df3ca816017c1d6b381a1880863f194044010e0e187372e80b5474a24afb1eb4

Analysis

max time kernel
137s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6871b2bf49a3f22141884badf02e88f7_JaffaCakes118.html
Size

159KB
MD5

6871b2bf49a3f22141884badf02e88f7
SHA1

7c1d4c24b05653be6bbb13d15e570e478cdce3ab
SHA256

df3ca816017c1d6b381a1880863f194044010e0e187372e80b5474a24afb1eb4
SHA512

d9b58b45fd7d24c1051eb3792faf650ec2a3daee1e6e630159e734df424136c4893bec4372e8c8897cfa48a06606160ce330e209db46146a2ebf1591f3e6ae0f
SSDEEP

1536:Sed3NcIacleB9hPyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:SebIB9hPyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000069044fad450a7ed430309e956ad6ce974249b8f3021a5fcf0cb94faacefd9c52000000000e8000000002000020000000ebe53de245d478e63bf025ae7a81bb5a88557d92b1d9897c192853b0d769dfed20000000d6a22ec0eef98434dfa342d06025574e4d11d22d28ba745e8baa1cf64cd68fd640000000173a375da4f88320fa6d8c7216a654f3cf813fbfc164dd53bd6ce7dc5dec86e875878c33e85a741f919d2ef049e4aedc049c79c0b10820cfc206db18283f209d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000c6f42be6c43cc4b87617656c34d79544a6493f123f2740b82e9bbf50d39c3b26000000000e8000000002000020000000062fef4749f486a2e9a283a5b6f57c2288f9d189fab9104e1f15cd1581126bf090000000c05346e4057dd44c728e973cc5bede46a4f0e7ceda77d7d3440d4a730f3cb1bc9fceaafbb305c3c5f72df04b801602a3fa48e86ba5505c210cd3e169b0f7b497993060ce383086f01f221eea7670e240d41cbac63d95bfc783972af8400754aff7b7c2dddac106b9745f5edf2272e987ae98c4f6da2919a5c4cbebfb2aaac80e803c5b2f17d16798f08f1c862bd6146940000000987fb97b56936cc6a411fae5be5e3b98b571ba62182fc0ff57b31fb7a03a874c147669d3e76b838d9c48f27a18d5164e07d4f01c3cd9fb06fb2d016fab983f11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30A9CA41-1876-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570005"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202c034583acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2480 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2480 iexplore.exe
2480 iexplore.exe
2456 IEXPLORE.EXE
2456 IEXPLORE.EXE
2456 IEXPLORE.EXE
2456 IEXPLORE.EXE

pid	process
2480	iexplore.exe

pid	process
2480	iexplore.exe
2480	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2480 wrote to memory of 2456	2480	iexplore.exe	IEXPLORE.EXE
PID 2480 wrote to memory of 2456	2480	iexplore.exe	IEXPLORE.EXE
PID 2480 wrote to memory of 2456	2480	iexplore.exe	IEXPLORE.EXE
PID 2480 wrote to memory of 2456	2480	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6871b2bf49a3f22141884badf02e88f7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4de3c7350aa2c25644049b4b61e2372

SHA1
36dc2ee7e48754761048c3e5f0036c58577ea33e

SHA256
bdd8a94640dcd85f6237f965f68f21a07e4dc3d7a04e903480ad8980868e7d92

SHA512
5e70e82c9897598e9316a584c38110d3056f276521c77febe7d0de7a7a916b4d9bfd83ea3d88b2db2dafe465550fbba2eca6aa3fc2f478c4ce760af19b2707ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc7f5c10f68483f5cbc751e0ab29e883

SHA1
75c169b84eb100fd3d0a734c997d8200d7b93612

SHA256
194e33c0a1e9fc193ef56b9340845e9bcad80bdd81d1b925264ae02cb17ceaa4

SHA512
d781dc2f3ad0290d3cd27a8c2a883ca7bb39ac6289cfe18df6cb801077910c1d79c09c03b01666a292beff7ead470d8606c57a91dbae3171c957941dd71bd2d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d93ecd9882d17dadd2b5611a1c0c180f

SHA1
0634130bc53b64e5402772ba6ced0f78473c7cd0

SHA256
ae842a90ad36160ab674bc853f524a56ad24c8c179cc0a0626f5a8e864124f6f

SHA512
a2c40c86821cd076708ef8d69c8ab051e0fd1a655632fb79d0cc12a189698cfcfb59e01454cb93cb81c0d9c57b3d1fd797e67f9e47afdb1f31f63f37d8dc7e21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d780478b232adc16bc8191f9608a77

SHA1
5f94c76ca6e3f6166f05ac3372cff363624396ae

SHA256
a97c4de8cb38f6158f86c643cf459f98fee23bc44f04871a63b22440d2d9ec74

SHA512
7c8dd9eb6c17577f56f34496c31d5c3f9cd1004ef860338a57798990393a1743253f088687ec77e91d81eb445e70e5e46d715bb8f0bffae794728363895244ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5760bb049a6754f610ecf94b5251d7cc

SHA1
7ce93290e5bf216bbed165499423d653e740b7ed

SHA256
15aee0890fc7253757d7402e6336972f4c761c3665188514daef0a7ac3d88e01

SHA512
db53102f83c475575a216aefba51a10132acb5d603592ea0cf7139fce0094ec233592ef9524fd12cea125c64739e5219fefb59ba8294e5df2fec021c2af27a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3395c7de5e8a2b3cead3f6c9ff6535aa

SHA1
93c39b6251a4f5e1e0794ef17e5d35824518b8e7

SHA256
e3916d6354009334af7a821965e317f43e1ee662724e289346337497b5796d8f

SHA512
d09d4682100cb36a3b5065693320b3c73ccf019979bd98fbdf3366adbda7c626d575a279931dcea9035bfc6b341ab5537de13d91a300f0bae0c8e9b94f6cd0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c020ce9bb8ed35aafb8cc042f5e4646

SHA1
653b643b59c3a75b6d7d2c1a75c2504f76a959a9

SHA256
887e22ac41354cd9653e99630fe2383069274ebdcd343b01e5609a33af7e7a42

SHA512
e6b6952e60fe87d43c8f129981a61a07b24210b92cd6553924e66220d5e219acbea1ae13d7ac62c1d1106f8f44f75de86fe3cba30dd74fc7bce4d549ca25e7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1239cf842e3fefd47386ca5610806478

SHA1
0c8202450f5bc4bcac77823cd50b97e747b7fe2f

SHA256
6e1e7742ce1b32d0c14d5b991a75f78daf9ef398b31f65bc565f196cc923a592

SHA512
45dab88ff797e1ec1da1250e26118fe290ea79d064e6cc96139414892dd8dfa8ba16e55474f8469f3825524d4274bc9f126801cac42ab077ec375604a0ed0988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2729a7fa819c4f340d6edea3381e5939

SHA1
bca3391c8c863117b50eb2c4e41c9f0e0a6bf5ce

SHA256
c459308b09a8e5ff8000758b2fd2b2e2cb0b94bef289e0acdd0b5db6dbf3457a

SHA512
1145ea41945c3ac82cc682b7f3865530bae9b1e35462b5d9d1a17b7f9898922ea2bece92582b06df36b7b4e887b36eb33e121d67a52184767950ca9f437e3bb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d630f29c4c675c0811528295328811af

SHA1
5d1fbfe654f2f82152ef603132741c4d8096f0fb

SHA256
8ccedfd95f7ed1a255cdb4c9db61d91f0a4f66b1b40fedc86eef3d7c8f875159

SHA512
b70918a2bc26e17edcd5098197dc76e5e2c35776bbc3ce8579a9cc2bac1aafcbb15a623c23fc7d32a98c1e12e9b4b1c9abeb9f5605d5476072a70707324eeb11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab210A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar217A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit