7c6e5424b96da9104f96faa70566e4ea559347cc32e2aac95f2e62047f4afab7

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60d74cf9b15739efc31476da890b6e2e_JaffaCakes118.html
Size

68KB
MD5

60d74cf9b15739efc31476da890b6e2e
SHA1

2b5f5d901ffc57a6ad87384123b804af3d54be8e
SHA256

7c6e5424b96da9104f96faa70566e4ea559347cc32e2aac95f2e62047f4afab7
SHA512

182744a158a8f552b6de3022c66f1617c8f30da23c50cf1d5a22b9d9f36d9f50ac2f60678af740d78726c9d176ad6dc6a8bae9a07ab94f4bd402d144a7b99edb
SSDEEP

768:JiZgcMiR3sI2PDDnX0g64D049AO4WoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:JzCSATcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422398912"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0033e8a9f4aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5429631-16E7-11EF-9371-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000001e882bef3f3983084027534f4e90dc35c7ad3ac0112328ced4e3f84572b20c81000000000e80000000020000200000009192fa82fca97a842401c8daf95e4e7445d88e05f70cd1e272ed52c27471f39e20000000099bc431fd358d285cc39c8f1445fe67f0cf55e05e556fda63e406bbccfcad904000000067697a5c83596808e7ab153c9856743678dcf69eb36263c22a58be56e587948a01e2868d68a9811fedf6f83bd2d910d97bba438dc87436b688f949059d0f0dac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000677c55be80cb61aeac578b32c9137d88e36157ad498c9289ecd651e96d7e5632000000000e8000000002000020000000b780461ce664be99fc89d2a122599d43d16d44b971f90f5e15ac5c04da32010090000000bb00c56a87545b51d3da8c96a17ccbdb3a0d99cadb853f33441ebb7421c6213f3d5d98da2e90b73f2a504ff35e014fe940375e610b57a88d100fea9aa613e7f542a41126eb99be27f32f383860b6880122cf282344c936e751719d2c636ef1661e46ed8d619aedd6c518bdc986bcb38125cc3531afaf2f818bfd3a23e6d8091af9fd087fa808595f14607320528f989840000000244e7116b21f97b3b4ed8f3ac3b9ec1063cf3884f4650e80a518d97a4a3e14fcef70233d57cb0bb04dd77f6ca2fb899c7a5499ea7d9553fdcdc72fba817e44cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2500	2088	iexplore.exe	28
PID 2088 wrote to memory of 2500	2088	iexplore.exe	28
PID 2088 wrote to memory of 2500	2088	iexplore.exe	28
PID 2088 wrote to memory of 2500	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60d74cf9b15739efc31476da890b6e2e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38d1c2eb8f06da50a3ff2de3e3877f26

SHA1
1592fc331e7e7013a108a984534188a7a0ed2adb

SHA256
a6c6b1ecbab370941e468e8b298ea7d8b8408fac1a50da11762d64405cd3c73d

SHA512
ab834c8e822704cd117473474a39a35b57d00833d1c120115280416c4fbcfac41523bf1e1ec601eb3723f41d182035b9025df2f65204e3125ed3a29095f5c3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1ee2660e7761e1dd991cf32116e7e0f

SHA1
687f868b201da591ca3411e71cdba1d10e9bba58

SHA256
498ff912ba1fd2e29ef1661e752ad45ee94dcf40f58104f44f6810760c72ded7

SHA512
9d64746f4ed2ccbec0577a5b7aff28ae2044b7b5a817a35523eb812aa4011d6415bb8be6936ddf8df545a9e3090f78f44ee46b5a25fca450c630c62904d55e6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19de6b7f4e809b3de0000822928e7841

SHA1
f465e37d32e9e0e2a9fced91cfd3dec76d4d0e3b

SHA256
0b7f92db90283452bee23cf8ad1d9c846282f02610ac51c3969b1d70a25a584f

SHA512
f0e16b3ebb6dc38fcdab502669d6bdfeee6ab78058fedf9bed589744b0e0f48b4bdfcc2094b90a1c2c295202715b72669d645235dee5460c992493891259c2df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5411d140a34c8d106c4214901b7a7943

SHA1
0ffcf1c1d117fe1300e1f29695133f12af35a3f1

SHA256
35d0a5e5ad7f420ab76b582e46feb1a9514eeb538f79993f5956da43e4bf9b95

SHA512
5212b76579c995f81daf70ca546b9b4a551fc5d5afa5f8de2881d7357a1d699b2e2e915d6de863ff227d0029d03d31cfe34327aaa3627f5be667638e2e973a55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f59f84eaa806327307eca5e6e809160f

SHA1
beae2f00d8f4f3831a9ff1bb737d7ce6ef16acd5

SHA256
5373d2bfc0b6f77d8ad88b06d4c1314742c2ece1ed04c5b0df28b06f9a156a28

SHA512
fbc717f7220188f8f07a6e96e06b542994cad9682ffbf3e8a2bf664dbad957c995868a81750dc37a5946e45dda0b16b8330b1cf636d611cf5982b3f8eab63c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e527b3533717486ec3ed26eea3c5418

SHA1
1247774a5a57930f97af33f7486849449539d456

SHA256
c4ee9fcca14058e6197c11a9f881c518219a79c4cca8f4cd83a77e31a7d4f709

SHA512
7951c4d1e1cf06db7046ef665839cc620b2b40afe29183dbf3348f0112ec37f4b69b42e74f1aed05ac995aaf1b1927931102dc225e003153944143e3c5679591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
468317e6be69cf07517683f8b621487b

SHA1
0f49779765e4eb02fb60b2f11ffc71e45b4054d9

SHA256
a20ac0adfaa2d7ab8de36815c05685939e1930e3ef6d5df5e2e11efb90a81597

SHA512
0f3ecad21f4ac6c3f3dec74bef0d5f6ba985154e93f79d3079bf1ca14e1abc3b70c7d31a693eb39eed49b31f03b00f02a542017f20904ad26387e16d859a070a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84c072cf90be5b365c526425b04fe5ce

SHA1
d545ade9face3b3e9dc7a7c2fdd767eccd9a77b6

SHA256
3353a9d554ebe54aef1f95fdab6c88c16c8f4966405ce32bcf0f5de1d47b1c45

SHA512
73f822ebc72cda2935079c2335ec12454f70ba9847e953121cbd96f1dd753d56987a240b70f45013b024f4d9c8f0b63d80ba152c53e3986e68d23c2e80ff37af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f48758bacc5a46b21e639b68293e8fa

SHA1
a6fa15fb2c79dd3f812556978d693c9e4fff0946

SHA256
b9cacf8fa1f00822fbb5228d81dd0bfad548a4a9702a88de0df815cbaec89166

SHA512
46f05b5b20c070e56185be5d748870172dfeb500f8546accd753a3da78db1bd60ceac398698888f683a1d86fea72e6d627cd8f3d9d8f3f0db0d0bf2795a74a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a779772e9bec66603f2c9552917ff6f

SHA1
288649ac2514b654f2047e6658744da40bb438e5

SHA256
9e22302cc7bf2af1b961ce2952ffe65bdc106c4c670f44a7f7d988b9e5681959

SHA512
985122e15249e502201e95ce7be2197b2b88e9f1af987e123263497c590edd732cce4c5976734dbacc9eb10e9f23f76a108578a0cc55957d24ac02ce916f1f25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29C0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2AE2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit