d6b962ddf2be95afee4f6671f3abebe476516d31ae2503b24997965a9cb05175

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6877e3180196591f165ac1d6de063aa4_JaffaCakes118.html
Size

361KB
MD5

6877e3180196591f165ac1d6de063aa4
SHA1

7828a7a0d7f793fe5f180eecdeca54c617d8f0a7
SHA256

d6b962ddf2be95afee4f6671f3abebe476516d31ae2503b24997965a9cb05175
SHA512

42e4a7ab5636f2a56fc07c959d49914cd5f1bca8eb2909a5cdaab03333bdcc34737f493fca56fa4102c0d6ac9afef1291aa3a69c771b17c063e7993c54b051e0
SSDEEP

3072:Lnu2RE0bl2/K/CRh6T8/Z/BQhpI5e7oQgwKRmt:3oQgwKRmt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3769B4C1-1877-11EF-9F01-52C7B7C5B073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a86f2bfd4377f24a86eae209033d46aa00000000020000000000106600000001000020000000afb6cd38b5b0474b05056391aa952fca46a01e164ab86a99c692424456d4ca6d000000000e8000000002000020000000f7e232e5d1d9b3d58fa9bfb9d2a653d781485ee26c4a9a96914513fe55140be9900000009a9c917212d7607357aafe4790516fe4b8d543c705e9afd70a8786b1492aee4eafd9d80245c4d3d0ae05ef5d6737bf1e9b01089e6c130edd882562e29de5d8d1609382f5586e76de2892f917b3410992cc97e305994e8312fb39aeb0c72d452e388c8da78c253fdca9add259f8f8569ab5a1521b8a66110e23fc270e833762fb3f03df50175dd8fae7d9a7918ee5407740000000fe56c539304d7a3f3d379a73e85ac6192b195d59008d0cd90c1695d062a8c96ffea8e6e2548d780ad40949ff206f98bb5cdab41f37649a314a0bb5c7c7bf57bd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0deaf1184acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570479"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a86f2bfd4377f24a86eae209033d46aa00000000020000000000106600000001000020000000c5247d9df2033706f5da9c44365998128dac7d6537e7e017093ddfa0c0e57d25000000000e80000000020000200000006e0b74e21de6fc6102178e052341727dec44ae9644fcb57d52d9a335e9fea2df20000000662a00be791a2c1f404d03b13f9566c7e5017642eb10eddeec093238b5af9bd8400000001338a1b0dd72d05f9369365325c5465e1b720e143abe602e28c0c063b4bad5073ff0db03aecd654d37ea4730a10d34a61244176cf93b9969f140d7d7d6ddda96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2764 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2764 iexplore.exe
2764 iexplore.exe
2892 IEXPLORE.EXE
2892 IEXPLORE.EXE
2892 IEXPLORE.EXE
2892 IEXPLORE.EXE

pid	process
2764	iexplore.exe

pid	process
2764	iexplore.exe
2764	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2764 wrote to memory of 2892	2764	iexplore.exe	IEXPLORE.EXE
PID 2764 wrote to memory of 2892	2764	iexplore.exe	IEXPLORE.EXE
PID 2764 wrote to memory of 2892	2764	iexplore.exe	IEXPLORE.EXE
PID 2764 wrote to memory of 2892	2764	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6877e3180196591f165ac1d6de063aa4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2d5e5cc0d52425efe4ac565d4509e84b

SHA1
b2717b8107d3f31bd4615e6e475e75a0ba812c48

SHA256
e661edfd755c065a0a6678564742e26b7ad355dfc4ea4af19aa608e30e13a699

SHA512
1cb25091137b0e235c0c3ca400af035eee0c58e0f4fb670d6ed3cd45f80a42378a99912eb2e129a6da2c2b9c1e378f99244d1fce12877ee9d68aa82d9fb4e833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96c77755412659bc5381a9bb7d59f636

SHA1
4eba3d1e28bdd37521c5d2bd103e186c1a273eac

SHA256
55754f76cf797b50125f626196c8323c8b3dd434ea4fd93647732aabfeb57a62

SHA512
bc62dbc6bd8d4e0388fe69ff4f0209d84bb71feb8878399fd1249119e068f43f42ccf221308804abb6e0cc228253ba42b7dbff83ef3ae634db8787d37bdbf748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
410d53255e8f926f3768b4c812ad60e6

SHA1
19c389a4a8ce9d3bf319ed400e393a704e9d50bd

SHA256
1ec11fede58b666663ac76edfde65c09903c249ac1c0a161ac9f3c9989e31c8e

SHA512
67d21c53ec66fd6a0f35e60fc0c65b30ddc177c242a2740c03aae33cdd3761f6147f60967d96cbc3812fd1bb3eb2aaa32b33489ba303582b17ce868bc3882a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecc0b01f5be11f9bcb0c0802f6d6141e

SHA1
a8b8300a77c4b162b414c8321a49e4c94497b785

SHA256
8fd914d6582cceb9d8d22ed2b87ca861018810d9b33b5395231566e8ef0a9970

SHA512
ce763237478beaf4278352f8767884fa5e48206a4aafb8d9ae6c6a86a8ba605271baa43643b56d5c76542aa32fa7e8d7e812fb0ae4cedb2080eb84880fef7cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77ccb29d82b57ec9609a85779a54f113

SHA1
e9b9059c478c7fa129388a7ec059e26786fdb361

SHA256
3c5ac4db9ff2591b167ddf17da79784f1b98e050c6bef66eaa86554f6ec1846d

SHA512
1bbccdc826180b0328150cf6a36b96207b7bdf99faf29623ab0b6212cf62be8206b238d1d007af537fcf8c317be921545bcbc663843976675c2c9595423412ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe0c0df06cc010aa738eafbf8b1180ce

SHA1
c3f1491c86fd58f4400a00b560382cf185f8367b

SHA256
652b72acad6edc60e56d0992bd51190ac4d03f66da3aab8335be72e1e11ee905

SHA512
f6fc95387cc067944293454e3ee5557d6d7a1b32e3459fb542b7629e1e00e4d0a5899b9b21c5e5322ff7465051209c82f0c4c9fcd15584fedc1506014f9fb364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
195b067ba171dc19cfe106cd6f51256c

SHA1
bd2cfaa46e343b06e801c71329d82364fe093090

SHA256
2bb2ce653cce940f966a43ad20aaad050eea309eb14b378a8f3124ee6fbd098d

SHA512
51fad16ec96c4d529e77cd6a4fd7c5e89ff49733659474a24b81f150b110fca1fdcfc2abd84a766ef6173ec6a0c59884ee90556051b738b77ea8c92316461755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5931f13daf7392efed3348bf21a8f40

SHA1
225fa29f43946965cf90a559a860e38e91a0d2cb

SHA256
48429132c7e61e2e731efa6d1e20f88ecc1436269dee476e3a4997a9ec8287a5

SHA512
a80a8e4fef22f8db2af0181098cac0b0ae6fe8a567ba7d6e6fc8f3b64f003d0f8161fcad2d42b8cbbcca8a7b98250fd811bc3e41e7fc16f5320e070f5bc24524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4775eb4fd03404817b3d545c1c47c82

SHA1
c72de33194b24e59d04bfaa31753f767bed7a927

SHA256
439327d38c1914b9eb1e97bda08faec78cfa5e0d0cb59b0567ce64a9880c807e

SHA512
72a25e7aaffc6804edb66517892ce17508b7c4f1093eae9b5752a4de1491ccac5ffdb6fad6cc49f9e6ff39c1daec61a8432fe61e0bdaedcfd86b496ca4502244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5152155f996f8492140ec4628ce51dfb

SHA1
4159404e137e0ea7d5450102def7231ba840b0b7

SHA256
2f4642dca41b987208c80969688edf19f81511ff74b3c817a9ffcfdbb03c82f6

SHA512
e0e2a9dbc72be269f2c8687c60a0e66fdf7a87b7981ebceb337a8e829c75b67df4bfe58a0b5fc05b25d9e5043ff409306e22985ca60b2a1b836394218de15ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fadc4f4f70f9ab662fd80801273adbec

SHA1
82cac12a6f1a51caaf0c29387753d3251569e13a

SHA256
fe4eff518bae89240d4482b5e29e44c39a0763214c208d13a766117c21df49dc

SHA512
f5a0a563f2d17552a36c9dde3861cc3156cfe39d37420710e06235ec1b3c105698205e2ce7769987c084fa05dc30d26c9fac38867b8d2a0078f1759fdfc4031e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarABA2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit