27ac1255eb2859b10ec643f0a6db714b950d6fa8806b691243eeeedaac64ef98

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad8b0a7a3b58be22ffa59b8dac2c42fd_JaffaCakes118.html
Size

23KB
MD5

ad8b0a7a3b58be22ffa59b8dac2c42fd
SHA1

2810953a79015849f78f11f3a2a283d4371d189a
SHA256

27ac1255eb2859b10ec643f0a6db714b950d6fa8806b691243eeeedaac64ef98
SHA512

671226230c6f209dbd127fa1f086c6046e96a93b1a113d34c654f323b6bfcb19e3aa1ce85fd3292e5b53b702aed82b30d4b7569eda0de7670edd9235b51aff7a
SSDEEP

384:yw+L2lUMH1MD97HoMjBnfzpJzswobVWHDiXubVWHDiX9:0qp2VnDz5obVmOebVmON

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78993471-2AF1-11EF-A155-FAD28091DCF5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424602077"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000022765a3086359aff6d81d04db4855e84c84adeae626d325b44abcdce513ebef8000000000e80000000020000200000006946e2677f6046ad9dd27a13662a8d06d50e7646f62a639ad1d95ff7db828824200000009889a9c399121097b0f7e4a3ca709547e0fe8ac0da0823cd0882299860d006e9400000006c9177d177da5b492e58900a5a2df98ebc79f1548a893883a689c4a9c6cd85e39520c4f5129b521f858e8b07f4e5a4772075b2a290bdcd303cb2c17b13e45e24	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ad57a1a56a643700fe474f2415b33ab438fc0c2fa2e83823a8b9d3cfbef46c97000000000e8000000002000020000000f75ef7fbc6739e25996184b74328a781641bd2385d3f70bde67d744dcb57c19c90000000edf30d6825b5638beb17d090308e2dca007f05fe7f29f790f15802941f51e85d2ac1e7bd9cbb43ba00dab93aae04e1ebb642c769ab49e979d478fbac6e5cd887dda479208bac56a34351d96b38ceee81b4fb95b4099b95084e206c83479ab835fe4b1682c5e776d9609799db52ff7cfcc007f6929c4f262a36cdf8561bbdc445343c371fe6390d3c468f6abed8b5ac76400000005e3987a8839e1e1ebfd55c513009e3d3fea7682c0fec53a7dfec2cc45aa5efe6d0e83095cb35d7f2daf86c0cefbf6670432f240a4e4e5a3146c64d3d3c215cfb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40875c51febeda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2392	iexplore.exe
2392	iexplore.exe
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1096	2392	iexplore.exe	28
PID 2392 wrote to memory of 1096	2392	iexplore.exe	28
PID 2392 wrote to memory of 1096	2392	iexplore.exe	28
PID 2392 wrote to memory of 1096	2392	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad8b0a7a3b58be22ffa59b8dac2c42fd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
374c1165bc3792fda9e7a8d6c1d4e3e8

SHA1
39d87a77c350ca794383433d8c05480b18f0c66f

SHA256
3670b87d80de5de388c3684600a4391f43c15d65406c22a5e703e72dd6b711d4

SHA512
2a5ce7e170c4a85a41aa485679fd8523df2c47ac2ad5b1b461e8b8f06522bb99c04966156ffbd501b5b5fbfd5acebccb362a167bdd972c334d6af38778ceb0ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4c8f0bed14be83062671ed46c0cfd11

SHA1
86ec219c77344ae546280e70b4bacf6164083ca8

SHA256
27a093277af8d4fa6b83b4658f13ad2bc262c5dfa3fa92cfb1493875656d6a80

SHA512
ca314460ac1f84b66ae8b4e7b726ccf51910f2af14b755588b7d73faf4c37d26a211b8882c24da2828dc193f1f370bc95a84d26b2c4d860b1e5de826f79ca4db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35a7699cb0c16b593467753ddc9db246

SHA1
fe5808e6817de22ee6f78760a2b172f4058757c7

SHA256
220d09a1aa12332408b6bbecda48bc1f5f3edb0493acdfb39e5661c72422298c

SHA512
6d0443c8ecc6f9d31812059dce6a5fd20f9186c8260c9ae84fecc1507d704bf61d843e86460b7eb7e06669b779bc0aea4294e2359a9e13d2df57176afb33940f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2976a19ae290869a0822403fe9ab29f4

SHA1
9655fada207c37b420b7a86745c07d1ff24a9112

SHA256
39da916c6cc7328d4d7966b4d0aeb2ebbd75f633947f30094862053922cfd49b

SHA512
33905d9293d362bd59af62783c573d536406a09fb97c8ee05c5b68732c88d4ab2f5739a7048de03e359283519eea206c418cf142cac6422ce26dc686e9d922d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f351fcfb84a391e8498a54cc558071b5

SHA1
3ebc173e104791db5b8692cae61a1eaa50728286

SHA256
052e6b3090c53a7bd30964a137c221872b56de8c5b373f756ef801931a8f30d8

SHA512
937473eb3ef3e78257b540a1ed4b3efdefa1455439894ee66e075d138bfb17c2396f61da79252286e0395c1973d9e1dff8bc93408bd0936bcec9ec87a426b650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3c145341a00a57fcf2b6906f60f9295

SHA1
32cb13067d9d916854241f7783036957e4a574ca

SHA256
1eb33609180e99c8c8b8e058ea508bdb651ed39eb1c1a24146041649b07ebba4

SHA512
14b2c34f310fa34b2438348d1764647335ab77b408460294ff6bdd6a7cec4fc1dcd9431bc7a1c9e8bb3acb7baed845449a83d0460cc19b77ee21a0b8e99c7af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6e7ce9a32bf8c437b9b696272e72abe

SHA1
531db91cf6913f07af2aa0c53a30851acb78bb78

SHA256
df23703f2b9760022f8fc8ac00c70210700faba62f463ec3fbb28df2f7d2ed35

SHA512
9f7ce38b11f34e3a05751a546163198afb72ca32b4e7e9ad36e5d4e176ebc9878644400415d028ed3578bee408a3c2e005e6bcbc5b694175a05cd8ab96102206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ece1bb2640fd8de5df3e9a4c1713c99e

SHA1
3c376a0bfd5ac33f9e715fe058b99d630517cf6c

SHA256
7b70f3cb94f595ed7e417982066c3a035eec6d02fbb55c77b3682560095f39c3

SHA512
d25854533c50dc5a00eeebefc0aaa6ab35809d1d8722074e0e498e36b3625d301e620542d083f215d21756b3b37be29662e4787104266c342dc54448c18cec87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c24ed83c001d1aae9b3a2dff77613f25

SHA1
3af5b92019cf890479fb119fb1f7dfd073f0d6f2

SHA256
08dfc466ef964b5eaba689de968b4c056c277840060e1bacb0c30723e2ab1b8d

SHA512
e76a4f9aeedb7c1c2709467c1e8a717f0db2733d084dd1614b3fe00fc93d10ac63faec3a20d0b9332a0c0a0913411f8310d5124ea6ba13dced54b23fea8e6b53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddaeb266ef0411e908af00c78eb04a3a

SHA1
d50fc11f99f6c08f44a234d165017ef4afdbf870

SHA256
493c3a630e8f26926a59a2e141dd77165d103c44b329abc144f54a1931257f9f

SHA512
526ccc90cf7a37d909d587e8abfb81b655037160c4217297ecc9b81a4105e89f38e44ce05ec2cf5847fbc30df162ca29b3256d955af9215401537a4eaaa1e680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
444772a1faf3e994fba1c97c340b3108

SHA1
9f0623aa5fd9bcc0917358e1a2cbd3ef6438030f

SHA256
ce487091ee6b9603a1ff5ed172919e8dbb5e53423ae950f14b6ff5e81cc9a593

SHA512
3072809cae6ceb7bbd9521cb847571e87a579e9b4593f1f28b421424e44dd14293a888b97f158dc1ae2335c7127b8a8407df47dc7aba5834007f5ff0aa9f8b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba17b0320884b69f72e36a90a5c38369

SHA1
a3851f7a7477b25523bee8292dfa7a59db7f1fc5

SHA256
9f7c424a40f9160a08ce152bf3ca4088863e43a95478fea6f9fbf06c7382618c

SHA512
eeca4ab1548ef459291b599b9d1edeb4d7374657b1a59f40f3de762a94789573c87d562ecbe3925e7ac54a26134b097ee9cc8e1b7d04bb45202365462bf45eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
069a02868540fe07e695fe18de77a977

SHA1
e9639382ef1d48e9e321cd86d128bd9781e10ab3

SHA256
41ea3707474712258074e488c316749c5a67cd9228033c5453bd8dd09fd9cabf

SHA512
2bf025e76d1639c203dd3273c1cb609fe2cdfde5e78f9663011b56ac3aed74bdcefeadda027980605a5443e2b67bf552c2020163ddd5e1c496d75ee54357b85d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A8C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B6B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit