f376b59fa1b6da56d6b12542d6c5e5fbe5c8ac952704780f5aa6a3e5d82f52ba

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6884302b78e36e247b091df9a3287a9d_JaffaCakes118.html
Size

139KB
MD5

6884302b78e36e247b091df9a3287a9d
SHA1

19142e5209792671ca91b6bf84de5082dffaec66
SHA256

f376b59fa1b6da56d6b12542d6c5e5fbe5c8ac952704780f5aa6a3e5d82f52ba
SHA512

22f6dd0f610e482b7532d2a598f2b3b002d3092643cccb16e40acbbff8987ce788cb7da0b37b809b14927e1e02ad0ab892f05e7a3646a952f5f8b4cd2d6e95b4
SSDEEP

1536:SCNgCNGHlmXZtyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SCmfgZtyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ed11ea8b8a2208417a5b71bdac189126c1a26779a369c8eac51738e04c630d57000000000e800000000200002000000023cf0b8997235f52280881d4e90225ec23cf0f8dcd43cca235f73542dc8ce880200000008a0253d940a493fbbd5dde529775de54279c8d5df41e6e2a460602600d762b6140000000bf1430af0eac11d37b8972cc9b15dc2ea5520dcb8e878befa82de1a429c77ab521a184942a15a57adc1b099202ae4ab2c763a525c1a0d8e08ea735db9b10d742	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000061bd8263b784f2f8c6c50763af2a276287a3f8a2042130391abe9aa396204287000000000e8000000002000020000000219b0e39f1b87ed156c4db2c7c5b555a6de477e4467b2581b0834913d7f7204390000000baf3b5a86b5fe88b2fc651fd8a221e16f2d8b82f79e942f7e5090a0149b491533d3277257da84ff51a25c837fcd6db644b3f7a83ecca76732d0e00d8fa1d5ca21a095ed2ae737d4400e56108568e90b3d14bc23a0083ff161b2797ada7c57b0b99caedd694a4e22c69e4e8df4cfcb405212c899ede60025aa5e0d4804250b489822b50fae1a992bc786e069090bf600a400000004c24dbe9a2548570647858deaf195edd1189c6caafa954bf185265755347d84cd54e71e9d7d4f22281f2300022756c9fa15716522660fdca432619351cc2ffed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9F5FA11-1879-11EF-A7E9-D684AC6A5058} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01df4c086acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571497"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1648	iexplore.exe
1648	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2824	1648	iexplore.exe	28
PID 1648 wrote to memory of 2824	1648	iexplore.exe	28
PID 1648 wrote to memory of 2824	1648	iexplore.exe	28
PID 1648 wrote to memory of 2824	1648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6884302b78e36e247b091df9a3287a9d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f0af352d48ed28e9b41d97fe04e1266

SHA1
9794e924bdac773711eac3adf02a94c6c3676662

SHA256
fe0f9d0368cc2b2a3c8a3d64df58332b56390d97a5bdf08a8184177c3aadbe46

SHA512
c4d26fc9af51673a3e8653ec36a323a175e543c1dff9a62a60512d9283f50f043bfe0ee4bbc19572fda8fcf173d766c428c6b9e7b3557cd60c83f7e20a3cb83c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72d083b55dd7256682d10d1182621139

SHA1
08485018f73a6472e30fbc5e7294d6884563129d

SHA256
5e6adfaba6bebf5acc265cb67f0ea3483fdf72e7a526eb1257bc658e75a6bacd

SHA512
4021eb948b00be8aa9b4b97eb99ff772be47239a3a595c8c9790ef2eb4555ee3c301f3f34dd4a1f199091a01534e8d726a114988c26bae1c0f386c0611e4f260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
540cc5b14b25922cf51f8d616864e408

SHA1
80edd347e16b2f8cd07a552cb9963d0d457160de

SHA256
6c6a8f53ac7da4fcbdfa5680f46030689a0a63f503efc8f780d418fea623c9e3

SHA512
81f2614f92d3a38961ca5bcaae97d9bd6493dd52b2f31734a81ae4b13928e93076e83728a1b683739865349a7150855bc65a5c69e7e7d55ae5381561e8ccef16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d42e505924a78f21b256262a1322431

SHA1
7309cefffa05547bdce929e65e677bd804ec42d6

SHA256
f3e133fea81259c5e964a07d4eb4e7a0f3fdb2d50f17c58cf3203a9a883a72d8

SHA512
aa33f1b7207e7c471569f1f0b1948a86c7ca76ff41d0822cac6d4bb7075b15bee77f416d90ccde2a7eaff8dc99f290e177a3ebbae1d9bfaa57e89b2696971a92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53cda048e651ec9f1f7ce09d1575b16c

SHA1
dc283459217e0a0b6aca3a5dfaffe6ea068590c7

SHA256
00ec3b677ed5311749a158984d39c04eeccdd39c6eeaa73de03320576595ae67

SHA512
ae4d25d612a2eb3ba62387d3d9c683fc1c7e9a5f8571a65ce22bd20af2cb132c15de3a459a7c693717628b0b4bdb603bbdd527dad1290f2c464fc3f4c99e252b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cb45ed432a951dca4a7882b37d09199

SHA1
975a8d7ddb2fda137ec4af03ad77907238755c4f

SHA256
910dd40c4a179ef01362a28f609bfa496b1487df4d08cb7a261b867a9204badf

SHA512
4dd9bb198d057a6c2a55cefe1890f73ed27dcde00fab62f1a3b8b53cf3bb7dbb22d90618287f4efd36c96cce4ce4fa66efc098a288e15b7278f47b891095a0fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e11b1a1517a91e14267bb87de181cd33

SHA1
18aa82e8dfac5cb851f2eccab125147cb454ba26

SHA256
ca24365e4a9688cd9ae6ae4869921a1f6e39dcd9d38a98f92ab98c67cbc3ee21

SHA512
50a5906a6374bc50add3562ec101ac82cd7c9a25e2cab5ddaa39807cd635967186b76c2d8256d0721ad22915fdb2ef183e545e0f8244213440de83caafa50aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89452e27302508f6ecbe04f4bac93f0f

SHA1
1fe7d5f10222f893cb350b924ae2617eeabacb2a

SHA256
aae3799eca48850e0b771eebe8f03341fcf23c69ebef359e62443bbc97930d15

SHA512
2ec52f4e32b526009d65f4be721594e7aeff7dee6aa1ceea61c622cdd77943e8eeb8196a5e489e85dc5a17dfb778a7d0732f0479f2a5d5fa9503bac6cacbdf3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53d722044094c62e70acdb183ae9c535

SHA1
6b75cbb37649c946e982adebcd29e6195293da23

SHA256
d188334e46d075cbf70bdd71e25f30003743604be7cabc832612ef6aa9a6d00a

SHA512
240d800dff0f694a04ab03c2295fbb1c887a3c7885798ab0f72ee5702788df043895b6509d1aec176e17b64a8ae77e20ad49ecd0e85f0b533ae0ec54198cac28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e0b99392d3f93f1933efbc97905089

SHA1
4ce10d3973cad2178792ac59d233c66e55fa870b

SHA256
e63cec1f568d5d8a8f180acfb4599d817ecb7a96bb54431dc694cba5b86153a8

SHA512
cc6039c56730631fa06a72a9f06e69bfe02def84b2df0d70719fbb4abcac41327c80cf38aa4d3d03c0ef9985b909570c63ba668945c3863fa23ca0d7330b580d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CF3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D75.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit