b6a1cb0fdfd46100e21e2264de8f3c7c5a7dc7a0eb6c74ee5e12c544f2847482

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e8552eeb64f8ace15561741cd729355_JaffaCakes118.html
Size

35KB
MD5

4e8552eeb64f8ace15561741cd729355
SHA1

4ae682844c07e86f7fb40f114c7b3aa8eaf035ce
SHA256

b6a1cb0fdfd46100e21e2264de8f3c7c5a7dc7a0eb6c74ee5e12c544f2847482
SHA512

ee05eb678ee9e859d4d409595a19fce7dd0d992e63cb78120f2135e12474deffcc06e2157ac08ba274134eff854188a74a166e4520583a4e56df64b76bedebb8
SSDEEP

768:Gge9scwk7PrN1i7y5hY3PxN/qdbPZyxkrFuK:Ggfk7EPxgdbPZyW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90266AC1-140A-11EF-85B9-4A8427BA3DB8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01ccf6417a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c9a1726019406fcf1be3f1b5387e10a09f1c5b1bcc3ef06d3dfd1c91a31abdac000000000e800000000200002000000061656f0c860ccc04e3c7b5012992aeb4588987dbcfd641ef1c11ad6c4867b1c120000000c0cc7ced334af0550863d8a03d14c738c42172c7c46f66185122d774c39a4dab4000000093ea4f188eaf72e9714adc318a5d60e514aab4ebdbdc774209f0cd123094b7a4ca04e572929af6f6e7ffd011f65d1810108b13ab2c1fbd55843966bb5fee27f7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422083979"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000aa87f393a707dc18556c4db0f8a25e79b42540c25daa1e838e2699cf5af00758000000000e8000000002000020000000cd087f3c30223c164f5145daad7618e6ea97d5543cc048b003c2c6690380ec32900000006a343686ce8893ec846213d95f4e2937615b35861b6679f0e8d861cba098298eee24e1aa2f25a1e4d6a79ee6f1d4a0d39ed2f733e342bad776c109f21bc057e698e9d9090e49982e0729735926e4b844d77fbacb4381e84c8832db7ce5d1b86b00669a94f7950e664568966c67ecf84b16ff6df1c84304a699abc2c634a159689e63e613cbb2c2535fed997b556bf3e94000000065ce5755c5cc334610429b6007066df558f074cc04b1184a5e1e27b2da0439af1b1fcb9b950473ceb5f9a147c4abdc13351e85417793db553dc1719b29714ffb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e8552eeb64f8ace15561741cd729355_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aa16466242c27e3a6bcce0b8b5b133c

SHA1
6fe2ba9240738b945a178e0f75ee1c9dd79f14b9

SHA256
621e8bf2f23b4e859e6fca4c85d3f1d1b4204a351e7e77ffc2a9b78bb04813a8

SHA512
969f86cab9d26b9126785b4ac3a4ca52b7e579d637f589df0147c35dbf40a0a6b0ecf363386ba13b7f50408a8956e60bf37f7e549de43cfdc2e905e65fe87bb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cd63ba58122680d2c1e76ee1f832fde

SHA1
d911443de3d5ed721e244feff4257a4956511713

SHA256
5ff8ca7a2ae99bc43968aa61ec143405acfe2bb0a8de505a802511eb4ae0e0f3

SHA512
630e1d70ea86f65887bdf4d9fdd80aa8e42ba1626f901525c3aced210a7233a11ad561a91083992e6b6c7aca1624bdf279db3f9adb48a8d70cf6571054269543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a54fac6e9c4914fe4a542c62f52d065e

SHA1
25299cf84b4c125752a6f16e5f53cbaa6fa4be55

SHA256
5d62e479b13fad2cae778860cd47a9e6b0548b589e01cef61c569c37ca6e21ca

SHA512
70df53c8d2e46413af59f2ad1cc5cbb483fcbb1668c7486b0eeb7ed318d4412325cee05a770cec0539a2aa0d3a28bc99b2d8375f1b968c1ff735ed1db7dccde7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78e75bbbc07faa8f6f4cabe8cefc70ad

SHA1
11eff17a1d599ca998d688c3fc3d5f01d7a0dc75

SHA256
597b669752cde577739b8fce54de7d15919f39f9c2eeddf2736544763f9ba277

SHA512
4d6cce855128233b91c7a9a5fd4ef8833e57c8d47300a9af07f282964639a2dcfbd8585ffbb55bd4d09eeb28493921a9eade5734a097461d22381913ecf00510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f1930c60a94d6e78af3eb97c8ca967

SHA1
e8785d73f4105f184677478f4c057b663e004074

SHA256
8050f9beec05ffb80d85e1cc169e75075a3d574932958e2c4b308925e1a38628

SHA512
36037f988c358720c858371270ec3f9898d0d1bf94eb8cdf8f685c01d364cafbfb57a7519edb87917a49b365bf67ef4ce7d41ac1343836fe05dd8c7cc675ae03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a469bbcb1cfc25bc8c36f52cb537bdf8

SHA1
28c0e28444c797cfae10d416e8f7e08eaf2f3d86

SHA256
46fe11283f479d6403d163f4d3a4082d054532a41369d2b493423281d5718168

SHA512
001c816e525ca6566d8900fbf0299bfb658c87d76243058cfd30c6ebb577da15424b82ca52882c20ffff5e4459894836b76ba80fa3478b12132a449cefaea94c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
856040d1b35e5914e73deefbec02029f

SHA1
68e44448e30d89f48c8caff91d6e7d09977750e0

SHA256
7665a2d5242eef9bfea87ba8d1d2b08cb73b350820540d8a7846f14e65e8adc1

SHA512
a89b8c6a168eeb9891dc0324dcdb94b8e339fd099f99d6ae0f8fe75f555c0de8e1cd0e063d5edb3356e441935911d7620bee6e1bb21f57ea03ef82cb3769b506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f32cc953d986b047424943391c3f32ee

SHA1
ee4b27c857405dc94fb05b4f72a197f1cadf94da

SHA256
f62d0248fcd720e6a3d2f30c118dbe1cfcaf1afb67dd3763ebc7ec2222c2876f

SHA512
2ad0e6f02c2d7a36c06c4e3432d3bdea05f8cfe44beed46c9b1dcf68033c9afeb5fe36668e75f28fec924380096ec11816d161758ef3c5bc43d046e17cb97157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2208c857e0c085360b3284992b6fd1ce

SHA1
35a6887f893ad2e8b77e3394475802f06590436c

SHA256
321d0a02cb09640c805820c50a63a38da4a9d680b2205354ebbae6185b73be04

SHA512
7dd439a42e6a4bbbe7c7906be54901996e79f6bf1fb5889a89d24130c64ec25b91ccd76779c6dbf1fdb28a906b252803de164002a1ee094bd9a8c8855e54b591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
915f2d6b070a5abffc0b38c2cc62d064

SHA1
8957519bf064a2392b80c2c5fc9d7ee45a9c5fd2

SHA256
4a3012f40ba76dc042119dc3cfa00b4fa2dad9af6833d43ee6cfed19964c3483

SHA512
5e64a87edea4f7929fbdb711d12dc53b824f94841479da0adc1e9bd2794944fd523c819c81b2654233738f2543702f141549ef9f124d4d1926471cac1387729d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88a55584778393dea5ff9f13e07fea8f

SHA1
e7f50429cbb45d4b925e1b935ae511301bc02906

SHA256
7c6016797fbd2ea2bc8d96472e6c538988c898fd856cbf1d2d461b4571423b15

SHA512
8490978b4b3712e44e4baab1f096c77081a0ecb7eaa641afb58429bdfb64a6f5f4c8809a95b54b423d83137d6ad6a40f1e32b25840a70f22ab01813ca907a637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
599a4f088baa9b4a301a14e60aa6b9e8

SHA1
50443598f2836801c5cba6d6eeb47a07f3844dc9

SHA256
4b8e3988e4b1225104545d18de8bf10b98fade684bba6de951a8ebb9c304bd0a

SHA512
ed872273fe0dfa720a76707fc138e21fd71ff7f83505e1c1e684bc85d095baca40b5218b28b9e48896491bd682330171a2a3856246f39b37d1db39391237effe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02616ec741690b0948051aa128ca0c79

SHA1
9d25fa8363ac765b38fd28f2f50b6536a0459fb0

SHA256
95db5768ef381476df63dbe09c077547fa3ecdc3e0b30fb5921f055d4b2f973e

SHA512
87ab8bac923751c2051d5303dd5b6bf35bdd215a662467d9d22274389935347e2841c5bff428806b35d3c239b42c9cfc38547fb08b2b30f2f4398ce4f3d8c181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30541751d0fde3b4d47b6188bf033977

SHA1
59819e42161ab2493272564ab7944daf44ca3dd0

SHA256
b84d366cf54db1904940c7282bf65e549b4f986dcab45cb4ef4293abbb07e6c5

SHA512
b53a98796837ad72470d43a8aa66c5c35ec8fddd1c2bd4659894e96ad39af41fdbe3d6d6fa882be651a0fcec6a7cab1b6f95bac3bf61dcb27211b94e42730cea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2628.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26E7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26FB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit