eb6f36aad0e63d5abc03129ab1be1f984f47cc2118b282d03a066cae202c2417

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63bb31f49812811aa6864ccb7faeeedb_JaffaCakes118.html
Size

2KB
MD5

63bb31f49812811aa6864ccb7faeeedb
SHA1

8906d18b86dcf439fccd1f8969549080dc9109ca
SHA256

eb6f36aad0e63d5abc03129ab1be1f984f47cc2118b282d03a066cae202c2417
SHA512

31e9b1e1e5458f2256066bdb9fb67ad2ebf9a8391e2a1cf5d1b19515b8aba686b48b962f08f9db21711250e2e1306b55c024ae25fc233a9024bc627cc1874d0f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bac9bf90abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000008601b241146c2354cb01d47cc1f9fb30657da79447a8b8ff2d60d28500f4fef9000000000e80000000020000200000003ca896b7cd3dc5d9342eb2fef2c9ca8f32022b0bc6473d8cef08914e078a6e1290000000e341ef5b870d1eb683c07885ca159926d71da540ba7fccad4098e67fbc3d3601077a7e219b9e9c8dcbbbabd436a61d4511ff66a1a82b2066cae84e0b90a53c4ca93b184113ce5854ee2c5f2bbf45fdeb4afee5d81cf06dcabf9f5153b9ea32b8a3e49c3e41d8950167bc15d244c24a8ac69c96825c64d7b86420799f1f75fb81e73b9e2246f5ed8dca16c2348cab5174400000003826b3fb97193f5dbc6794e45184ebca9183500a410a4a36d998c2a3cd0c7662a59be3bd562b4a706ef28bdedaa9254eb3f22786ed311b239aa5004231e4a8c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422465949"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000dc10173d07204274fa0e2638bb014ec88dd326736287be1589c134053541541f000000000e8000000002000020000000da149c43ab418dbb6514e145bb3c707513156321fb6fbc2eb9abd07585a78f9420000000f984d7ae5d6f43a9e13bf2bf5b6575de836de36e9875dbb8eff79df6507683054000000091d1c17c9509046b3e02d5f6e6aed66dd4dce314e041ddd517d0c8f863e358824dec94e753c905f41b489c3f3fd7be691f2b353ad2e0f47037fa1007547e8708	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB08FC61-1783-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3028 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3028 iexplore.exe
3028 iexplore.exe
2556 IEXPLORE.EXE
2556 IEXPLORE.EXE
2556 IEXPLORE.EXE
2556 IEXPLORE.EXE

pid	process
3028	iexplore.exe

pid	process
3028	iexplore.exe
3028	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3028 wrote to memory of 2556	3028	iexplore.exe	IEXPLORE.EXE
PID 3028 wrote to memory of 2556	3028	iexplore.exe	IEXPLORE.EXE
PID 3028 wrote to memory of 2556	3028	iexplore.exe	IEXPLORE.EXE
PID 3028 wrote to memory of 2556	3028	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63bb31f49812811aa6864ccb7faeeedb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4331c860cced639b90e8bac16ae27a8f

SHA1
ee1862c9b3ea6ba69a03275a5ba866a77904e193

SHA256
eb7b8ac47ec2618b603823951180b3330a0b9393df17d83f7f3585de02132c62

SHA512
9ff87c1889c502b96435425882abd76cf860267b1b6a3b71508a38fae3c855d6f9840eb2be97abee80aee1b960d7a1f8228dd54ce7b46dfed2872e8ba9e55ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
162b2eb085f6a0d1fb311c06532c270e

SHA1
126c87182206e0410daf4a0def52428cb7a25f6c

SHA256
fb8580b06e34b600f955f6f7333c99492c1ca290ce700a720380893565d4b020

SHA512
3fa472aff6541eff5a8da927e398cc06c30014cb2e707ed6daf1cfbd034e9351ed6231436d6d697a2f00a5c6226fcad0fabad385afe0adb36cc55bf95fd6d585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3705603ce93c8acba2d408e876bbdccd

SHA1
fa7fc2743313972c045ee0b689ca65e06d27e8d5

SHA256
7d3e2bcec3b713dfac4ab75ba12d1fef00ea199513cc5b5c12d73cf7f290f7fe

SHA512
2fc051bf65ee175f20acfc24237984866f36b7885ad90991ed885ce8f473036e1be4c602490a567a92ee1dbadc499a4c2105387c5662b9e014904bb1874f6331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39e85b6a03542c4c23e86ec7a6829a6f

SHA1
c54265364b03d2789050e7dab3995fed6e15a70a

SHA256
a0d4908a474ac019391af858ca092214d0cd22331ff3ce73762d0bbc166b33ce

SHA512
dc2b0cd8ff7dc4d6bc2e4757a92f3440dbcff6edd8851bda47b952820920f605ae014d8a3a9b78927999b49cab19069b067e1e2676e9394df3d678b6d1dee9dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba6f378b8eaf40414a2b53bb9ee4b882

SHA1
f138df58274337adcdac9413d98208e763c64225

SHA256
7f34c33bbd0b7f433f5f9af1abfc626fa48f82f2f6827fe82ad550a5bec94c80

SHA512
85ab11b0d4f83c00e4b886582ba35cde90f53cfe7b1bd3dc6afaf601cd7d807bd0bf37c09ec1bf0275752219de928031349ee4fb3cc997affdc772c46804a2b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00f66c2628d5d63a6274c735c818b9c6

SHA1
2920ff744a89fead8f2d67b68a29cae7fc5789ac

SHA256
6a5a4aa4472ecb927297678ff8fe48d3704d891d6ad3b448f0dbbb552b6a58bc

SHA512
bfed93218d83d27f50757df28574624fe818842739b546ad80401718ad5ffd8ba0cd0ffbc86cfb446f160e165b22ee10feee1518e91983e16601fc13a6163c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1cb116639c2d568b28ff37cd6e489eb

SHA1
44d9ccfcdbfef71038e197ca82a23ada01f1b68f

SHA256
05a2e092f7caad73f4d1abc5006e90cc8cdf3c9423e24349440690148a41256f

SHA512
993b4448f0d82465ad5619902560cd076ae1d564284a95f65b5735f718257eba319ad1fde3db2399eb121439e0522ee4163121da83152e97781c0b78179f923d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c313590006471065f3ec9f5bbdc0b8f0

SHA1
28b2e9227693a1bc9a6daac934f58fae449f1c35

SHA256
d84f74c881558c0a2726c8cb287d9621e0fad0236382f26d3ec94f2e1e59ac2f

SHA512
d45fe006c994ccf7a1c280304b1471da5d4b8c75e785d280f3fbbaae6c602621d727e5a7e52c9c92c4cccf399d63e9021015f68ca9d686add9ccf0fdd9dc3fee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
332a0b7d0b28568f5e05c49d33863b12

SHA1
71780a952b51a71465c6ebc53237d357512dc691

SHA256
8db828a7c774c1818c42158aaa089eaa43761030e8d9268a26ea511e1fe81710

SHA512
6797a90c840f81c51f7b9597c4d9ae25f0b37a63fbeba2202f81d3fbb2f2466d42d6ae9cd235a7ff458d384f011540843706f7fb486e8bddd8b09c83e84616c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95c0f3dcc088ccefc14595d1f817b1bc

SHA1
d232243e2be0d97bcdae358acfc2547a148ae19c

SHA256
1c73873460fc35e1b572805673a97a13faa9e1829b70506f6cbdc835d865b89e

SHA512
5a3f2165c0fd40c6aea42c637ae3155637e6001aa92e2f3ec9c2b5e3d767f50122f02acd0fad2c378bc623779a067d8eacba2f38d75d195b3aeb5f8cb3964443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53c15e5df4dc19d865c62283702ab5ea

SHA1
8b825eb3d26e35afff4748557819881b192634be

SHA256
db4fa95b6e47cab62cbcbe5cf1244a34dcd3373b378bbe53c4af3e5dedd98208

SHA512
eb83e95b3c1703b49c7391807943a986974153708730e3ec42904d0263ccbc93ffa544d9be238209d21218c901c0efb057fa83e0f11f730365ff811abeee2f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42889bbb97a2387ba2c156e45e31e3a3

SHA1
65fa6e85a4955d1dc5f2cd9640c90e35e6ba49ec

SHA256
aeb64f39061ab5e7ab880a29a3fb793f0791561d4b4f58b74db078263decdac9

SHA512
490dc2c9f66ede8ad5ac509e9e6a090b6526ec4cd65e493ca3a104bd0f400ed2790db83e2229e5356b1405809c6e2aff8484f56f9325d257b4adabb0b660b730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
775d299b2a032b1f50238b9fdf5e1475

SHA1
b6f102a48b66a43b58b8430a45fc35c109d44068

SHA256
f0683428a7804f1f3ee588ce076da393dc2fef147cc6573df2a35efc270125cf

SHA512
84ea5d8868a16c905e55e9386fd82fd58e5cf62dd529c68369b7c174612ad03900c69e46a941a31cd5dadd61d1ec3cacf4c01033a61a349515a2a18e258a4707

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B57.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BA8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit