de046db3e6d4efff9b8d9ce268996878786d86cdf320acd4c911b796cc8fc851

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7cc5bb01edeecaccbe9d4614d2d4a698_JaffaCakes118.html
Size

461KB
MD5

7cc5bb01edeecaccbe9d4614d2d4a698
SHA1

df21564a08173d03e622a8c3ad8818f0ba6b94f9
SHA256

de046db3e6d4efff9b8d9ce268996878786d86cdf320acd4c911b796cc8fc851
SHA512

9e0a545ee2ce9eef0ff6eee4497d7508cbfb1693309270b1141bbdb07e29ef34a838a8c5da099b72375a22581b29a441cae6f3b6dfaa12898f1e773c4ef17b84
SSDEEP

6144:SdsMYod+X3oI+YAQysMYod+X3oI+YKsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3C5d+X3G5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F32755D1-1CE3-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423056950"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a624fbfa5f357c3a73d39ae2315015d33a5998821127123ff5a41926d699cf17000000000e8000000002000020000000089fa1ed1ccd503ff6ee06425d148688d408014c548e5e748d31de1fc058429c90000000b85c0a0162e78d65f6761e6fd9166e68b77e0bacc411a6d8bdcd31c0a051eca5d2b47500f7eaf2187d06de389334ae5e4abbe78754c5428aa2f35c8c342e1d36309bed878dd6501322d31a85a0fa2cc54512b3d5d69b9c50a1d28503e2aa7ffcbab90898b19a62a4cfd10c4c59f1cfa0196ee30e9cadc9da3a3630eb6ee7039ff4cc3f806ee7e38abade223c011cdf2c4000000051f0347139444b1f158ad1d34d65feba0e8d502a4e93f55e06bcecd674b5a0647141b61bbb7cd6d1aad7ea9419e438457557e9705d7817c7765d4640851c2b9e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ba4accf0b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000968b1f3f1939cbfaf9b066034c861294da6621d2d2439c9987707427958339fa000000000e80000000020000200000007f6b0f6de23d19239588557837b770e2a9227705ffa63d6c881d6f117d56ba6e200000009bad1cea8752ff9cec48e927ebc465c6ebc8798502ee6414d6f20a99d24a76c24000000002503ae8b5542acc29a58992d32baadabdfbc38f04c058e8d445a1cd7ab827a3fb9423667f41fc1f46fe9a18e677c0518b0a3edc25a1ca5ca5b18b0cf8738ce8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7cc5bb01edeecaccbe9d4614d2d4a698_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcc57c380468cd0cd965633ab3f64475

SHA1
1cbfb11f128c6fbddd92ade308e993ff90c8969a

SHA256
16d2b9d92564fa99e3d3a5b34023c3513226fac2adaaed14caece42ff1468996

SHA512
7bf50e02f788b2fa3ab6abbb2edbd63c3bf242722e1bf1c767bfc17af98cfdf407ce2f76153de7f77c7968a89d1deeea06a7a2d7e14971e321fefae698fca88b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48011ba5d03d9363be4c7a5777d9ad50

SHA1
1a4edc2d9ee907800eaaeb76ade8104d9ded77d3

SHA256
090b68a34e75836590fc2f1289f0bcf2e68b40d4cef10d080120105754e47351

SHA512
a584d53b6b99f553594abc1a0f6954978bedd1fafae4c3a0109b6b73e44e00faca45626314399b8d3947055351b19135f7f015ff0fd09e27e4162873a2f48983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
068f8c9bac3e814da518c5e9d87fc5bb

SHA1
aa59a742dd623429863b7e8a39dffb4c8e38c040

SHA256
475e93f2997afac7ab8076220346f8e2a248c3763ee4452c2f380b7b4bcb15fd

SHA512
d3007a1344213bc6570e357d5290b0a57a5eb444209423e55fcfebd5b872bb6e0736210c215e6cb69dbd06e9dad7eadc876df1ccd62462d91d48d41b8b1c3396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a19d18178e9e6d0e216986b7029f33ea

SHA1
f4cd8eebd870c1a5f8244e46e8660d55c59f8a66

SHA256
9d40f42691b8968d3caa2bc6f0d5a206ba649d9728fc97990d3b7046116c2726

SHA512
56834808946ca8ed5ecff39f14ade247322171aa007049708ace67e43287cd6992e6960fb3f33b16ad058688f41216d95319f0879fe512d99596478774722e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
159fe25b7455fd79db893c698ec70062

SHA1
402c1e0a369b7bf68162939488c67688fc5b4a76

SHA256
ad3cf34371db6ec113c7e584df485d0ac22fa45d746e5ac054dce761dfd3408d

SHA512
1509abaaa90b5c202b8b3c605e64e1f25536dc8095e14a1c186be74b6e81a4e4ebf4daf274ef98e1c32165375333d5cba6ef736e917f87f6b371b7e0c7c26072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f5eb129d2c33f8121f7555251079407

SHA1
6b2bfcb3bb67741b924e21f8bd7c6a15c1778e46

SHA256
c0135a9751d39d804519d20d9fc29a9bf1133d6f271d50fab2afac6e8e69977b

SHA512
11476c1da50102a477fdf398b0553de0e565f871fdf9f723572ad289d77daf81ca1d7d701f8bb16dbeae979d0a4ae813a4be0d762e31a2a89a110e540a9ad908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
733bd67ef0722f2af69ad6232fe4bd6c

SHA1
39479e97bc31059a0b1a514b01d34bbe2644d389

SHA256
daff6c279e0e1987047650b2653925e4367f3234beccb168b987c886a0e7b88c

SHA512
e9ebdf0752dfeede8989cd8acd3fd0303be9f0f7e45e400a6a207f73c47d8874a724147d9d9c35af9901bbf61cdc45705d4df2d3745274104a476c3953a2d65b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f119c007af1a5c36b4f5ae04d454e780

SHA1
569d1a37abe1fba41ba5cb391cd07c848715a232

SHA256
2b5994dbf2c60d464cd848690d29f93278b3dad9d78da327e3e14face3284249

SHA512
05140f582e8dd76a8a90baac7e584c44378f77a10bcc7180e0867b220421bda1a3ad15fe52c57ef5bb33c45d8aef4664ac92abc79bf40a9ddfe067ec0b682c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d095652b472f5ded65173edf642e8ef8

SHA1
17d745056df389abc92f5377b7f1f14253c744da

SHA256
642dcebf53ffb6b43b245d829a181339574f751e506a534f7a0cde36bb5c6560

SHA512
b9b5f2e9edf13b61206deefc37b345d12a68dae1048582a23c0268060b83ba34ea034ac821e5d183d6bd86b6dc6ba41aa6ac5e7e13f537c85177dbd0096c3f38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6ae0a0859693e41d452638ff361ea9b

SHA1
5a8a53774132e09a14ad7c5b05d6cbc371440f91

SHA256
7c1d99c8e9c5eaa8c114029e4d37bf8163a3164b83c23b57de10c44e5da819da

SHA512
6eb01cb4698635613e0cc7a9922b5eb243e4a29e2f08cd94181f057f8672fa5a5c6e3fcc02d3b346cf5fbf6c3e0236d6b8cad033e6c0db13c3b5f9153d0e6520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5da3b762dbde94fd1afaa424637aa176

SHA1
718cb7054706b0ac7bae48891ece46444fd6fd76

SHA256
d5487af12dae8f9b5c61518916311271337c5ad92376689ad66990136e862809

SHA512
f012f6a6013c80764247704eed7c3a37798c3861545496143a2240c696f6601ccf5cce857595419a25c522df0da73e9f848ce79555bc3840c005d72931ebadbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6c857016a91c689894de7356333d442

SHA1
a7b4045c17616b9a04aa25e179efafe98d8176fa

SHA256
85e664852129da48aa1eb9e56172f1f056cfbdd7f61943b9a8ca1b0bb8b5e658

SHA512
6d9042d920627bd2ca06b63b0d36c5bba5cee8445b0cffd49bbf6e8fe19e6a27d05e60c88d70cb7d034cbb66341eeeca575731bc3bbb16d0d3efb782c17a5f4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc137fb4ead0c9cb24cdd8dc3c6d4d57

SHA1
2af468c2f42acd5ee923c9fd0db3ee332bbd723c

SHA256
d4ae6aa30b93cf1c926a437f609b12b7f64bcb267cd2a0b7419e208bc65f5112

SHA512
6595cd3831d5c7535ce390ab45e5ff552291b1f1f0603ec20c2c3dbd7755d6eff4f484e5e7b8bfd4d6a8f192ceaa7effd2df29efdc53677abaf9d0d8fd4c52bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2fb4d7a337d9e2b566a9c669cddcb36

SHA1
a8476980d33ccc125ab1d4987023665ee99983e7

SHA256
53f51aa22b1cf4c01cef133477438f53d6822cd5244444e8a8bf0bdbac81542f

SHA512
be81723bf87dfc385d635f488ab751f5648923dbacdd36dd284fe0c315ade506dce1031383b1b09f5a349271f8e046591c21cb0cddf7b94315173f514e5dca73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d534c4d74717e3ba852df73739ffba2

SHA1
1e0c320f71f7a10077ebeb2771d474b0428cbfcc

SHA256
c70871faec85dcf8f0a7c7079d5dd76d6b6390be9d7e27fb85a1a93c668f8d92

SHA512
edf766426f12081d24ee09b29a44ffda526e67f444b92842a90da8973883b3ff14c320066f85921444bd6c0a081e16f0d575a64b57f1d3594c6cdae32f982e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B99.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BFB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit