5593b7ab41b62534c68605906998d5d716ffacb7794bede4cfc118dc9eed7a6e

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 21:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

76cdc30e3daf1b063f3bc60cf5cc74da_JaffaCakes118.html
Size

19KB
MD5

76cdc30e3daf1b063f3bc60cf5cc74da
SHA1

3b5f1826faaf3e557b920ad18d6261a857b02c6d
SHA256

5593b7ab41b62534c68605906998d5d716ffacb7794bede4cfc118dc9eed7a6e
SHA512

86ac321501125c06eb784fc5d12f57ac5394d451cf08adf49cc205135074941eb47207c7023fa00c95240ab7df58f7cf4b3609ec51de0eafb56e0e051734021a
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIE42zUnjBh6882qDB8:SIMd0I5nO9H/sv6PxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c11eadef27c59684979d55b2d23d70d586f5763e6143c5a737bff8cf849bb892000000000e8000000002000020000000406175c36f04918cb9d927fae7ace882d61f48c2dd535756d9a4fb5bc24141b120000000be9ac37308da4c849c3db5636f2ff7ee5d7c6b1b4f7ac82b9e07e1c2a91b91e74000000003ffed62a5cf1e2647c5b5e26563097209a166f937cb3011d2359152630883f79b6b4f8c9389d51aa2f55ee361301d48619807ca9352eb790d66940e2ab2b045	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c0b64eb2afda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CC7A1C1-1BA5-11EF-A585-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422920092"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d9b024342a425608bc0edcdb5c9f8cc644cd4bad428cdef61bad4593950af444000000000e8000000002000020000000712186e9ae77359d83a0307597ba08ca8b7455d6c8663096fa1602568a7b8c9990000000826ddaefeab95652ec376f26b8e55eeab93ab22afcdb9d9aab91ef4e45c5c72730eae73f8e8ab490493a25443f0527f0fe51935b271ddb447558e83c709645c7b2439148b2cbfe80f32779579d360aa61f85a63e64457c0b8f5ce29b463450d92d595069191be311c5373e2bb208730b5dcdc2131832b32c866ae8d99d14a204991bb498e39c8b5d97ad7b7838ecaade40000000217a89ea70df87847011b30c61fa075054c002b935002075a8d0a7405077c6709e398d7452642ba712479c916ee2c0e16b4814a250b1c519ad1853eaf3c15599	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2392	iexplore.exe
2392	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2568	2392	iexplore.exe	28
PID 2392 wrote to memory of 2568	2392	iexplore.exe	28
PID 2392 wrote to memory of 2568	2392	iexplore.exe	28
PID 2392 wrote to memory of 2568	2392	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76cdc30e3daf1b063f3bc60cf5cc74da_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f213db9706a76a88ac99650ed96b879

SHA1
7cbce4a37c207fd0b97a832d61b1e9b0819248fc

SHA256
41679e17a4125073489d2618ddff8056c8915d057ce3ea9f6b11cd09e9a75366

SHA512
1284ca968510d63dbfa98ed7babe531bab698c2b96fe355fb51929da9e77b19a77a5d804103c2e6b05dc5dc18b40991ca8440a6b37ef2978343b0cbc5d75b2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7774460900d880e334482f197d24c144

SHA1
71edcac9a96df51ffdd6dc789ddb5b924bc26f99

SHA256
4bc2b9125ac20d239cbbcbdc5fbb6bd3db99bc3bd8f9ae2497b669ce4cb69f37

SHA512
ea40b4381e6afdcd774451ce02949a032c45d52eaed865ae80ae80b7c61095c77a52adefe517cff156d649ed0e09d93efdc24b22b1cc239ea16c9bafc81f87ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc8f09b2c741da8c9d4f7e6f0584c348

SHA1
e11d586b0a847d271f5940c26e8191fd829f6e58

SHA256
fd4270e80857feb8675c3a2e9df3b1fcd0a107f23abc4ddb56ff3d1c91997c33

SHA512
afd756c0f398f9caf2de853f540c7377bbf3fc0f363dcdf246cd8f518d043039a0b810c7150287e8ff5d495f2cf83f8c052e6b18b7049d42470370c46ed08db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
067495c90ace280e3590b8a48f0b5ef9

SHA1
b8c41adecdaf491891cd6ad9c9b9e4f86d4928da

SHA256
47da6ea0795815a3580f70de65685e9bc01376ab89792e68ded2af13c896836e

SHA512
93fee8881d1cdcaf58537609d895cd3af1620a5bca233b22757680ce7da1ca85046139e17f9f4a17ed3faac231a93f4b46411fc29f6254b06baa02d50b72d531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ac8339b86f99b783629f407b20f57fe

SHA1
7c2a91482b002470bc76dad05e26a28be6d86fe2

SHA256
3a94a87eeb8ee02b5f96eea3c35dd0b9ac8821df5c5a9d96ea917eb710ee49f2

SHA512
be106c6927955aee4cc848cc14f71b735469bef4bd1f24f77e2d767e8eec1bf3dfb364ec5f2fd76f84b423016cee76db0c22dab225f906db10383efb563516b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b582925e9e9c0e642e8b2a2e9ee2f2f4

SHA1
9120cf75713d66c2d4ec7efd28cffd7eb761ae44

SHA256
f3cf91ea2045ff66021739619fe67f052384d29dab4bf7e12dfeb915eb0ae3b5

SHA512
58f56e4a122e02f19a808142d3ec7125716c4da51bc000c597578bb11328e2b4191d083d1295fb43c4a67a590694cca30fea3b6c8c0ba3741ce7d8cebfc45d34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4e9c5a339c7f849eb7c24a0e6024f3a

SHA1
751aebb0b03a9970b311152ecc932bdc4309e510

SHA256
596f65c96ab9849c3f8f1c1b57017f7fd2795f1d5ea3a339b276ae226896c97f

SHA512
a7386dc424386db85e02fd44d7f758a6d40f736ad370839505e2f6a71c1c9d0aeda26d3c3353f63be1c7b65a5e4473ee64e4beed8877003cd06fd30d305adc4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c52cfb6af3b85b9142d882a822621074

SHA1
860aefb167907dabd820c695964829f7122ae67d

SHA256
56f4261b49af2aca35417956d15b362affb4b639ebf296496256313195092485

SHA512
ac7c1e5104784abcb7788f7fd4e1e45e669c4419d5f146b51b8192c07a6922c03f30b709e471ed5446c80901b1e5eee7a7ac413919fb31e6996bcafd44b9f951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe72cedc06bc943e50bb1412aa9e4a9

SHA1
21774e5821126ba79b75a9cc57557f3233140143

SHA256
2f781fb3a13aa9b30f65e226178f53ad8de83a2d483d717e75a27a45bd758189

SHA512
7d51b55641172efc58ad827d5bf58393cdd1a2db6f18bf35390ae13704fbc8a0634e0c831843a6381f2bbe297dce7587ad7ca53b39e42d87658dd9e10207ca35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d91187e77bf660165737b0a87c457f41

SHA1
66372e1f69f8be6271ec6c62a8218b0e0b2237e7

SHA256
9a6a26a57a124ac12120fefcee530c36b1cf801f24c80e9f527f5631a9abc3a5

SHA512
148e9c8426fcdc11b23919594f32a56231f98725f0d21fbe83a4a474a61e008922bac56ddc4865a0aa074245cf8a6139dca192b8d6ae6a6577bb778af7b6f403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11969e5aa3b579ea1e64ae76f3ca2e1f

SHA1
287a1797b57348d0f7ffc52eaca2668896c7e5cc

SHA256
1c415386283d97de78f7a76369257f95bf40c3f70c7139337047bf3ca2ce0d4a

SHA512
cd1f667965bd13e3639230db6813fb7fd1adb4bd5fbb3a5f161de4512cce78faa9770784bae19a7c694026621b6701ce06378c632716bf44ca3191a157fdc5f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa2d60b8adc3d7d7a69fc909a84884d9

SHA1
2b5a5d21bd0ff35cb6680667d59648c218919bf7

SHA256
fdff847670d0d8f9ba32334e193f49e022f9054edb8c89bf50e1fafd25084b56

SHA512
d2268847ff140535defc544815b67e477197583e300503e53a48a465d422d0899be9b1bfde2f319cdb260677068f562aa1743d9fbe4b02e30f6e09812a2ea89e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ab1da4bea5e5ce3cca0cb12e2334a42

SHA1
3fbfa503b5227ba06f6c64d192a40b80b856d3a6

SHA256
233a146189417074d7042e72f284db7f68b28db74d1ed19fed5ec6d9c07c6a8e

SHA512
29bf33e6da077c743db7aac8291d148863deec793c6e0387884ce8836622d8fae61e70116ed9e3ed53613758f0ef4cafc5d16676819c12f5a6cf300e52cf4e39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e12c4e4adf4fdc83eb29114066a22586

SHA1
1f143e964bdf9e51b80343ba9d8ca26fa333504a

SHA256
055ad35f2e69ee7204d661c433b6a7ebc87b9dcf6ea5b8c6842dbe067c86eb5c

SHA512
c17021017bcad51ba442586c1d5050be85e8897cf7cdcaadde3a2e2415286a8e4a20a5a07a2cbade11ecec2ba1509fd13ea23a6f5368c319b367e4c15f0111ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFBC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFCE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit