78d76924165f27310e1e9088e36c8389009d6a84d3ad38f26e7ae95e4798ba99

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78f6ca33dd420c08cbb47223b32fd88a_JaffaCakes118.html
Size

139KB
MD5

78f6ca33dd420c08cbb47223b32fd88a
SHA1

b3b2b476de79c00c242c1dce659bb8bc861faf15
SHA256

78d76924165f27310e1e9088e36c8389009d6a84d3ad38f26e7ae95e4798ba99
SHA512

4e0d04b64aa3611702fe8b1d504e0ca570b6ff38bc0da86fbc78c6339210d12e66c358d7fa0db6a07e0dbb28d9459786a13d5cc77469bc657b7bfe8858cbe39d
SSDEEP

1536:SftIBMPq8CgtNn2RlxyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:SfXC8YyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422970306"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36A1B731-1C1A-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000026dace636f330de4e9b7ccbfcd00aa805d7e3d05fb130259abddbe40b21a8821000000000e8000000002000020000000b7e58476e8730596ac98205cd3522ac7baa1dc1125e8d153ffe20df68632ce4b9000000032ee977a09ea0d7925b140dd7e8186a4c33cccde6ce5e27971d96255918427c9514eb12fa6a322198e5bc98627fdf1ad6d4543bb4bdf4067ebeeb15f346b449da1c0bedba2f9fee7448df48ea85c6282dc2d7c57e24a0e5177cb5b3f9be62f70ee83aa877022d7432c8ca0ff7515d36841a66e4ddca21ca53bdf8c92f10ffe5e0b170274cd522c881e3130b3c028ec28400000000a97c5b72089cdc32bcb3f385fcfb76da6c522e93c8a71bc69c50f5c1efbb1526b84096138aa7b146b9fbf85465fe0c8f6352e14ba95e180e395956ba2704d25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000cd828da8261b4c2dba674b9766e4c8813f6ce769122c3ae377113ce2b2e5c8f7000000000e8000000002000020000000511141a02f8250af01389fe881ea750dec6fd2b0731ebf0629a05a3f13474fee20000000ca147f2fa020332e44d28bf14183e1f56ffdb5b943d597d2e552617f42f3391340000000847022721a745167024222e69180ab7946c3ab870b70c627d0cc08b7a8d0f278aa954b7fc036e050c5fb4f6bf08544163726a8692bcd982ef52f75fc4334226a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ccf34c27b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2480	iexplore.exe
2480	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2456	2480	iexplore.exe	28
PID 2480 wrote to memory of 2456	2480	iexplore.exe	28
PID 2480 wrote to memory of 2456	2480	iexplore.exe	28
PID 2480 wrote to memory of 2456	2480	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78f6ca33dd420c08cbb47223b32fd88a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23028457df6e17f8fd19f555ca009bab

SHA1
e7e41a68537f8b735d1485580a212d578c2b4af8

SHA256
b1365cb5f0db77f12aa8866bff50d3b10a4b6e47deb5899bfc1016b7e275d954

SHA512
29ff006cd98009ab0f1768cc4301914ddfadc63cd5b18cbdd0f2ad90ee3b454782a2c525960b2426d1dbf5f92653640b1ec36e15b4817a4ca9ce5b00a19a128e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0e165316c615796ddb123dd1be7a9f8

SHA1
23605286b8ba9de367f21b60fad253ed47c2dc33

SHA256
59922c5e1bb614c035addd9dec5c2ecc48907d87d9990a2f72ed386ac78da455

SHA512
5afe936a4d0ea0a7e73cc5a1d620e456be0d22982c78b4e1ddbbf996d17337f4c3a1826bc507da08b2fe5ac68b9cf06db754143aa061f8d555f303e643541c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
783c3b18f308f65c40e70dd78eb20d87

SHA1
d87c50eed03ce17d99f1e161628b55386e6bd175

SHA256
bc1837d8baad5ca0f55a88bbce1040a8a2c2b87c50c20c39f8d40ba3763acb1b

SHA512
bc442743fb9b5f7d609426ead9163a76f7f2dd7823074a7b9cbdd18d823f8691a344fd3d8369bd4602e0cd834377f04453b346221edbaa2ac129e727c77ac7ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ff89e2f0542893b7f48a5b7ad6d3a49

SHA1
17d1b58db98b5c78b72f2512809e2f27f85519dc

SHA256
3a2b08c04c788e5bfe0648e8be0ed8e5375a9bc5802c0aa46050761414126991

SHA512
1f209d78d91eeedf271b171e66072470776a17464cbf86576058cf574908d1eaa2ff89af0b081111539f5c44e44e4ac73fb27a2570eb3411c51625c6a5eb8ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03faad9baa661baee394650bb0ca146f

SHA1
c86baae2122a52df2d92594053b45a850d5368e6

SHA256
8aaf33067b90bbcc6711a2d34c7b529a998291fef917f5886d9ed2ad0550a7f8

SHA512
5ef46d4e4b24a3e0dccc37da6c216802b337bb29e5d5a18881ea44dc0a933b6ba7a65499b0c7b0b03d9b0c5ebf844bd678249e976895e713b53878662475d2ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e82601e4ef2da078e2d7becf5e32bfbb

SHA1
e079c41a47958486cb4d6e3082b3d169a383a494

SHA256
60fbd0bb7db07ab7b8a2b466ba8972e281e083673b5223d0dfc8fcc1320136ea

SHA512
63a22ac3bca627468577b02f3a76b9816caa6afae269dd75022632c3866253ad13345eb41aae927b16a258fcbbee992e7053fe1d16f506489a700d5cbf24a0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f21a183cf8a9092e1f56f6002020770c

SHA1
df6fbcdf06a033851a5bc6a005882ea5f38e45ce

SHA256
e24dbd33e1d087ab8e5efa0a2841c6ba0bf35be492adedae0c89d75b6f07e749

SHA512
8e4b449cd38e3c05131deda52d1042e63db6f4b602ee4d4408aeea04af69a5f352b808a30e0713db39166977baf9388c8e65654e9a9e0faf33507370e4c0a688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de99a4df8c330251f3708bca7a276ef9

SHA1
259056599ce7afcecf875494a22899ecae5c9244

SHA256
90d64189e9acd13a0ca1071a9c30ef264bfdbc209e3de3246c0067372f787e9c

SHA512
4842ae122f67006bfba76e7866008bce92ddf26280a4217970445f30ab0b6fc0363988edfa599a4cecb39683361260a99fa7fa8ca2bdc09f4d9832095edc807f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf368b2cd795d8b11e554571cd84b1a3

SHA1
02b29d64f0c5823c65cb099441c7e33ecd9f92e4

SHA256
61c02205376fa30dfa8bb4745295d3abaeb6880f57a9ab17b6e741094aa7ee40

SHA512
6973c32e4c36d20c125045c2aa577f0ed76198cc307d220025b5e30dec5d3553033aa54e5160a226877d5bf4b94f91ec518e1cdc933c955aaec109834c57670b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7087512296d5f55271f6a1c9d0d6f2d

SHA1
a5c272e0240e1abb88aaf5231d793e10e8aad2e6

SHA256
6dffbe602ba5ac5ef717650af1af6b44ea85f77c32ab56104b46e7b204909403

SHA512
70fd8e80015ab73c41606fe698eea4920916f773e1bddf7640d1243238065a1f4c6b3b983cee774b5d77eee06220b2b17852fe816a9dbe444bca6ec26f8cc0ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66652078cb7337f2b8ef9d4e0a0999d4

SHA1
0aea88eed36897be6120d0aac37d168a92231ce3

SHA256
24c6d52f41a1a7da1f7526a20485b666b554f126b4a64a97dbbcb255dc95eeac

SHA512
70df936d98425359468629252b428c5c9d459f30febe044d9005b293897fa2165e97718f9a118f84bcf2bb5cfb1d69a5a2ec422009e0703cb6a3a5e6f622b74d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c677996fc90939e50b9d20eef6c0eb4

SHA1
15a1da0a4028458c374692ee1311f9e90d952644

SHA256
e5b6451f2456b292c80f44e0cf61ae7f5c4026df04c85dda6d8362f7df2370eb

SHA512
a2a2b5ed60c3028961be48fdb5e68c078cf11e18070ea52ddc9a3a3b610b8d84af07e61b2bf64986bd7c5670a7cd9c5575b09ea0b8e6de1a7b6192c90ce6daec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20CC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2274.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit