eee3c8943320346e493ae93644e9f507a0fc343e6161698bcc3d8e24329b2e17

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b6a5800db22a2e6bc3f10fe6aaa6169_JaffaCakes118.html
Size

3KB
MD5

5b6a5800db22a2e6bc3f10fe6aaa6169
SHA1

5cf4e4c1350ab56513e20f89e1b0fac479b6703a
SHA256

eee3c8943320346e493ae93644e9f507a0fc343e6161698bcc3d8e24329b2e17
SHA512

9f339062a2e7c15dc9831d98d21da636a4506339bf1b4129ee3468ed4a2a1437f4af57f9ecb5c9b2dc2179647b251dac6e74f72b9948f690f79a7ff0d96a4f28

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a610ece45b7ce10eb7057b2622e8b24b029e4638f1bc8e070566e1f410393329000000000e8000000002000020000000445f7619c8a02f7d6fe0a4f6708cb00779c874ec8a90ea1eccd3fd14f7fc73c020000000f57a718e2172d15e586a3abffde9a38d8b4e8303fb42f833d5bc56e8f82d20e64000000031b3f87d079583e011a62ec59ff0102ff6ef97a53a4f10f6ea93c42941e26fab0001ad17d0490fd56d1013741ead6be347fe64a3a0ee0259e59624c2a7aca6db	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b088d630d740234b7ca60078513631051d43a6db494112045a8998914b7375db000000000e80000000020000200000005a63651f6f7507768acc033f5fc0f3eb511a3d16134b8816bbe836a019e01e1190000000c6dec21cd4b8ac85395e640ab454b4de08515ed13e4cae0366f77afd261a27eb93db11bf1acc64bf1bc1f5a85a29fedc03a6a837c0b3941ab64165886255a47d7a39504d088ea9c1032a53d418a0db0810f1035e521ad5cf6628ebb6dd86cadd6a4b55f8f181f9f0a6566d1c8ea7a7b33bbaf7c36409abfa804a23cd51b8117055d6baf9e6fb2c385004786d372702ca40000000b96d21281c322e7ea8e264f1c8ed76a3194069fe8b2ab097ee48a0d0e99bc13c951b3c039c1fcb8fc343d2ff7fbe3b851826ebc0eced9c08ad29aa5f64fb94a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC8E4B41-1621-11EF-AE65-4658C477BD5D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422313856"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903232a12eaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2220	2580	iexplore.exe	28
PID 2580 wrote to memory of 2220	2580	iexplore.exe	28
PID 2580 wrote to memory of 2220	2580	iexplore.exe	28
PID 2580 wrote to memory of 2220	2580	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b6a5800db22a2e6bc3f10fe6aaa6169_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6ce7018c5756657579c498703ab215b

SHA1
9dcbe5616f023e745f949b024f2a52aa90c65a67

SHA256
dc4a2d4cdb3e4404cfd79e72a7b748f6d0e90bbd176054d1b01d0e6059f256b5

SHA512
1038d6a70cc6458f1fdf0acf2402d274e2b8ffe695ba70dfe617aa197961a83ac6dc837a8b02ecbf01b60ba97dd70e2939ddd38fdd674fda16db202d55fcaaaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8996c80d4f8af2ac2d715dd856312ee9

SHA1
0ce410b6321eefeef6b1f0a68b5afd392477aab6

SHA256
97e82fe0bb55f6a04a1028be2644b29eb7aabe33ca4c0b455821dd963cb58dfb

SHA512
8ea57816ce7ca15630f2217077f5705bbcdc13b586dda6e4ecea0b38e3f14940a30bcb31316a32e46867d8471ae847c0338e1e69c3a682a26381d97f8f22ae1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a0da944bb3df3880804d1ecb95cdfae

SHA1
5747b697a0457b7cf609b89cf7fc25b12f4ae642

SHA256
685b6900f6ed5dd5e828783fefcfd14386419a179eb5cae3bccbf9f25bd99838

SHA512
08b86717178ef82ea01370b7048ef6177b9ba9c08fae7f68b1ee7de5b17a796cc21094c9c524098136f05fb2dafa3f27078dcb0a9c810372eaf496934469d514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cee687c7cdb251b214fbeb312672430f

SHA1
ed03d0b7c0bfa3da69cd1cd7b0bf456b80240529

SHA256
9ce4b67636e093e3189c64e95dd7fe39be5b5e02387a09ab82b3352b24fb1831

SHA512
389aa5090401f411a7709efdd0625774eac5835fbd790c5dac2b4199efb8c4174e9cdee047bf6c7d63e4ec2b728d0e9f2e4afc794ddf9430aceee06274103028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a78236c114979b4815512992bfd0bf3

SHA1
ef94e1345a1b7371930a294a3c4a023e53b803f0

SHA256
249d440278aa2974f87245344bf33e82c3520c310dd4afa13d03069b0c8f660c

SHA512
064c87d0d644e834e76763adc9058fcade1e8519311856757c48359a175a09a0533dc0b7fa1acc7ea5d489073019933244bb7cfc2f0dd1de7f0bf0e8a5f25554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7490cbf5b6cd5ca120e1152a7d7b81bb

SHA1
125cadc49ffa4f6196a41afb669e9cd2ab037d15

SHA256
cc97ab47e927182b3afb00d18e2da0cf59b583a4a1931791b7964ac0467fd620

SHA512
5654d1f5b70865da1756262d937d87f4284e0fb7b30015f5596c0ce1274995d34d5c17aa5aecc366027253a946af8f933a1ff4c65f6283aa0bf9cee2dac506de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6b127271a29b2ff707b5b0416f82f98

SHA1
ebf72fdc12a49fe80e30dc16f47946ed0ed84759

SHA256
c05d35f54295e26b2eabdb812b84019e4b7a9e5d90aa21928c1f3cd469e9fe34

SHA512
752eca0d6bd704b8434dbd4fdc5d8c3ff70956f49b52d96f91082ef9a6a0a6f725d983f0e210b6823ebdbb15d08db9e8a1be438b6c1baa44eefc932f65dfee7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0219502eef8f5a13507b0aa413c374b

SHA1
32928fefa764fcaf23316c096e69341bdfc054a0

SHA256
e248daaccb3320313e61304efb814d475bd392c378c71b3d703ab8c08686bed2

SHA512
5a190da878da134684889b6b8f230e503ebf169739e4eecda95ef0c45fd5e99d3e7ccf3e38693ac856be7cae53dda92032d1ec2531ba0b60ce9a543cbe9ad5f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c293e843a50d8c760a79f087c18eba3

SHA1
9310337a7bd91dcb5b2246fae90f55e49d9ec8b8

SHA256
6ed2471507f4d349531d7909bb479d56aa48255f2614aba65d7da32a6cf71a60

SHA512
4f81110ac3a141deb5fe79942ed247199a7a4da3322ceaaa6f38db0eb2f53600d735ee9e62982ba8cab80f980de6d76bc85813025ea961e18669d10771f8f5ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c2dab96f893e8972c0d5f75563a39cd

SHA1
c7c827975da24affd43abe81b6b1bfba8a367f0f

SHA256
3c2b1f22ac746f1c39a1103cbf13fa676471d5ac76ebcb57d24d871ec0161593

SHA512
569cbce03697919cf8f71804bf392d4170d73ce0e406439768587faf9517e221d1324a865f82710a5b13bf08e83c148213b1687a2cf68cc8017346f9c215f892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbf4d9f9814538e1f2698e5e9809ea7a

SHA1
a2a65e4b20be4f8a4d3a62c6ddfdf1efcde1fd64

SHA256
a63ca1450e850d60ca778508412233286c29517be50617bce80153d187cf820f

SHA512
82f75d7043718bf45b0bdcc8fd526c8f5feae8a62734792394b66f80e3549486238442407528ac3191150a7299a0a60422782e416301cc89db6e4b704d8e4ddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2685f092d30b45187cf36a9d45fbcc3d

SHA1
69b99c6bbe68fa466f461d2475f1ef0adecb51bf

SHA256
3a43fe66eb21cb46331477a28b675572fdbc8ab5b83258bbc85f00636733d779

SHA512
be1e5514969991af0cba603e81953ad977932b10d20e5f239df5c84feea48c5cd06fe5230ae1ae84b00518ef63dfb1ef1d74fe442ebd08c030dc2477121bd9dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F6D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar33B4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit