a623bdf74db44a033cef53c508bb14ec44df42f35d3f55fa53d4f099fae0d1af

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6119fd6f19e305ba56cbf567c66a462e_JaffaCakes118.html
Size

213KB
MD5

6119fd6f19e305ba56cbf567c66a462e
SHA1

808c8208d3dfa9a06b404ebd98693d5ef7671a0a
SHA256

a623bdf74db44a033cef53c508bb14ec44df42f35d3f55fa53d4f099fae0d1af
SHA512

018c582dc0efc23b352e4a37b9d1dafa1360e222c72cbf1e43c9a3160296c6824bd7d7fd747f86de8f76370c90b1d4348d8140e1b242bf6b4a162d3380c74b7d
SSDEEP

3072:SEZIhZwrXeF7MY/yfkMY+BES09JXAnyrZalI+YQ:SWv6KsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422405587"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FE086D1-16F7-11EF-9A72-56DE4A60B18F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2656	2468	iexplore.exe	28
PID 2468 wrote to memory of 2656	2468	iexplore.exe	28
PID 2468 wrote to memory of 2656	2468	iexplore.exe	28
PID 2468 wrote to memory of 2656	2468	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6119fd6f19e305ba56cbf567c66a462e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c7be38e6879fb32303efb2ff7a7c138

SHA1
4b992cb7e1253f5fa119c0a3eb289b2e4fd6a568

SHA256
90b7f81958749ef682105374c55f3158fc76f0fc7b676def1ff0c422c286a35d

SHA512
37196cbf86114c8c2f3923bdf391c22f2f774a8648b2065f061491b2d8c0f8a6ebaecfd694333ef44bdc30664dbd72b86c749bf0529c0d467d9de2d4e484957f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dcb2e71011ec43a429811d84db62501

SHA1
b7e908e4bad3557eed73e02e61ddd7c000e0c96b

SHA256
957edd68d1d542e6d96d18eef7f485680dc67bd66fa98942f863c6f4628f00c0

SHA512
e1b2eb2f205e5311a185f5346b05fe142c5e172db77555196dac536fba74230ee2b74c045adc6aa76dacf8cdcd76de6184cc7c105f61a8f207d2af3c49c7b0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ade807aed573c854e4e216019d3fcbb1

SHA1
302346b2be1c1d92b7d6caaad9145003756db0cf

SHA256
6c16734b0773bde6d0e8acdeb7edfc3bdc525d687bec1397b8698951aa59a1b7

SHA512
af96e37e84f1a71570e6e6766c12d4b206f9ce269c63f2f4b64d67db845d06898c0ae59f5fa1331c3501f80458d3fc748b19abcc7976cb061fa919e03ae408ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bc8f0de4f447a77216fce0831479073

SHA1
1951b0dac00733129262e84c57757434d0e30d03

SHA256
5fcbec3ed74f5f974bb5155649cdbec6ff77176e743a7e07b6a00edeea67a65a

SHA512
7acc11a0a70faab6f5e65b5864220599d0a3af2388c793df2fd8d439c0d4b87ba47bf81fea4a40617130b10e9130e622f4824da401fdf8efe8d61c84a3e2bb51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85808fcbf44c5d82859b1e42371bd472

SHA1
f853c6d68a3ccbd98d7ebac60d3a10247f220999

SHA256
6f9afbd5c61a96f1c68737a29c2533deb81d650e51ac88779e6a71212b99444f

SHA512
fb772e6b3afb42b01035cf699cfaf39da501afb3437536fb351c3a93e52ce491cfe7fe64bf47b1b5201d8e529af075d7d072460932a461001b5854f6a0ad5bd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3510e7ec282a5312c678933d2f333a8

SHA1
d3a51b244cb51e5f3f3c35ee81af01e96ef786ff

SHA256
48c19808ff8621d560ce9e1e3a6c88848b32557e63e61d8c0744aa6b9656f454

SHA512
f6b08480d056e90b03413f0da68fec2837cdf60defa10de5c58d516d6b2b4f65ebb3347bdf57dc0d6886ba9a3d448407d1ca15708b3e31d4400c461196d07b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31cdf942f71c9f6b9f5295e004c33900

SHA1
83d1cd3f9524884f7033fe3b2f2668568ee86e5f

SHA256
5f94a2bc2a9678e6c249fb5ba74636469ac7753581202c5aefa53b82d38db1a5

SHA512
ddf949bd6aa16ab7f975519c46c57327ec35b9ae4ac8f7da42541d8e803962991409ae7b871f02f484238a074ceb8957054165e86eda57a03305928d80e6fdf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25443bcd5184a82446decf9ce1d34baf

SHA1
cf48257f8987dbf9e3d53324755fa99221ac607d

SHA256
b318bd44320838554a8a24517034407b96d2df9e54c430b5bcfd17830bfb2610

SHA512
3bc8bab67293b2346a436ac3ef607fb512abed75bd31af0355ad7f3cd1eee2a6f778fa9d8fcc2070a491223b32a7abf9c89fe7f1f2a5c79937c24a5478675d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30310ff02d837e210efa417c4b60c1d9

SHA1
9370d8bf9e06fd39aa4ef4d746210e6465763791

SHA256
c36d86066f21eec15e4f443d0589de33aecfe682bcb75008c9b4dce6ad8064b8

SHA512
07345607e5b4c71502951a3ea3572c8b5db900cbac5d1f40ee9b3e02d39451974e30825d4c37362ad6e7ba56ea076e4aa2e72fd54e623c2ec3e2ab7ac0966028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b390137780123da9213db45ab8dfd49

SHA1
a56cbe97e511daa154bbe3684641c0a0bc2620cc

SHA256
796bfca091ca09aec4fd47656cca9f7930901d80d26adf42a8c3d784ed28c023

SHA512
68d4bb3b45f2bb139fff689bbbd4d1fd80140fc75cef813d105022b3e10c88dc1860337180b7bb57b603ada84e9c323e821d5a77c9c2d83fcc834cdcb13d20fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23022f8f16553fd00cf5e231cce35ed2

SHA1
6857389f715bdb1e2e30304b4ed1750148e919bf

SHA256
8154d5b6fd194129756115febd6064d06c45f310ca60fb268f2c22cfc62ae339

SHA512
2ea02e7cfd95e105f4a03d45dd698d4f29a4fdb63476c661b57de89f4b695d4ef9556ec3119fd1fc5b58f246e2bf750ad2bd180ed3827510e3b232c5e5c8283c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97a2690142f5f802d46085eeff0eaeef

SHA1
504d64926407db12945a9ad8467c3f30bc9d6818

SHA256
65a4db5dfe589548e0a0fb65df6daf559770ea6293ec2749267f178bafcac265

SHA512
ac278bac9caa78f37196fe8193e89f6851341b42f0a1814c6f4b258f9b0fa57b7711c14de8f5de81e96d7d174be56ed95f0ff3f5d4ed133bdb04d8bedf353177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca01ed5de3add66bc06a43830f4e1192

SHA1
e41989a665296a52d5f113240ae1ca7785394488

SHA256
d44781f46f91bbba159c02fcae8fa530db4dcf4c5f32784f20c290cf6c5b8f2d

SHA512
574eb839f738c247a4f5d2de6c38f7025feaee5354e0624fea24a6a69a2f8e84c45de6326f446a984a67445e3574b0747e278ed322f5f6baa46131dee9d524b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c8b64a02d3f9febb2f53f9ef587940d

SHA1
90e09c88cf218b6f42651890d4a4926f545d54e8

SHA256
baff8c666b1a3f75ed0e66795caf5c368f25aad77f2cadb8b6e54f696984faa1

SHA512
8aa7ed77e994e84eb8ab89c53752c61c2fb0ab1aa5dd891adc248ceeb5adf61c1ca56e84b4ad9cbb11991084943025bf11188da9ad2a5636b23804e515d1e76d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
353703680e4f1da092628d8d0512db37

SHA1
2106b8fa9cce3eecce0700c0a3775f9577ffdc79

SHA256
29f73c0887a8ef6dc665ca7610bbe4346030acfaeae13e3766dc60d1e1f7b5e7

SHA512
4a94bb4268ee08cb7382786ac0c69c7d9232978d2b7efe3e7ddd5c76940b15bff6f510f2cfb5f3503a19e2b43b64c68a1143cbeab9a46d6126ea8c3c645d8952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2118484fcff806b6e7c2ade33e5d1af1

SHA1
4fba9f8724ba463dc382fc4557aa8c3120768bcd

SHA256
921b95fc6fb444bc0785f3e9b1a0526099dc53076b7fa816f4bb46f537a465b9

SHA512
77ed7ceab5c86b1fed9d534bc69b5fd883b398377399521620a455172bb10b06fc4e12f022458ab01d343873d114c9399618a364d931594eb4bd3690c72e63f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c73eeb208e11ff241d90b2810d94a6d

SHA1
1736ecea04bd751b05aeadc284046f694aba947d

SHA256
737d039fa98303370d544faaf5377b3efa2114de31a9c8103fc65a233818e841

SHA512
9b4992286f7126fc89f6b90e84f1bb40925af36a15fd6a5b40d4a8a0bd8e2b458614592a1704da2d2ce6635e68e5e428bcbc04cb5beb33cc30d5d437c9c5118b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1121.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11EF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1204.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit