e60bbe8afdc5bc7874d2839fa4b86115adde8545e404ffa983fcaf4a5c751cb8

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 09:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

adc8e36e96a54f4f8927c7948e5f665f_JaffaCakes118.html
Size

460KB
MD5

adc8e36e96a54f4f8927c7948e5f665f
SHA1

8f677593db4b0beb060304f20d4af38ec922971a
SHA256

e60bbe8afdc5bc7874d2839fa4b86115adde8545e404ffa983fcaf4a5c751cb8
SHA512

111e850001cfd4b623a96c6e912dc4af8b10f629393bc22158d1be4fe50317224494600312beb06745c1c983cec5c5e928e7f9d89dff133565f59ab62ab8e0e3
SSDEEP

6144:SdsMYod+X3oI+YhsMYod+X3oI+YdsMYod+X3oI+YLsMYod+X3oI+YQ:O5d+X375d+X3T5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C08D171-2AFA-11EF-A43E-62EADBC3072C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424605946"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000003246f653155df9d535af4d801f674fa6d1b9b9184fc90f1a70e4b155bf8268b6000000000e80000000020000200000009a8929481873f22b5320faafee03af24e864e4549d211bbefbbf8c09c7772853900000009ee93a3714e5a08bfabd4284a7a8cc293ef9e88688936b39a9b4e937b49174de8462bf7340aa5e59ddd02b8ce08231bad77d8dd1b6a263e11a0b24435b13757cc3884edc6c39334da3be751f52e630aa27bf5045fa84b12904d70375e28fb6c67a672548facaef7743dfd1909318b26c58b19eec73723cf2c6d3e273f029ad5092853ff518fa0c9e07924b4f6c74dee240000000fb47b006e997259ac070ecad7518793967cd2a76c1e092cbe34554373a323f8dadb35702752d5354b9f705a5c40e1d804b36fe2cfb86c69ebb73c65e7f92888d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000c6556af4fed41e7c16673841444bebf266900a3cc70e031d51e34e49c4af1b26000000000e8000000002000020000000c91600a4893a3f7a3d245e126d731ae7979ff2489d012d6e6c8a9444bade06832000000021f9e48131177c88dcc7e936ada128c00eecc4c99057a85b27f61ffe4fb61673400000005262749987306074c093b3b1978528c1c57f075355fa3d31bdeecf521f72a652a163464e13eaaab66d69dab5504b9762494fb9e21d2132ec621018b984d26a13	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0073905407bfda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
288	iexplore.exe
288	iexplore.exe
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1652	288	iexplore.exe	28
PID 288 wrote to memory of 1652	288	iexplore.exe	28
PID 288 wrote to memory of 1652	288	iexplore.exe	28
PID 288 wrote to memory of 1652	288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\adc8e36e96a54f4f8927c7948e5f665f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
372b7bd2a0cf0425ffc98110153be764

SHA1
7f8692474ad66ea39656c5389a1b33251f465abf

SHA256
fcb26d9e76eb116cf9674bfa410fde61649449c9eb2e09e095ad165c3834b516

SHA512
a8988670f0d96b9e6e159cccd42eac4463a77ba1551ddc69f68bab9eaa3bccfcbd42be79d46e5fea164869347d0c9d5d4a3719798fd397f644aa3543710b2191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52b7d97661e6ab3a3603345cef4ae7ed

SHA1
e7b8841384b1ade1676a30d29943cc8794929c0a

SHA256
9c61bc1a572783724fcf4ec3ea6a7bf66252c17cb0828b888b258b1b0c9c4a62

SHA512
2b390c185848e06233ead9fc9348d59ee63ac3fcfa453a8a3a262835f4c8f4d6d29f08b77a8359dc8e4477a73e287d181788cbfd534205d8aa1d4e84654b113f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cf946a888049f276c9cd67ee21780c0

SHA1
3cdac20e5c802496c1d983102fd59b2f41f1af1e

SHA256
efc7031478d8d3e76897b4ae10710aed44dc75e17bfda99223da72a3a4833606

SHA512
60bb9c09bcfc9910eff2175a899f547eb425dfa740841dba18ddefe9dda29658cc9562e8cbcdfa7a0925ab1c6abd0024103696ad2a470d5a4794d4af855db1b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccb278dd39313a698b65fcdea18e8e92

SHA1
0de544b28579f30a33de643d642fcb18df42054f

SHA256
57861a765a52e0f97b75783398733e3c9da89e6561e4cdca147578ea867b4090

SHA512
2bae7d0666b680e725f1f56ac91223fd74bac3a8026e73522088a44fb28768c7b755a51b465240ff514cc3334ab583fb11a699270fc1539303e072e1f9fbc73e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f0a0aa7f29c58a83a415122548e5c50

SHA1
80995641eddcf7a475ffd8db84909eca27545cb6

SHA256
e1c56597d1e8cd1400b507e61cb278a66edc0d9dcd453df4ee66da08e68b968f

SHA512
3d9d9f70d62399eeb9ff0b161c1172c14a329c32eca259c7cc478910e201e9954910622ce0c0d7ad434e6322a3afce876f32475d78e7a781c99d8ca1965ce8fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6be935bdfb3979a23e614143760cf41

SHA1
6fc126f04f6560e706e92d1cd1487d394ad6fa65

SHA256
5a16db376de3cef3d9fd19d32c510bcf881e4988601378949af287d2222e1876

SHA512
f93a8fa2fd6b84dfb78048c7fc7e6ed2d89a8e96edff5258dd4aec4fd71cc74d3ffaecce8844d32566321eb071b993029a357bf4414d79ba8a9d951ac8bd4042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35d98a8238231ebfa89043308a4b1a5c

SHA1
93e215dc638aaacd19ce109ba08fcc953340ef34

SHA256
1851111fb85d6571059f9f5ebd1769d3ed9fd59a5b9a97a424090b1a4672f6fc

SHA512
79607cb2ddcaad0ba48f8f9356e38f4422d8ec7e888d6dbc316bbadde69ab9a5f510062e88159bc6925d927e5d7f76e7564de5ce08adf34180300646884af72a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
410fe52de2f7d728078a6fc2ed3b72c4

SHA1
ba4d771ae1158115754b7eabeed2943186f242bb

SHA256
d99f48b9cb9078a6f420ee400c63aa45ede16f901f90f37187f37a8c7c0347f7

SHA512
6c8b1f04d0f221b1fe46e9e11b6b8de96c36b1ef1b3fa8e80e8e4c0297acd24ef9a5dde69971ea8144232ca85c69f1a79a2defa317ff74ff9daba31a22a71aa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc1b63a99227a5ada1bb3bd21923323c

SHA1
0c3815a0ff702b8662f668187a5fd30d3d7af73d

SHA256
7a65c57b0065f2f3bf9fc68e93a5958ba2cb85458f87c63b2d98837c33943fae

SHA512
f463027d0be72aa9be51d9f3e0b8b755e574a4dddba790570ffec5a42f96c300129cb646c4320d70eae7b99e2746b544a9609c75a76d5dd5a9be87372d0e4dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e08d5633efc08efe20d520422d61b574

SHA1
49d473f482fa80c2e9325aad93994e375352cba2

SHA256
e260089d7016e52c7b331f36c3cfc26bde59c7de28517fd141ac6fa8f559038e

SHA512
6653ad52a7b94f657e3d87322fe7925da8524243c26cfd97c7b3dc6b826d49ee2509795c13b6d5901175bb8eee52a3657789bbf8432a290d7f304f6668d9e31e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8d8b3d3ee9511ede3b7a1a666b4b4aa

SHA1
d712e6046b8e9c3a1d4a27d11b534707a67edfc0

SHA256
18e2348fa21dff973ab6b49a5688e37e930dffe0c943c565f7f0d81a922e22f3

SHA512
aaa17152be85c0e7173ec119902ea50c785a0d4310aa4ac70edc1f7902fd6c385435210890cdb178c2aae239f9d39099a594808f0017dd0b22b1382cfb8edf5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d1290b9e91017b36c2bbecb5bb37e76

SHA1
bfe7189b6a1f145be644c5b87e1b8f69e09aafd6

SHA256
706c299ee1ccc09c4bcac8d0980c05f8f29228037c48ac0247de47cefa46fefe

SHA512
98ff69d54a76062e497f6f95b677f6c0336cd2a38485b3263374194c23f1430ffeaabede4c4b1921621cb0943efaa59786903d07215160ba4025739197b54f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5294d7ea7ef28e10588c965e3f0ae6ae

SHA1
29a8baa3dcbb3b50098b8f78292b68571503925b

SHA256
e0a3fb31e519765228a1b19bd64db5b832a24cb5a083095ce93f57866867fd03

SHA512
34226b85cb16f88591103c147ebec8461e4a663eda0a47ab83d6bd0eac3777828d3cccf0f9204131af0cf07622050ed48e45a04ebbd6d89795d6ae84f11123da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5721f9d0de6c73c671ac3e74ea5a7df4

SHA1
f5fcab578b2a85d294873d7351f0c51505cb56ab

SHA256
3270ed0c1f7a9d2ff57dceb39d24a1a4df4e907b4ee81438bd4eda7e0484026f

SHA512
3a42b5c6454563c8d77bd5ce51772706c02dd538a58075d5b19024e3a4ca5ee34d2902a4e1dff88da98764d48b91c665a147325521a9123ed35774b7aaef824d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65b191cec758ebf77193220a4ceec161

SHA1
7f16b734461df0b1c113e804296bd36e38647974

SHA256
85e9652c310e51302f6e432b1cd06eb2a43360da504ae394fe0bfaaeaf1c0cb8

SHA512
b28532228224dcf03d1b6696ece9c2bd8503689c4bdc7e476bddfde9b0fc205aa3411dae287058e0aa60e8e32ea4f9a8d48665d1b8cd7edb3e5f6a322f40e67a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea11cd0af4b4108b2140d1675b2e1819

SHA1
b2da8250996fb0e75e8ce7d27258c872473367cc

SHA256
885ae72ceb83cbee022a582e4a09684d3eed56e8c23cd6d8688ecd984a2dc84f

SHA512
0bcc06fb82c3f981fbd0471e64c97ce1922fc743fba9128adf2839d7ae601d626c2dac456080095b7b490ae5777c2894f0b85a8729060b7263e86d19702474af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52c817cfedf37bee49d51edc0f483f67

SHA1
fc296abdadf205056eb1de9d3a8bc84b52c5a88b

SHA256
3bddc81be567b50e2774b33315c496156b161b5b9bd42666dd3d2ee5bd980d1c

SHA512
8e6540425e4d2fe92c997ca1a47eeee3004f573282d4de327aab58e041e2c945d403856d95db5ae599e8f9161e3e1fdda5269286e477d39b241588a534687826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DAF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E5E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit