d86a6987cf3a3f05574c680dc44b3ebca3fce374e66510ec106b1e0e3e57dcfd

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4276d3facacc1b6dc3767d0dc0d28b1c_JaffaCakes118.html
Size

21KB
MD5

4276d3facacc1b6dc3767d0dc0d28b1c
SHA1

658cb76ea9d005a087b551ae9d810f512c113cd2
SHA256

d86a6987cf3a3f05574c680dc44b3ebca3fce374e66510ec106b1e0e3e57dcfd
SHA512

16c7e96e15b09da4d2f80357dfd2420da488e04f94505eb0841fb7427d756c4a6357b925addaacd5d19762dbfd0db9cf449a1dd7d18fb529af9e9bce81da120a
SSDEEP

384:SL2BRwd7FablRT+iSQqfz+jCjgD8mFZAZP/TXA2a6pBK5exN2D2tN/:SICabnJI5c8mFZoPr/aIBKKN2D2tB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427050072"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28A5DEF1-4135-11EF-B74C-7EBFE1D0DDB4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2524	iexplore.exe
2524	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2132	2524	iexplore.exe	30
PID 2524 wrote to memory of 2132	2524	iexplore.exe	30
PID 2524 wrote to memory of 2132	2524	iexplore.exe	30
PID 2524 wrote to memory of 2132	2524	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4276d3facacc1b6dc3767d0dc0d28b1c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecf0b03d5bcb8abe29ec8e7dea96e38f

SHA1
23bd6243fa2c61c07a6df0fdc9e490555d4ff865

SHA256
a3bdde26ab24f95548a8041a7ba3f1fff55f52a18cc675f80df102d1b1fa9a12

SHA512
14ffebb082f6be17bd89d2243e80c5e6234818255cf63ae523ccc0f5aa2514af36bb8895fcb80161e0b396c0ef82800ac0bd30669585b169f160255754cbf87b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a0590600154a15599eaa79bfc1839b9

SHA1
30470237f9c28bc03c2ab7b7bbd0d06ecd2f4fb1

SHA256
497f4b392e911220428c1c168053632f9e914a708608b45a8552e31d650685c0

SHA512
0ff2003b2968ed08ef282a8a0e569e672721bcd87ea22af0d8e66627089c7a16d2655b527a3aa99799ea4d7b1da02b006e6c0d65a284f415b644c8d0506d787f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a12aa50449adebd01300fe51bcfe060

SHA1
7c176b9e8a468081f1d64d4e319b94e62a8a2dd9

SHA256
d141d030cac2a714069f034dd82e5ff6b7d0b38ca2782fb1cfb0c0ae0348f5d9

SHA512
fef23be1df040bb84b100e7bfa2f6c19c342779493133d7f60df8dad10cd17c825e5d746adede1f6d524e0653c3a0b5e0d95fafc76e8d274dec6ef541d05176a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7d9709242f6ea1763001f82962f87e2

SHA1
f134408299bfbe094de1828adbea449154472d8a

SHA256
61dc94bf661230d1881750db4da0333fb1c41f2f1c5631fc59e1df8a4217396e

SHA512
6c06e362d7f976b4b915709c2f4d0d36a0275a022e906b4e6e42db2a05a9408d8e34efbd9907eac30106a9da9d472be5d95cfd40e36c7881fc021227d636de77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa7f51fe204bff155a340e1c3fd8d970

SHA1
ccc06c5b825e257e89854aa1b49eb636c2004da1

SHA256
26898f55ab0b0b39aa9031987f4efa6bbd4472024e41f6b87ce73480d6eb83a9

SHA512
fdec96ea7a04ff8213bfa39b121f25e22eb502ecf1cb32d61bc77a7090f697eff59cca953c9874e51fb32e69a50b090e2bba0c3cd56eae84ccef083ee4b4f827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0b992ac0fd57770d6488d01e7b146d1

SHA1
f670d714fc849165111685977792db4ee9bc2273

SHA256
7dd1a13d23a4851ff08b0db0e72fa560b3cd291fe18e9b456a2ba5bd3b552d17

SHA512
e7cd6dd32fe88289b3b25224c48ebe011f47786fb478a6f9953cae2bdf9db200c4469cb3a4e369dfa58576c277e650893d2c2fedd94d1d2c01547ab89239e2af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a988ea58699ad14ece55765a41597055

SHA1
8c40c56f16f3cb26177c800b362404066458d8a2

SHA256
403a829b2b266f29b22f144c559f40b58949b3b6b9e128cce207ae601a619493

SHA512
d4f6e46ffe5c24b1088323054ddd5de8c086b22dcfb30d17daa7fc804a3a22f934a203d52b2a60cd45bf9cad8c69e7267316011067f321a155b07aac4c2e402d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e58165c13e1961d9ddbb546fb6bfe43e

SHA1
cdecc3e564e82b58b89fea60125c8b492b619478

SHA256
8a01da418261e8e05ad759004fb67a64a70e1a3510d132c3c0ccbe6b16bb52f7

SHA512
a88d6e226a5ce5b1504b440489e8c994933b8d0402835319ac0aeeda17b88b73eb67cf9eb3adb706e3aa2e2ae3dd442a27984b4b56d02b233affef61cdf10470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
833af65bd81cd5148595dd6fe2345676

SHA1
bcc457c348adc3ab5c5ebac4dede72daf94fe143

SHA256
681a6fe8691d619f24a407aa28930d2564b23c90623ece167f47251ec4e68250

SHA512
08dcdfababba564e9ef7e12bfdd9a5450d6139c7a6f0098cfe11ab4cfce101c6a916db094785f485247a5e67ef5fb09d1baba5e2242a0670e3d245e5ba17d5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb68e423a6bc76c09584a8d3683816e1

SHA1
6cc1d0cc1bc4edea296dcf1ed89ec74a61f2de07

SHA256
4e7f29c3b71e926eac10b660fcb20e33a165a2f4ad79a20e7df9ec904484ea78

SHA512
b50a433af0759539bbc99c55ecba45bce259d7b81e876eba4f374d1df74954b87b6dfeb356bfcfbfeae38b3d8a06762d308ec09efac29bc643f3f955b88ab3dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28d35de6e7617ed032ae3910efbfdeca

SHA1
a617c36eb7ece557499ec10571966f5c5d2bacfc

SHA256
05243f581a637631ec631f950765dc692c8b7bad0a896fa27ea3d969a8586bd4

SHA512
92aa12153af07138ce7e68a074c5fd84d5251ce9eb1df8a0907f0bfe6c3d8055825bb7c6882b4e205eab7571ef6d4775bad5ff81e457ba4b12d3c2eae3a7578f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7644289ae651858e0379cb33f199c0dc

SHA1
01d1b5b4222db3308812dca8187be960edc544d8

SHA256
5978bc8361076d11d9acaa8fa830d0da4512d750ba9ef35711dde7e453883e5b

SHA512
878cfcdd81630350bcbed26f022af77ea8efd28d4e7dcb163a1a996e53f29721e7a261c453b80c181fcd0e2f61ad81b5c378b83cbb537a87dc0d060ed7a02f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
be9fb4370884d6f41119cd474ab79e90

SHA1
8ba7f2ca8f5a4e3d73aa04ac905f828470de065d

SHA256
9f3c7dc74bad6666d93519cbf25fce20212a82683de7ff77eda40cf21d29c40a

SHA512
fab92de0048f2fb7805ddddb669ba0b2a42bd0cce748239fd7a05583484178d19c67238cba6a21b9a1a1989d539c70b79815a772d2b698ea99f0275104aa45e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
480B

MD5
8f5168bfed915fc09285b5841e54398e

SHA1
94a76d9a3e9cce173abdfd91c2e293d23035a364

SHA256
3883ce63c4d7cbb053f7751d1a00c3fbfc8c60850a6125db814594bc54cb7138

SHA512
a49ba79c5304f932c945455632ab507875d3819111aa9f8678e3a40b14539e7c5d8228578d5692be129b140530bb41c6c46b86252007691b746c91510a04268c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB040.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB043.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit