8af3c95bea5dc06ce5e6dbf67a8b2d4499ab946aa50101c710490e580efeac2f

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ad60fc0d16958f04bc2ffc5e89ff10c_JaffaCakes118.html
Size

23KB
MD5

7ad60fc0d16958f04bc2ffc5e89ff10c
SHA1

d2867d8a32fba0ee290bca55982e2f977136420d
SHA256

8af3c95bea5dc06ce5e6dbf67a8b2d4499ab946aa50101c710490e580efeac2f
SHA512

f59246fa61b631b86b7e3f7f13cd371299a5a289eadece994a239fa134e72e19bfe3f74570095528b1be95931769e5e788f6ba80fc53f8f49a57b22b2f85eb46
SSDEEP

192:uwHEb5nmGnQjxn5Q/dnQiewNnEnQOkEntbTnQTbnxnQHGLnLnQteqMBQqnYnQ7tR:rQ/8G3aQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DD946A1-1C7C-11EF-A538-5630532AF2EE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423012542"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2712	2164	iexplore.exe	28
PID 2164 wrote to memory of 2712	2164	iexplore.exe	28
PID 2164 wrote to memory of 2712	2164	iexplore.exe	28
PID 2164 wrote to memory of 2712	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ad60fc0d16958f04bc2ffc5e89ff10c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53704bc5f34f89949c6ea421a8413739

SHA1
0c9d7d2db71e946aa84db7c962f40fb004ed3af0

SHA256
3cd41152ffb92cadc59a232c6655207e844e88a203d942c7015df85babb2be1a

SHA512
fa2f29883bdc71b0928822b60566ef63597d28ecb699cd6c04784dbdcb74c08ffefde843120fb199d265641f216349ec659fa553f03968a6207a529b1dafd33a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11aa7c8ac528bdc8907e10ce5aeb4487

SHA1
7ed2e694aee496f97947f15411e9cf52be6e864a

SHA256
914cbc0318690947572ffc30273643da436992981ebc9b822f0345e0267d9ea7

SHA512
69f8272d0053eb877469c0734ba68704a44730acb7820ccc4277d90150f4e503bca27c6ce401ca87bae063b265643cd159a99c1ac6730584e7852e4a63088b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19dac70288cd06a8d1cb5d9aeafcfeb4

SHA1
4d674ab8372d65bcb9cb240620ca659a9046ad5f

SHA256
3502effa3a4eb845a364485401f1def65804458d01e817d21b630c504ba09d46

SHA512
b95049613d86bb234ccda9da98d9f50218791e08ecee0b6b24facf2273d3941c9ba7bde4c0e3f77fdf0136fd14bbe90ad3cb54a338bf8e71c5ea52db7602b1e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59f6928e17289ff729087c87572cf948

SHA1
1ec69405043a0128416e6bcc02c76007e00bde0f

SHA256
b6aa3d7de550774ac3fed442458001bc14fa3e6f1404e1368fcca0b63bfbd160

SHA512
94f307f9d9f9ea0cd70081a46b9459255e601f28d015da7f442f9734257c699dfab6898c23f467b3594fdd505400438da58918032107fc0abbd12399bb3bfdfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
248d0e262736ef928643d2857a071614

SHA1
924eee72fa267e3eefbf97151eada0f7c4bb7e95

SHA256
30ce50f033e912867ec64541b93e54f708d972f4e2a9de701559f55bc1f53488

SHA512
ed54a09b48ef9515d57d46c95ca848530434ef1c187a64dee5e5a951e3c1e6e1613fd9f12198ff9b865daf677f0c310b7c32e2c2ceb013b206bca8145ca7fe73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddfc8420760ed2d80eb73e3396ddcd93

SHA1
f71a0c40c7fdf3482d6f7f31afa14188592c56de

SHA256
52ecfe05fad826e0de6380f4a18218c132468eaded7d841cc839f3319e4576b2

SHA512
55cb23606dec5fd197201e3b4ffe44df3f3cfee7e684c9b6f7224273a16b3172e5c4ed334fb9573dd3175ff8ee2b87fbafee8171abf8812cb9736367b5edf59a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb68343f6e56f6d3a1810e539d05b600

SHA1
e4dcfc13d9bbe07bb0ba99a844fcb4b9d38a6101

SHA256
15625ecd249a2ad138d7af5dc84fa1f1917af43ca907e80497ae3bf898a0bea0

SHA512
6aeb95a59e0922c05d62fb46117dc0dffa5f09b041e04241a7b73ac4d257db92ee22e4f290c30e2d4adbdcc660d60c70680f824dc142138b61450d98097026ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a3d504af4e263df1ac8ddc6da946f20

SHA1
f40f48769868078122d76fabaaac65009c69cbd1

SHA256
30fd38c6a4d8e8e21db8ff167ec1ca1bf183d3e8800441f991f92b102570302b

SHA512
d867d9a101ed9bd7bf452948db13caa586d74bf25e13825c654053939fb6f705d12f65b57815b0161f17d8c18a8ffbb43c810d7147a8976b519d0d5db8f97054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34109d61f643950eb0c497697a180883

SHA1
485e1fcee18171b5ffb73dbf16022ca7220959dc

SHA256
f7fe6e10fcd97eda49379ee22ebbc1fb90c6c23a2bbd471544bd03218fd8482d

SHA512
9ec10169c4189058494dc18dbdca6d63392ebec2f7000ee0caf1060d9f6b511d039f2ddf33a83d3b65163f48d8ab672ae942ae9c21ee438788eb29ea4ab8cf92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e35d0af9c72dd4d9845c82a09c7549

SHA1
bd44fc9f3c1e16f337892db486fb2e5b552bc81f

SHA256
6432ad5ca7867ebf054b9b78caeb0471b243568a345b849529627fc2ea803f76

SHA512
42bf7253a1b5903a255f54f448324acf285adcce618df7939c509e65981d6b1153d815e036f3a401509f27a7a5a2ef1d7b46b9861df662ea167fc0b22dbcf48d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aad4cebb977661d61307226280c68aa5

SHA1
741653de16d0de1e15be2002f5b0eab6dff6778e

SHA256
c6d0b8786e8896d4e0a8238da4c1742a093066c21ac949682a6c3c16b40bffa1

SHA512
9dc24a9a563b93becac35c48967c8ffdc582d811b3fce7f6e14792478e87cb8aa6b887bc9f7c2385efe973cbcf4ef4bedbfb57d6a0c78e7155e8a4f7bcb1da0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDCB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit