65ddba3d2a625d9f1effd3addfa165edc2a002c2715cb5f01cec165a67c7efe3

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

783be545b6c9233d1919acf3186d9b9e_JaffaCakes118.html
Size

60KB
MD5

783be545b6c9233d1919acf3186d9b9e
SHA1

a48e9ec0c3a6c9fcf4a3de9fd51c4caa98bb386b
SHA256

65ddba3d2a625d9f1effd3addfa165edc2a002c2715cb5f01cec165a67c7efe3
SHA512

c74dec9472636d6b3fc5d5733ae4ed79b97742cd0248832dff6c781ff0b1bb921805014b400cb201c2d624094a12387090a10938000a134f72f98f0c8bd7d446
SSDEEP

768:V0BppziCn31Dvu85rrXQ5Z4wUm68LKuyY55ojrO:WBppGY31Dvu8qLKuyY5ejrO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422954017"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{499FA481-1BF4-11EF-8EEA-EE2F313809B4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2844	2936	iexplore.exe	28
PID 2936 wrote to memory of 2844	2936	iexplore.exe	28
PID 2936 wrote to memory of 2844	2936	iexplore.exe	28
PID 2936 wrote to memory of 2844	2936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\783be545b6c9233d1919acf3186d9b9e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
51ccffbc3938a5348acf4f4d3b73c06c

SHA1
68960cd5108027982533447a173c61e7d68ea6c9

SHA256
dc0fcb601123b128313898155e305cd49bcbf4284502b28cf9d6b142281ad9ea

SHA512
56024236d1b057181e9edbd1998fbd0058d21589b47d876782c39936e6cdcdf2a6852f691d00b9fb15b5d61cf8fdea9cf18d2a6a3eefdd27010667e27b80e973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3acee15324f523bc670b00bd1606fc52

SHA1
f8aa6cef9af260f2e1c9e6b5e590ff83e526fb1e

SHA256
cbed61f020a2a0a6f880c1ced191cdc2c381d77517db3146e8938738683b1638

SHA512
5382cc013fef75667d90f26f21c5470e4449af60a8e3881e1b8759723e7e236048d9745a1a61c78a8f324ab75c1e1af7121a5846d02b93ef919ed100e846a84e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fd4593b604d66dffee955a54fa33b9f

SHA1
c1fbca3091c40612f8e5b89a020dd143f34ffb56

SHA256
92b43f9e9020ea8021cd9743ca4793d998b3e7eb03d125437395454d2d8e7674

SHA512
68f623752b6dbb68ee1edecf0ace0f1a2dc550c6c4ba59179d71b72be7422b22e78aaf3822d8f0567601a4495a690b3ce21266dd245c9e1162446ae7958bca25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
644186476a50a0acb2b2ce0f7e4af827

SHA1
5969c32e4a85899df2c68d35e7d25320c27dfdd1

SHA256
33ad9460a63c938e220624c1acfaf8f62a6d0f763346b60f4546fd59c222bdba

SHA512
e194271ed6278f46728aa274363e53a9299c017f8b22787d0325d43d8f6bb3c84d72f95da1044790f56a13c903cb4f252cb743184e7aae1d0635e16199828fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57678124597dc62e7501ff3284f861ad

SHA1
5074fb95a73442ae7c4b60c820f52b050160236a

SHA256
06b8b03002f909f1fc8fb6769590505b1c3d359733a289045efd45b7f598c8f2

SHA512
98fd98c4758b63d1d288b8e121556b36e2312acabbeb2517e7edb2e345f89dd705ec763addb7a85e5027f15cfbe162b574cea4a4649f8dbd7b24938bfa842059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8ffce2002187dfae6d515deef621985

SHA1
51aa9e454a94ea7ab461ec86c8fbcdd86c518ca1

SHA256
89557a63beb19af8fcc3b7a2a6a1960e114801d1789f639af248e67e9ba7bc64

SHA512
569592dfc80172196553555047ee9337d832834d49d6ae9136ce0a7393631d9f07336c09cb087a3205844be1aba382b5083ca419bbcae9eb405962ca2540314f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
034688c1da57f6d39ae37080dec89973

SHA1
90912d201f309e6c1f86f17c75da7e5d8880e861

SHA256
57462a7864b0fdeac4872c34993c1bbecc3740311a095b34165d2dc8fede1385

SHA512
29c2d4eb80fab386a597de499f94d4b8360cdc4bb2afd4f4bf1c58ddd788f102d58602b34f234918064f6d185b916d8386dbbf8df65f00898c65e4ba5482f0cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70e899d12ea3f32af0f202b9f8e371e0

SHA1
6ea696aea46db7b5f0da87c86577449e1442afd9

SHA256
33f67171fbf1556c6e28ed745dc586b55ffda7feb2f9c6948b957ab8a87a505d

SHA512
c19699077da4fc5749b667308651b3e2febfc696fa1c6ddaf1ea509eeb46555f18cdce8cce9f0c02e77c042dfc0e73b4eddd1a84a9264d21d70cfd623519efce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5386fddff00cdd9232934c74449c00b5

SHA1
1cd65e03649a8c93d7a06ebbe8dd1a9a8e004c89

SHA256
8663ff00e9fe7281203b03223a01823f453efbdb7946c82284cc5153ea5d15f1

SHA512
05163112fe4869ca80d3eb399fdbf02f25054f90241a56f2997d3beb9cc1caec5c598296bb5039e27b0d6c0b6097d6985d836032ea1b3215da9a1d3124dbff41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dbc9fda0f989a6200bd53df288f176f

SHA1
a494274fd42f55d10ce11c574c67d3ec6a276f75

SHA256
8dfade83532cfcde8df6739df6f6632992a8bd02a98194d0a9a88f0137c93df2

SHA512
f0700e0d1545e8e64d01a8deebd664b21bebc3c51ac13cb95c2e3a9c46b274322c36e648eb274bda5100f5262aee56a2d555c2c0574a19431fd878cd55805f91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
536bc3ae9d16bbca62b9ac655e82f271

SHA1
623d41d61a1ac4cd56076b414f96105a9597cd93

SHA256
1adc0ede2262499d61a57d80d17eabb9c5f884dc26cb69cd1f41d05bdd72fcfe

SHA512
6f409eda9588df1024f0b4cd2083df6a1a7236a6515ffb5ca5377694283045ca532405dac1946e4b37733676e3cd24fad4da846934c1c4e588142d035cfa56dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
952d8bfafed79e1218601fa482f347ee

SHA1
01401502eba053d2c72467f1a32097f1099fbcbf

SHA256
4b887851a21dfa558e8a5e55d552e76cf73896152081660253c4770ecb873ffa

SHA512
51362a55463cea123e0fa1e64cfc1d0f275df5ab52a4f9b25c52c62cc9f0cd683603700da52a44621cc6179841c67c1999fcc153c3b031d7fe489a87e038ffb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
472bb8ef0119e32e647cc47b5e72c9e4

SHA1
104de6b616d2ba67863568d285467aab729b1bbb

SHA256
701e6d6fea6330b638364432d75e23bd5418fe331a5e94281227620bb1ade326

SHA512
2302f6c7dc869c8ec099520817aa07982be6b4dcd5bd88a7bdee31428f4940d00a88c5c3211083ce87cb8b901e0f1419c614a3c80b69f0c95ff3ecc80ddb25d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f422e1fb207f8336c91af1ba380ef5db

SHA1
b833802d9c692c8ce776a7b98ab2b35ee6281867

SHA256
03d91b73b137bea2d83a54cf25cf9120baf32b8c1f66d8cfaeddc7e64481236c

SHA512
c929da3ff897d3c32fcebec69f39a3579abe8929830a37f2d97439223d31828e0cb6c725021fe838b93f167fc0f137a9478645398371d2fdd8a52fd6d37e0563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BBB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E4F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit