b76a1020d1f829a7d754e5bc8e274cad171e1a16221381859c4b9780a9bc09b5

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6622b63fe4ec276dd2b2f18b7e8d7b1a_JaffaCakes118.html
Size

4KB
MD5

6622b63fe4ec276dd2b2f18b7e8d7b1a
SHA1

bc2628ea5c1c724bffc4e0d05f55970b1b35d162
SHA256

b76a1020d1f829a7d754e5bc8e274cad171e1a16221381859c4b9780a9bc09b5
SHA512

68127b0d78c6fc35231ce08c9a67ac39f7040944d6cba8b97d6b73005c2d3b4c6cbb6c70da6a262e4e82dcfa97f856d93a0a2dd205189a222d56f8ab808e93e0
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oD/t4nd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ee1af3c34865e4286819505d342c54900000000020000000000106600000001000020000000dec9f41a3a1bac698f0135ee244cdd30e10935a980796b7f670d36e554cd15aa000000000e8000000002000020000000ef1d876b4bbd0912dcb9d1e9c1198ea9075ef651bee4dbe03338e8500e27ba72200000007d6c5b51ab6a0ba401d878b1f2b89c24a7e3be40e6ecf558b23307c53d0e5ebe4000000074ffbcf6de166cd1ce38a1f7299d67fa73c44cdcb5476260fc7cd2c2fce599e503e2d8a903ddfaea7482e997b4cf31518aef73800b9a4bd17ef2ff99fd7d05cd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ee1af3c34865e4286819505d342c5490000000002000000000010660000000100002000000093ccd5b0d0decce9a35f2629e50961b7eac70f7cedd6c5f68eed235e4448280e000000000e8000000002000020000000abcb488164f20ec69713d4c75b8bd7f10fc93d394a23cf3901a3a65bb9731ea290000000d13adf72a45f9184b0b347ac13323c7e5654b29e2e39c61bf291067b081ec632bc429fcc84dc767142661c2e049b7f03898ab436f2cb76a86d87d7f7c6e85be7cb84566e25398de4c5e949772cdbd91a2413169bbb5a81b0263b58512ae4958120dd73f1785b05c2308fc981755ee0c5149cf7e45b275779430c7c5cd502c51e69b42722a626f08eab63bae3e0bcc73140000000ba794b2d9addc51c17fba453d6d99776e1a18f09df49dad230a5332b97f944a26d03a9f48a970e609d445d9cc4de3e62bca517e6bcb97e737a9931994b20cd00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f000110408acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422517176"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2ED9E9F1-17FB-11EF-9A09-E25BC60B6402} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2656	iexplore.exe
2656	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2556	2656	iexplore.exe	28
PID 2656 wrote to memory of 2556	2656	iexplore.exe	28
PID 2656 wrote to memory of 2556	2656	iexplore.exe	28
PID 2656 wrote to memory of 2556	2656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6622b63fe4ec276dd2b2f18b7e8d7b1a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a596db88fd68737b8208bdd01cb36e9d

SHA1
456d8c0521eebac6f57b6f7a98e77115a554d840

SHA256
d32c7208cc5af05259006793f0f4c9c96f259dca15b80bd50b91a88b02849083

SHA512
762b93d9a011d6675c9c3f1639d00c3402edb14ed88b9f4b9e85737a5c2c670e2cb4b9065c1fb39126317fd1d1200865357f38c81bc52361a4b975bb0b03ec38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6471f2c0d897159b5951402098504eb6

SHA1
f276c6d996f43fcc9ad7417f3ec9044cf9002b26

SHA256
8ac5cf80e45a3dc299a65ad29395d1685c496a445edfd0b1787cf22472371364

SHA512
e353703b09ed9ff0728b3e17ea4dae8d73e05eb7a41ada08dea6ae721c75ce4e4a77cc1d91e608f1df8f693abee7a415f8eaf8bae4e9e6dab635b10defae2025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72b813255b0384da922664d6c18bcb9c

SHA1
01e25b3d2892c73c60bbfeb9dc4f73a36d66ada8

SHA256
6bf54bebcf927bd19d8ae7c878bc33a98dc3f844709b3fb341fcd789a6a2897a

SHA512
510d769225d1434791335341366cc51e31880290d5c7ca05de8b175a958353d4f73866c2830dc81d2e1dc2f00899532a4fa12274d895ec0d55cd25a4fa0a5a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36819ac84046e70ac7060891f95f12b9

SHA1
d79eb54b5ae1060554108ac70058999a1621c458

SHA256
03b55c7e383aff6f6f8f900f64e6f17f4aae8b278988a1a33a2543b9df3af55f

SHA512
08be72cd04c5847523680f81e92e94870c5d1fad0e32dcd67fcb45e387a26353b42c92a530e799e7d927db477b29bb9cb50567957d778567253436ec5dee57bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7aa8453fe78a72d7d53f1f00bc7bbf

SHA1
c771b6b7138196bd731985c4128ae6fda06f73c0

SHA256
b05c263ef9935c44bd566bbd1205fb548ad7f96f2265263f9826e714ed4c6dcd

SHA512
4a15873ea914b924125d2d632770fc1cb212c1bdf909df788ee5bf1e6d8229b60d81b2a02bfe5fd3c0756a8d797c1aff829e1b52f06f736341cd8805af42b037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6094a111bf148527c5fdce5fe8f32b63

SHA1
f4b1442c500d4d3bcbb9dd17f00fe9e601ebb174

SHA256
34bfbe6fc4d9b9cce91c60e475b889343b2b0fcdfb880ac171beb6c801cb6108

SHA512
c38d64837b62a133e79d74772433065c7e33a882f2a599937849f57434aeef528c2bf5bef84f92a23b36c10c76babb7604a8707ef2d90e91974adce957ada306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
353ce87a9215b76f0914e30d47aa8323

SHA1
8cc25f3f580bd3c19e71fc62b39a0537db41c73f

SHA256
af01a9945b238b4227c9fb95c9e9a27822a6ab38ce55787b82f94db7ac7d8213

SHA512
5e60f4d53b3d39516bf8d9952e7dddfb5e736401b003ad280933ae25b26a9b168f7673e8c48bb60a1ae651e4333a7785f8fa35ae9f813a1424e23b30a471dbdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24f1fb5f0d49e2b7fce75df8b252c074

SHA1
95ee3dafe7a4621596d391dbf78c47157c9a0ff7

SHA256
47cedb1819d0060d7571bde6ff72e17eeb9d8db7df7845d2db90176c5c7d5d46

SHA512
d10aa706fe6ae6df9a3a8209fb1e57dd6b6ded31925d9a157c2771f57efed4d6cc640c611c97a486ed99117b9cba9d2518a2dd55e3c0d70d6d367278b3f5c076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd624a21d32a4c248ce3e687f47cb5e

SHA1
20acd3fbf6d8c488cd7217d8ad5247dbbcdfcf2d

SHA256
20a367608a6f370ba609af5b1a60bf6d23005fbbb0f27b1a0af04ad47dfb9c5f

SHA512
6436c0ea86902015dc0437e245ee52e700353ef26a84258f51763094edf0439c8c3a7c9d5375694e5a73d06532dbe223ab4726249b6d09cb67866ef9bf8a42b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
661a05ccb42f8083216b854f3198dd34

SHA1
306f5b5c7b5fd636189de673f3b49497daf4b9c7

SHA256
0c25d2ddfe6bed223a18533f66215641e2c01db4e5131f819cd387ae09c2e122

SHA512
a78b4b9902fb5e0fee50cbf2fd2d6f3d682771bd4d5e1e8f4a69b8eab3f239f3e0829a59e34d71d2068749d8f3032caeca65796d910312b3c643e2374903b242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd3d6427c7f6a97519f718caa5948f5

SHA1
88fe20b85f2f90901d1bf3dd919eaeb64a0bb0ba

SHA256
3bd0f58e869c06a180f1af70a16aba3b882e2da3ac50cffb174094425846ab0f

SHA512
a35d58914bfb57c2eec0e6ad81204fbd1b33eb1b6677f91194d89378bababa9f8e3d1003dbf85658a6e5ea8bf34349438ec9baba10f2b0fb15d815040a404ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68925e4fb9dc7a769a4b3facab134ff5

SHA1
3d2d60ca12e23435339b3a52b14eb91381d4c480

SHA256
626185f5e71655c4dde0cd9d707774e6672ba330a692c319137d0fbfc29c2bbd

SHA512
cb69c483e4e288dc64b993be5a46f8740970a3bcbabe5f5ee3ac6af2ea5440a921b0fb48b1a895c98909f7b0ea0bd07d1b744d0a487c884f58334654eeb8cf38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b553f9d3bbb4e3831d3ade18bcb0573

SHA1
403161cc5b2869f85d44efea6e03be0557a00d3e

SHA256
db3e9701a2f9c2778cb3a80e923b135dba23dfe8270633dfd88e6bddc6e7fdaf

SHA512
ef20701655ce0a8f2e7c1644a866cf159527809028241289c4a3b04ba3fec3790b4c4c371d6ca4e75528f7beb6034d5a3b27053ffc0908f93275cc505cf737d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9ACC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B9E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit