6e57ae0feebb149738501fabc2658c6eb8e2eb51b56b328e6d32dff59f33306e

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74aac2ec4f00af4a749770be10465d8e_JaffaCakes118.html
Size

461KB
MD5

74aac2ec4f00af4a749770be10465d8e
SHA1

ff0e30dacbd946f2cc125bf9c2eb62fdc8a9aba8
SHA256

6e57ae0feebb149738501fabc2658c6eb8e2eb51b56b328e6d32dff59f33306e
SHA512

8847806c4647d93b64035d20230fab1f2f2d2edb1651ade9008a197796fb16ab041f83b95b168eb4d640e07f59b05f58cedd6e18c5f026e1ab6d868fffc12121
SSDEEP

6144:SRsMYod+X3oI+YlQyQgsMYod+X3oI+YmsMYod+X3oI+YLsMYod+X3oI+YQ:e5d+X3B5d+X3m5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422868423"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000e114cb8926a36c74f5ead13bbe23c166d24e20b6e496a42d4f6e8cc9d5035bfa000000000e8000000002000020000000af99a280f58d15910dbf6051653a29af74f4c0b6f13cce05846bc2174d39850790000000c109bc98f4b056db2b98b5d5db9cde33bf31086afe8cd76c1ad6ec9608f3fc9fe5396962c29c2423c0f3b241101f5e5846e31e579dce27fe633ec7e0384000e8e7cf156f251c3575013c2da691baf4f887d369f04cff6d2b5dff7202e87f25b3b72adb47e93b6ba4eeb577de93d4ea518d875374ce40e91698fcfe905bd4bd89d9f84d3007be878cc1a6cb130baf0962400000000b9e23ff6b71b67ca038c443d7a93e9c6fd94af081f5cfcad6de299b7425a10e4ff0d7fc3c3e6855e25072fa5094b6623a0e56ab6f626c64f132d41c26dc5494	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{003CE5E1-1B2D-11EF-A48B-4635F953E0C8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008423caa30bbabf738cb170a09901d2eda8cb738e5f65cbec65df45cbce7fb3e4000000000e8000000002000020000000ae915fc715ed4c93bf1bb9ba017d34d8211740955bbb2cf4907bdc5ddc487f4e2000000074539d357a87ed4f8c456460b9139d6ff974d6d7ce935f4c543658fe066c75c2400000000458ece04c6200e73f31c99a31ef1fd6ca11aaca2d36175984c17c66c226e82e87cff7cf99f72b322437dc94ab5412144a12d818365a77cd1a0f901ba94ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7081c5d839afda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3016	2884	iexplore.exe	28
PID 2884 wrote to memory of 3016	2884	iexplore.exe	28
PID 2884 wrote to memory of 3016	2884	iexplore.exe	28
PID 2884 wrote to memory of 3016	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74aac2ec4f00af4a749770be10465d8e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d0e63816fae43d44b52cdb671842d5

SHA1
053d6fa581b15756b0209717def28c2e892883c6

SHA256
aecf1376410ec0f29265ab0603ec58089ecce3600c2bf97ef908aa9884d3bc77

SHA512
e611263383f0759ecc1fe36d8b498d36b6e13c3a4e31d45fb28c5f037050738734bf5497b574443558d886923bd28d7da510f831ce53ae7290a6b487fd49e114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b82983057a1c74b7b14f61f9412e73e

SHA1
3c65f6c2129e6782c2712c47b299d4a533a3f267

SHA256
a9373fb54f8c0f7e3f1f17835a4b33161eb434181532b23bece914875a9ae173

SHA512
5629f4be29e551df87ea1fee7ee93881bde95eb934432fd43fa8d9852e29baa16e3c7b047eccfb603bd34aadc2728abb8335fb14e2a67b351aea0dc79b9d6857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
791174f04ca7a89ebfe954961dae87ef

SHA1
67aaf058ba862147b4bdf0c2167e80d1d792e056

SHA256
a3b16438044489af12de1125d747129bf900d9555b8d6a9a246ffccc66615400

SHA512
325ab0691d4b012108d78d157677083628278c3390839e9fe3cefda327fd7caaf5caa21f5f630e3a013eddd534fb095f4e737b3f132f663a204bcc8ab0a4b1c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d87a13a07c05220630f961979afb5592

SHA1
1edbfee71ed302c36b51c5544093dd143d152dc3

SHA256
6c2c6cc8a2293d54e737558da1fe4c9568f69e3d9bb55214f0b56d5e67e95dc0

SHA512
8eccc3c706737e545ed0bbe3a464876ac361153115f5a8a9a17bc13aea28bb2104bc4aa51cf1d28bfca4009a485e2eae0449a0265232875e81609a4a25dc2601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7777d4669e37765732b81b0804922bd

SHA1
ac99d21358d54a11ff1da5a69f2039bbff18f1f5

SHA256
2673d8478d17bac0c209d6c67373bcd4ce5c537d41039ba21910f9bcae646f33

SHA512
c536841b2a1c03dec6bb298ec91bbc682bc6062c1b69c5bfff214aa0a55c2567733afaf1eb655448beb17977cb745ce3093583b4d87a1c5cd1f535bac6405305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5a4bcc0934030cc838b86c4ef36c761

SHA1
26378eef0140f4fd35308914ba70f9dfae127e5f

SHA256
65832d4b6a538ea2667cb3fc133b735060f8a58a68ab7f8c0f6e02a6646ca18e

SHA512
6c5f5b1cead36aa44e97368625bc10479af19ca6cbe91041ad52baccee34b29863fa5647d9fd8b817f63abb17c510fe06d55719d8b4af910ababcf7b3aac6695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
158cf6af9d874877c3a576566c5c4e19

SHA1
dda26f5853db062b689e1eccea26cc18765e3298

SHA256
b0f6ac9b1a01673deda77a1652c49b11afd8886139f21bc59906c32495fc84d4

SHA512
77c363e6afa14bb5f33b18f633104f06bc70664625ebac8803af5fb99b779ce66ce5f91002dcf56a7c84e4ae5c9d92905b45bdeeef6613f123ac599b72528730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
582d86d93b072a3afefaeaff20dbf02a

SHA1
94aa87be816c063c451bc9f2437188b3f077d5af

SHA256
a3c197ead253a71122976237988edaa3994289e03d7f061ce3b543aed3706a2c

SHA512
a6b97c48a0da192b2fb276b1694e5e0c80ed1f2a1748d9cf5611d4fdca9c388d600a4dbb3b93ffcc424868f0c237577832b5fc95183c3cf5610ec147efbc91ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ec4a4d616c2f9e5fe57513804547b22

SHA1
b602852387feb3d9146d68f09ee78cbf09b9fbfd

SHA256
0fa5f20150910e717855db518b6de8c63fdf6cfa72ff46032f62e490e8b66ad4

SHA512
d889fb55b2fe8e9aa2e71c8afd10faa7c6358b56c168f61f627be68b5d748198813aad2bc799bbd1b4472828fe35fbf3c8a4012aa8bc1d56eb0b8bc119241621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1ccdb403801dea71164b56dad628959

SHA1
55d77f4239d13f9819e15282ef90834179fb380e

SHA256
f3ca51060e40b512e520c99ea9d511a8f1741fd9b5632ab95209dee715dfd8dc

SHA512
d7490f47bbe368ec54d7dde5e57ff7a387bb9da9fef8cad4c61d33689b79c7a8106451860e4516d3916c9397aac65bb12d0a6693ff7ad60ac43dc5847e9757a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1c828feb4b03e5385c68f0dadc8028d

SHA1
04b202a75e394ce9504ef297e06708ac7f791692

SHA256
bee858aa46bfde410578128f799d66086bbc61d0fd4460045dcf62c0631ca519

SHA512
b2225562b0e6a6bc9105bdce8df967bb5a09d14c3d9088a438df70ab85f39d72527c08a67f0ea39e3b9729dba4491bcb1675b70175e18a570866a17ef4e17139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da7c0eab14ed4424322356b1f0c696a8

SHA1
b543da3c6a8e7f8d48e8fa034b1e387b625d0b9e

SHA256
42f32613ed549117c0cb64bc7cf9776c9a4085d5a161077b044cf8c3076ca5b1

SHA512
d5138227579f00a02ee54a983c32ea1c414e4d5d3c7523273f9e9f3576f09ebefaccc30e768a89f616f21ee0b2e879a11c35a9fa4d4486446111874095781fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66a9944df1a31c6c3b0bc5b85f29cdc1

SHA1
f8fa0f108a14515e1d1f5531bf5856e8cec4d509

SHA256
e0be1a945eef8f8c62a368c8ef26e561a9ca167b6da28c98024e14fa814f71b2

SHA512
9755b5a3e63debfc9e1040ff661f010b23d7233c9696a4ea7ad452c327f9075ca2625394f2baa1ba5d142b9053a16b7f40054a9475bbde92119f39052ff86ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab40AA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6464.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit