3c28140cbed3bd4eb21e86242bfb58a86c5700f102d57f1fb444654df00dd47f

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6536933afb543511bade66de66038d00_JaffaCakes118.html
Size

139KB
MD5

6536933afb543511bade66de66038d00
SHA1

7673842c7fcf2bead5e3c330bdc9e4c20ce574b2
SHA256

3c28140cbed3bd4eb21e86242bfb58a86c5700f102d57f1fb444654df00dd47f
SHA512

759661a6de5d555906c7146e117505a01c0750444f8a0a3573a02d2ecb56e9a639f166f633d8ef181134a064fb5b5dfd2377d6e758ca6756f9e2c89225be8ac9
SSDEEP

1536:SIVcz6yl6myLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SIvIyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422496661"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30797882d8abda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006e860696b465e7481b1e4e03843fc3e9e8d1bfce5dd3c53ccde54d0c2f263ca8000000000e800000000200002000000013638c3a0deac8664d5e82a76385e611caed395ecbaaadf2b335b6a64653aa0290000000568790dfce106faeabdda2fffff866c44d48ca10d02644a5bde56e7c5c0790b3a48b78a03eb2a780d1c468b25535835a0a84c1765f0e98e57f4ba7ed8f272c233ef2c447ff8ae7a6784d849cac44fd78aec4f930d501b44db584a693738140009be67c47045eb1cd81cb71839be24094a5067b607e5e954e6b3ca0af8f0389dea958059ef6e24a44a6d76b51bb00762d40000000c3b889de3f954e4b0ea6cc160173d89b15004284b897708e91346b4110b375f18d1a803c74fddde9577a5738f433d463c2009578f17fff001bd283977884f781	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C40CA01-17CB-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007faf6595b7e0f5656df0c84f1898548f3bd6148144026e426c2888ce811d596b000000000e8000000002000020000000199a705d49af18c3060305c56560653af4c563cade1e95bb627985687442936c200000007aeb3db1efc327f9c15dcc4e3b24b71c7c9286182a51c7eac9c39b5fbd2327d240000000f4c4d4d0e3006ba152927a7064e37766137f405a7a219176b41231765c9c11dbb1028265bbc954a9a61a9ec1e90dc07fa3515791a09654111c193916467cb7e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2984	3000	iexplore.exe	28
PID 3000 wrote to memory of 2984	3000	iexplore.exe	28
PID 3000 wrote to memory of 2984	3000	iexplore.exe	28
PID 3000 wrote to memory of 2984	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6536933afb543511bade66de66038d00_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54eebe2eabc9634cdd02834f9b47e946

SHA1
572edfe922f26112cf5a31b3c13a858e276f3872

SHA256
7c161c93673a5916e9e09b1c951309e88223f3eb10feee45f97f3310a60c57e6

SHA512
0bc5d86e22334c963a8965813ef7b420a4f78036cf1e2d77294f946cf06cf372f6ce66729d3980f711f7de04d365fc3f8d9d4c367995bd06551504907a685586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91f7feb733bacbe90a72cd09c43e074c

SHA1
a1e1830bdd960c9aea53002a1b62f229eb703e80

SHA256
301c62b589e087964ea51240b2714515e5f917dc68aac79e232d96b7029bd86d

SHA512
4bf4744afb1bfc7b5b0d1316057edaffe76c40ebf70e13cee635593ea8fe5245390ad6e3c920556307a641361fc789827b208a1658fbcf6d462b6cfee8a818cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3803b8ddf1aaf3a76f58d6d8bb270086

SHA1
47a5966d00063315c95f355553c7344f4c317193

SHA256
2a3656df3778456488a33d7a6b780dc191a4325d6143df588b6448c7bcb38e0e

SHA512
92c1e65771f0cb63e1185cb216112915cc958dd00480beae70a0f83664a7cbda4d1bee76db5b7340153293d79250ad0448f5e25ab7beaad2769a4540cc676693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64e2c734734500e8edc232ee31591d93

SHA1
9117d1ec24dbd660ecba94861205317d541ba9e0

SHA256
0faad02baed8a5cb0fb29619126b80711d544d22aff6392294f3a7defcbb4008

SHA512
30af3b61e81248d2a7aa927028137896b02c3385e8ce2d9912ce0a586e5db8c25952c6a04a5dd71ed212994e6431eebc79aa2ddf08e13b282efc871904697855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
133ae01899dc0de413b3e15d77ee5a01

SHA1
dfab442a6dbf50b65f47203ac8e211e43ebb0e51

SHA256
335b132955f348fb733e4a917504b16771f7f4050e612b26f8b24170a5e624ad

SHA512
397cc7f94776acae740432373e2cc611000f90e00898e270930f540d5540ea3a170f165d23de069571682943fd994935d2d8b188776f0600dc58d26f7ba1fc81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f4209003e1df4a1d5c43439572ad00d

SHA1
3cf07ec5567be4c25a4205ce45f13ea096d53677

SHA256
820592be74234ce3bc44f0b48f94da15614884db95f9cd22ab072d15fdc584ac

SHA512
8b8046639766ef49227e02dd2b629b65442afa8472f026c9a95e43d033320fc750c96173322c62f073849037e9e5e6f9d57b9bf40f8f95ed9e9f1611776200c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81a10c3c7b64933047fe24df4888be2b

SHA1
c85aa0f37c9e0a024f215497da2b6659fbb3bedc

SHA256
7ba90f62d04c81c9c36a419921ce667430a1cae7304b40ea7c60bb0999cf228b

SHA512
4322c253f92909c38a15e3b509f8a876ce8e2f2c9fbc306dfac25e1588641c5f7d77c6fc49d3e5360c87718e2e572e232c25ec66e5252d9222b0e26c7ac6e456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f0922329ac782b8f98efd1f82cf4d30

SHA1
0788a02d39d8bb9d39825157110807444adb8e9e

SHA256
bd6786ad6d94d5bb09b6f23b4e9f8087a7deac7eb3a062d3855649c71305932a

SHA512
49bbd557ea4dc22305404e65344100da5df90e282b70585d611869d4d622e678f5fc5f01952a7d3fe6d8eb686edc4544cb8d9cc398ff5f8fdf2b6228bcae7e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e147d8b28f660313626136e132046f6

SHA1
59ae6424fcaa120e5080aa0c2a93e756c747b06e

SHA256
32974f6ddb93002ecf8429c973163aef18edd2a608a46c123a0ef641c3b12b29

SHA512
c63af268ca663fb28ea801a60ef4690b8642cd74c1fe100b7b4802c715a6cee525b78cfdf80dbdd1ef4c49bd1b2893548cc973d8e11e7ec3130d34c72e0bd177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a910f7cb4fda3f3321c891cbc9db8759

SHA1
81ba869c14f5919d35593e242402a04862611933

SHA256
6180a124ae8c01bde88914ef701d9d053826dadccadd99848808b616e9ed7725

SHA512
29be5b7725fb53b8193a1c4fd0ac29b5022937210e05908c44262537a75d832707e0c82f7543db606f6ccbd457aba34f6b522269f09de4b8dd6126cb6de819ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1641.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1673.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit