b1cda84fb0ca1e6b58294433c9a8006ce8be602ad88df2c737f3cc71bd5347fb

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2651596ebf81d736af4cd7688f246d45_JaffaCakes118.html
Size

460KB
MD5

2651596ebf81d736af4cd7688f246d45
SHA1

9d5c330648d035c591d689b1b1cc33b97e55fc82
SHA256

b1cda84fb0ca1e6b58294433c9a8006ce8be602ad88df2c737f3cc71bd5347fb
SHA512

7d4e102d5b580bba0723221ca442fb9570e792c577785465c754bf3ff4875c76d5898b85e71b6978657bb4e239599742352c3c1c9f22c125df39c628df118d64
SSDEEP

6144:S2sMYod+X3oI+YysMYod+X3oI+YD3sMYod+X3oI+YLsMYod+X3oI+YQ:V5d+X3+5d+X3t5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000dcba08320785907473bf22d4562866b6a0f3d42929540c271c61945cc3b156ee000000000e8000000002000020000000b701ceee60ea3a220244c556602a6a36f4a84bd6162e02eb25f4b18dd117999d90000000bfcce9e5c4e7b5c2f97a674b11177595624ecb760b74e6df8823908af9d9a03efe82ed4c365b20459f21a8637dd0b234ab2bd187453da62d6ed9449579b4728e9c60458e86d596416366dcf17568d367f255100d795655bd9b4553ea707a066f29825c35a3d953c78f201109f97be640c2e3edf46cc9eb042a0317c1455d8f2117b2c4517d10eeb6cb18735251afcc2e40000000cd8ae5cd8e9bf0a05473c6d242a61af3a2e738076d6acfb62573849ccbaf572b544d75f904ea1346bacce40efd8cc7914bfe2cb7c44dee1ff0b08016f36b4d25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000069d872cc7e3c2596fbf01ab8645d48f7a17bfe0a60ff77062e51741dec0c2fae000000000e80000000020000200000000b2768a97cc9a60d069feb8a0726e0cad36182bd565f6ec771bf684564c9bd7220000000d40657d8aaf8b278286def7486498363f03204461e7671dad4035c86cbd1fc7f40000000dbc49a86e46940184b016f3b748bbc4ea7d61f687eb6cedb17bc4d4e5333b6e2c28fc6ec72d2041bcc7842a0d3c26af152141120b049604a34f4f6b62d05dd1c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53611911-0D6F-11EF-BC03-E626464F593A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5086e52b7ca1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421357594"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2516	1876	iexplore.exe	28
PID 1876 wrote to memory of 2516	1876	iexplore.exe	28
PID 1876 wrote to memory of 2516	1876	iexplore.exe	28
PID 1876 wrote to memory of 2516	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2651596ebf81d736af4cd7688f246d45_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
449cb3c5b7166a105be685b71ce2258a

SHA1
1eb82f24da841026e14d3b9cfd925c49b5bfd6c8

SHA256
c9736032950ecf16abdb8164998d42c7375c553d6da0445767f54e9f816e544b

SHA512
eaf6c682fbe060fb1460b7b2e316c32427fb3b52a9f784ed07d7687c20ace499f2f1ea1aafefded4a773ae9b79b4c282ee19b5623b9ab05b1f262e8ee6a74f61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e81658e2c68be9b58ac6a36aa70a246f

SHA1
17c3c21f874e273e9c09ccd99fc1afb91f92e0d5

SHA256
c664dc032ca4af1a2b22416af3c393c018da6fdf6db1b35b49576f62ead1f0eb

SHA512
6355c97f410f458d010478b6baf779e10b7d1ffa08f0ad9712ada2b8418e2c4b1d954df21941eb0d977034b6f86547b72d7098e52a0ae20f0cf93df20b987a6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
02e8612a976f46c93db8ea68f3f8f0c5

SHA1
1d5de28c4578ba293e60b7e868c3e1eb9cee2744

SHA256
00eeadf2cbdd89b98678a82938ce54a03a9026d5174eba2774f0dc364dd86c3e

SHA512
4b898a441506d54c1ae5de911fef873c0fc2afb312e85a9255b51129c0bd59180973e85019c52ea11df4df2c45284c9ff9e2ece24459d78f2db16005046df082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8b0128489e853ee5ce08119fce3aa3dd

SHA1
cd8e96ef38eaee96faeab7316e2cfe4b57d786a4

SHA256
f2f1c45484c3cbe2b71b6fc23359d57852bc088d842e76054d0474bd896e969d

SHA512
84de691ef48b7221ab37663d59e9586af0bfdc57e9d9a7fa221de79b4a3fea0c6d8015f159c085f8726a6fb3fe85acce5333594ccfbf75a4a690e1c2e3d9c1e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
aefa19d43a023257dba1875f22fd25ec

SHA1
cf63a1aad01e859d89a68578edf0d805f2e46f72

SHA256
630f912acab30829148e2a6074b5f580273f857abebfd9e0eee11f8d170b52f6

SHA512
8b97a14eba119f1dc56d3613c8b0df39fb2bb7f139aa24f81f4aa9dd97e7503d78bc95526786b3219484d311d698c20975f1e7f93b9db6afe70641404104a394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dae0551ca21e2e9c68703fed1141a50f

SHA1
72ae155629d50bcecf26ee1e5b7d61ae91c0eae0

SHA256
74fe6199342770e86727cbb814c0e98e938600888db2ce127c0a599ca73e8f33

SHA512
15f9a223aff82d08af04f39c4d17e2fe9e454e582bfc9952f9092d1c5ff4d02a8926526de79cdef23424d16a49416e4f3073c272c1b3dcd83cbb412052772309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0f52370b14bc52f7b4d9b7d09e439a3f

SHA1
a5a37a02a3d6a26884337a10fb4756fc11d4bc78

SHA256
6ac1496066cfab0103db321e545dc4a4914b9b3cbddd5bf4e88cfe39838c0ea3

SHA512
02ede3e45c209cc375493f3e96aa52ab8c6495d9d8907802bd1f3055a1b068e6b25c829de4bc08925bb42a32d26eb64a30484332f2419493648b4da8dddff403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
30917ce63c59f44b9591e800aa32ccb7

SHA1
e48a38f28467fd5fd0269dfad0a29695700b9dc8

SHA256
3359811a7a622c9e4cd769e6649968832874c6044250cbd99a3e3f649c1a89c6

SHA512
71306bb18960848ca7a99207cfacfd35dccab5f9431fa49f1c753d7cc9d4ae6b77a0b7299c34cf4b55de507cacf958d7fdef851dc4377c6b56dff32eefeadf4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5723f49f6f261aa112367e7592af408d

SHA1
fcdde5f4d6c83e6f6e8f0fdecada326e808511e1

SHA256
b16a7e0acb2f4430406e3ebe01a906a09d608b0d2593e7fc076610b19387e602

SHA512
98c52b4cbb9f6e667541cd8be36b827dee462809de8aec96413f628399f77a086347b1be0ff267c5ad6cef26ee4bbad2ac65ea73e1bf1b64d581b4214deb8359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6d1f180f2ac91125509442b60b1d44d6

SHA1
91063885e3480bd1296a27fc12533a59d1e06a76

SHA256
712ad8653005e237328e87b04710e34addd2b7f68dae188694b3f4af7293668c

SHA512
a854d6bdb955a1a3520bb526e49a27b7770fc22ca79fade333a67ec8ddeccc301d2a479cbf92f4ca1f79e488a4328bfb12f072d5011d69211faf71e82fcd4ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f29b7f4c1f731e186b2342134cc0d6f8

SHA1
db84c4dc7af73427428f8e077151548132d2bba7

SHA256
ba5d914adf2c78b511a3fb2e0aec0530edea5988f8a3a7de922ae227531581c1

SHA512
b5a57c514623b7c949c38941e173a0dec7506b99b9ea4e1694649404bfda16e582bdec9d789b5060537d2dda7755eddda4c73c684627085b2553b9d8312ea081

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4544.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit