588eff78468f8226129be1ea0016ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea9e8f59b6760a813c822790c401e517

SHA1
c8fda7c543487c49ec569c41d44c85f05877ab80

SHA256
08a74582d2c4d5f1d69fccb6ad4be32bebf54f5018de70bb9545c6a039cf2913

SHA512
22eca2896696ff5e5693f667a3e1178b36a0c799e896b74e5a5ef58a7e88aa7f293f624ae12e17b1c879cd47513197fde99526d9bc84a166fee35e224528f4f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c2cdea9b121ac0cba3841618de6070f

SHA1
8444d7c4f0eae312887f3c090b2c717a5058fe13

SHA256
7172c6a302d1f2dee1a9debd067ad6b51830cc91f2317597ac0332f17d16cfd9

SHA512
afac1364fe3206b7e7b3d1b64ff756bb94d26e4f8159a62b56a128598dc468836350f757c4a97003854c5c6c4c8f1a19ea1ae1e9a66c2c34a9f2dfabc12ff139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c836f386c0e95a1ed837b03eb326345

SHA1
a6a9f98a19582b1411a49591e82f4c0beaddabf8

SHA256
d2097fed5179d600c978d683f2a0bbd3d50ad6900bed3f67fb8dbdfa95810eaf

SHA512
9824d3a70eb438a4f9136f0684ad96091188df25577e54b4c735bc3d390356f7a0b568db28cc4e2e63285e1c3c6d19f09c57e4fbe1810f7276dbdd7bd221c6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5a8695c5f7550d1c077f5dbfbb20ddc

SHA1
8fe9c8c70d1db589af9183c5ff0d959bf270f72d

SHA256
e1356352f8ab8d5332dd5a8a6791010eae21f5fba4b8d619ca73521d82f403d0

SHA512
2c7f065cc3fbc02502bd73069452d26ac4c575f527bbd9780e5360f85f3a264709bf2fb987068c2b80cead9872455eac093ba5221b9037257cb1243e6c157dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2031acb3621fe187a7b7314c5941d50c

SHA1
442bbbc3d1685b0e144b3e353f42230967556392

SHA256
24f19be686f12fc619fd29d876ea88ac0968613123520951c737f4edc0421e38

SHA512
c1ebd953288a624ae93e9f616140e96e4ca3efb08906f91ce8a4fedeb0211c4812bbb2266cb0d174dba3dab40daec0ece6d404155a0e20db8ac78cf9be45ae6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
289411efe248a2d02ce6f9ddc1e7c346

SHA1
f7c2d2860cbfdfe78d2951298494be2d43e64e3e

SHA256
c86257cfe3e41fd6b3648e51f3f98296c289e33cdde6ad944916805d5d40aa7f

SHA512
e5ca4c46ea3d3849cbc317404b4aee3718d53fa43e495a7a401b35394bccb4d19eea00ff1775ca2d4d87141487394aab999c03821f73bae7543eaef5fac80a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b94ec68d52b31288d59b48f225e000d

SHA1
6bd7f04663f4c032648cc5c8ce27a049d424fb77

SHA256
13e458d1b9dbbf8712c20f140d8d7e7fb611801be2586907f6d050d9f7ca8c17

SHA512
38d9e9427094d421df3902ad49a8bdd1aaa3df0f38f2eb1e9c320993185f066c166789d5ef530a3e44487da59251b5d6b757d427fcc325904c6f0fff4814c87a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1348277495b65f56e1e2c200113b2f6c

SHA1
8b98eba23d9c012e14798b623dca4b2c16ab0789

SHA256
d40cdeff06fa2d66dc6f9318d3dd2c593191d0b63abca4f694c21e0f7cc220b1

SHA512
0a499d617b2d947069a9d452a3e9d0a81e28934253a23fe78c91c44c3cbea3d4fd18e99ff3f549a541fa875821da8b7bcf4366826909892c36cb52cd6ce6bffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\WeiboShow[3].htm

Filesize
241B

MD5
f5ba896d004fc2ad25e2efb56b129b57

SHA1
f4f586a75c24d595aebac0d105fbf989b7f723fe

SHA256
5551cf9ff3d42d87dcd453c15951f650effe152236573faf7e3fa6813343bb7e

SHA512
7431e23775359b0a0d7cad2990b3890d14ff203a8113e404b0439ca9f5019021ed395b5f2c9e4b5ba59a398659578205bcb5c92ebd3f8629b70ab8d97f5713fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\WeiboShow[3].htm

Filesize
20B

MD5
7029066c27ac6f5ef18d660d5741979a

SHA1
46c6643f07aa7f6bfe7118de926b86defc5087c4

SHA256
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2

SHA512
7e8e93f4a89ce7fae011403e14a1d53544c6e6f6b6010d61129dc27937806d2b03802610d7999eab33a4c36b0f9e001d9d76001b8354087634c1aa9c740c536f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7FEB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7FEC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81C6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit