0848f7796a6048b8f9d4d78695baa88833ab994ce0ec9b8bd88df4d0f30344cb

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

759fcb57fa4d40ef2d28ca571841deeb_JaffaCakes118.html
Size

127KB
MD5

759fcb57fa4d40ef2d28ca571841deeb
SHA1

4e8269a10becef4dd4afeab17c73ae0053012d3b
SHA256

0848f7796a6048b8f9d4d78695baa88833ab994ce0ec9b8bd88df4d0f30344cb
SHA512

818549bcf4f746d3989895e7209010a3ed1383b76d0910d60ef163a4fcfd7665e4b9bcb79550540806b7d135050a8e94ebe6edad90e4b7289e687ec9e7b86918
SSDEEP

3072:C8PY/IpU5qk5gs9z+FANHqyExClts4MYDWPTIzb:4ts4yTIzb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{93018311-1B67-11EF-932B-4E2C21FEB07B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422893581"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1276	iexplore.exe
1276	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1940	1276	iexplore.exe	28
PID 1276 wrote to memory of 1940	1276	iexplore.exe	28
PID 1276 wrote to memory of 1940	1276	iexplore.exe	28
PID 1276 wrote to memory of 1940	1276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\759fcb57fa4d40ef2d28ca571841deeb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

Filesize
889B

MD5
3e455215095192e1b75d379fb187298a

SHA1
b1bc968bd4f49d622aa89a81f2150152a41d829c

SHA256
ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99

SHA512
54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ab25ac68a7745a46b562b8e010da6ffc

SHA1
e7514b10e3b7b2e5cfdea343e6a4dd1e1841a9be

SHA256
11e965d2be0a1370907a5ac3dba93e99f02c4b3cf0b05918989f82235de402cd

SHA512
732cf8bcd7cff0540bec27d95d2a6c329d99ba7a8484ce7e3403dd7940fb86451b6423fee6f7288c7e65f6df5b114715eebb594ac92c1e15e3f3dfbe9c5effd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
232645e3677824ca3c76eb80ac5bf5fe

SHA1
598ddaf629883b79abd560a6e2d0ea52e579c7ef

SHA256
973327fc084158c1ec8f46d845d6f6eb25593f0e3984ecaaa6e0e1b30dae1417

SHA512
70cf873e60aa6be87395106f8c63fecd48fb90c05014637d5f651884ec5ecf7cb35d998eb97b09ef4e3e6978dcfae6152a14ee93032b48bd50e9568fa3d19185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01c75539791614c2c7810936b82bbb3f

SHA1
be3790c28a34d5e14804e6183d23a27667453810

SHA256
b1594ee7051045d8c52640144311a21cb4f69bd4a8e0d8dc632ce8118d4c88c5

SHA512
92b38033c1d177416a958924a45c5f1d07a078bffe64f79255df62033a413681975a6003663168ae4ec5e901955e42f8541d80ae5486a0c151d5b7c160778302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e130958ded98e4247f3b6a445a98b1a6

SHA1
748de75c03029c4b91d56fd3aab82305d53f0e5b

SHA256
38d6eab1982550fc54b4a666fe855461603d887bfceb2a8fecb7b7c000f1bb26

SHA512
53aa07af26643cc067efb0d902f3a6af06d091ffd003e592e3956d65822870a6f584ea513b93bc0da6928487f1e32285d639eff1d382af258996af401876b1a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80a6029943ec38b33f678847de999f4d

SHA1
20b114c0f47846175eb808b8c7dc8d74e37ef423

SHA256
115a04c5787030d7f135e3bd061164c3cabe541f67150f187cc072ce388a646a

SHA512
48a6f391d6db0a7905221df6d403938ec0fed93c9c526dcdbe5cd46031816233dcb94cb026ac0dd5bc9f667783699c5b0c8fd5a82d4129b0ee47cca61949bdb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5975b91d8ab14730cc8a7436b5c600c1

SHA1
0c148068fa57c1b762b952381bca607347301dce

SHA256
40fea666395d69f0269a00f97123243a19b14acefb09c4922d208699a1fde188

SHA512
0280b5c95af32ca097b4ee82cf64bb69e5d8b6bd4efc3be45aef5a09ceea5806395a26f0df8a7c6ce7945777b0aa0e4df1df6a7f856140b7816ef47eee2a650c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbc0bb7b9cf176970c4c336fbbc105f8

SHA1
c47ceda439fd1fed9b0a4949428213f943232faa

SHA256
6e4c52b0db06b4c4b76cf195da38b364c5ca9fd8b9a658d7fbf217b709d4310a

SHA512
78717d4abade3611726b7c7c1084c24b1b404cd3ca1fd00211e1277f87b947d859caaa019624c0503d37beb9ff7d588f1ddd5151cee52922578fd27d544f0e98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc6ad5b4c3d20f20c7a45af36a4c4ac6

SHA1
9089341d7aa9ad9ff6a20f98d3eaa5eeda479f56

SHA256
4cdc8b6870da1588baca79c0e95c09293ac24a7d736ff011047cd110d90c1c3d

SHA512
b153f9f4bc45c0800d1fe4e107cf5e16511ec285f028539e7d1e77edc6915d51617d5cc9750ac516264255c7e0521de02cfd39a75fd9d3409bc40f3ae7d6a543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f24b7c92110dc2b9fdb49f9e67e381d

SHA1
fef9849b6d70e82b90d712effe27cc2a65c7e3cc

SHA256
50ad63da3916b27d45cc7ac1928d87e0a05602098844bfda0d50dcbc13566810

SHA512
fdc9825112ea9f9f0e2c9cbdc5f9c0ae1ee4e7ae7223b32ff06c60711bd7763b18a3fb471651fd97c006cf2a9fea147890c4ae41fd567a2716903bf9fa99b381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c86ef3b2fad7c00a468d1e8eb972db7c

SHA1
953d43c22221e5dc989d7b80d6aabb2670e6b1da

SHA256
688ba3b64f6c765df3e3fc8f34d648ae2f2a70df37544b6eb7bc4f98f4ef349d

SHA512
4247bc4f1a2e9b9d5473ae5561c066f0f5f8296142ba0f5c68336e6ef164f082ea29717cf6db616b9b083ee7f7b24fc38454e3eb3c20575169b7b4ac9ed8973b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
221d23ebebeeb75d8b3b004fd7e50e8f

SHA1
2143c5014faa870c6cc313db666182030ab0f35b

SHA256
d8787d5bf0df7b43b001d288bc858856123dea8d78decb85400d89278545e17d

SHA512
0803b155f611b5134b48a72e3d7ba6e21d268b26344655d7db4acb7ef662980c32a7761e3e012fa04c78bc9033ee95142a8892715ef2bd73a93d89200408e064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e92ec971136ef10b8a44e44d023210

SHA1
079e8360da891c005840f81262b9deebd8b4fe19

SHA256
7811c8e4f51676d626c4564022cc19905532c97a42daa257a1230cd294fa2c43

SHA512
5addf2001cc99420cb61dd7b39f593ea5234d2acc6fb7b4e76f176d9f7d1e29de1ef131d9082bc1b1a9700e4ff320c4eba7b80f8e51ddb2e67722b066fdc9e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
611fdb894a2b182cb33161f4f6e80853

SHA1
905d61592cb38d2e842144dae175e118ee8220a5

SHA256
da6b96b102718bea43d1d3e23418bb97875e9806e8cd43b5cc5de65f2f98b6b1

SHA512
4fe69f8ae43312e2608f5b046322041204ffda6c84420b6a55636ea08208d9617e6209f616f30c973482f7b33639ea845feb2c890ccf42d7cfad83571a3ae8c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
129d745fd8ebdd7e4d794433b3f5aab5

SHA1
00a6a6e219ae926042edd885e0ede8efad5ce96d

SHA256
1aa035eb14d609f3aef8e01d9a58ab8ba4ea8539950f677819c2d32d1e69b6cb

SHA512
d9d0f274fb6ec8e9f2586d969bf6933c2d30916e0d0034d2cf7105ec56f05a7cd57d60ac065daaba886c64e6a369eb088219fcdd76e56bc114ac9ef1053fdd3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
333ef9460252ec973032672136a9564a

SHA1
aac1f1c9830189fe7d8eb3626ce66ada5e97ea9b

SHA256
139f9ad678246e6c66c028bf64e19b3449579b6934e42e9f1eb76cb68378f04c

SHA512
a0b385c9178a6e2174f745310f1c8f0ea7a7ce99f0c0b788e12537dd215f58db84937e43e56a6573141eee63686819312d5895509c01d8fa86b64153a07ea45c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4b9366aa953d1a648f963585a3387579

SHA1
a7a60465e54f8fbd1d1bbb4ef82c9d4bb732b629

SHA256
336bda90000ca44cd1805d6b557abee8879503623fa1bfceabf4b93bd1e851ca

SHA512
515491887890237efc3fa763167df27f7a2b57701e505ac2a125efa8c7b5c7325000adc358b040c6c3a34be623ae96f7640d372f3bb2c092482e18bdbeab0a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1145.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit