d4717f907b6f55f06d6a25392616e11e5f0e99a32bb96499dc2d847294482719

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6879eda0ac1d997bb78a5d6fe0eee902_JaffaCakes118.html
Size

162KB
MD5

6879eda0ac1d997bb78a5d6fe0eee902
SHA1

d96636fa7e69e855136a97f6470faba28d0192e9
SHA256

d4717f907b6f55f06d6a25392616e11e5f0e99a32bb96499dc2d847294482719
SHA512

bd3a45bef3e6bb48cd39edeb2253841973c77c144957106d7b6ae3a9be3cb4fdd14748b40e9dac724b22d7d88fb7156558df3eda3b1c44b6fd8e7e631f842570
SSDEEP

3072:T0uChAakfXajm5QGvcS+ApxWIdxRS0w2KQa467s/kEDWxweoiHbVmshLBwKOciou:40f5zSu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f094d3a884acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB3F8DB1-1877-11EF-8303-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008b2d33870eb63b4e91e61d5dfe2dd3d000000000020000000000106600000001000020000000d15dfb2af0738ce3bf19469003fb09d763877d56ac60c7044a553c0bdb50ad89000000000e8000000002000020000000a02e30974604131d7cd8f2109c6a333450797ea033b0bdd0c021da53c45eb6f790000000a81c53d63c3147a8cf556834fe09c4b89fc7fa1dc9d988fe71776cff2eca595e3d29a8a728a54ce35d806e61f456ce8d80135a9a034d486bdd03a1990964ed82fca4b9bb88de3e1ee1fd50d7d707754f8bed41c87cf050d3507065239e6a96aa58d854fac9c045a2e5a1e00e8d3375e1fa9c4526a2d34311569eccf5f945095f0c7519ebe5b439fba91a525872e4605440000000c582ccc621b54aea341909667c61cdc1adc5fd9dd0664513636fb2d3598f812870e62326b7a3bae02a4812ff7ab739b9471e5af3b1d8fccbeabee0ff7a26a9c7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570675"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008b2d33870eb63b4e91e61d5dfe2dd3d000000000020000000000106600000001000020000000a6694785cb428199fade86bb650db0e7d6fbb376a1e1a9a22b1c398605c61a01000000000e800000000200002000000015dea70380cd63805f88f30b8d70420d00c66dab24ef2160cd2f3381a6fb3f412000000048ccc9d599c8d5ff0550a87a6120a9142c8f4ba175626bf55c41665188d3df60400000009475dbf626aea6839200a9065328865850ff410c809737dfeb4b3729767ad107fcef6784263a11dbd6f4df1849dd1718de65d2589ea976431b2e2b384b1a1450	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1344	2224	iexplore.exe	28
PID 2224 wrote to memory of 1344	2224	iexplore.exe	28
PID 2224 wrote to memory of 1344	2224	iexplore.exe	28
PID 2224 wrote to memory of 1344	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6879eda0ac1d997bb78a5d6fe0eee902_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c928e1d06d7f1cadbdbf19791713f4a5

SHA1
4562206f6b3c9212d38fa880e3846524ed44dd27

SHA256
594182e2c821c04611cf87815b0c0cea09b3211a545535c02b05522fcdbfe7e9

SHA512
79bf691c927dfdf947fe9ee0beb62cb6716cd1ced15781228ed0ad677832a5c710b61d1538d778b09d84197d07092375fe37e8a9636611ce8ea064023b4fe029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
697b17b96de0e1ab4c16a22e6647dd7a

SHA1
dddfa85c3bb12246bc39076b01c6c3894244b702

SHA256
1b12056b7b7d4849137a2a962f55d74d06a908f1fd85a56c140dbcc72dc0831a

SHA512
7045af08fb3f426a2e76b950f96124eff2a2f2803573fe64c06741b11ec1fed6c33e00a8ca9945ab475db4613e84d891bfbe0ab9ee0276fbe0d5f275442f75dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f192793a7bcf4fd4263531f9b9e67bf

SHA1
ac52403fd0e8dfb185ae4ef68ffcde510948cd8d

SHA256
883fdf69e1495fa92591246c054b3eaa7e5a9a326324d1f4d38a41d4d7b46588

SHA512
657fbd74787d1b9a32fece2be95a38b1aafbd27f87ffa9d7140e18505793067c345cf5ec60231858df08c5c7b7fc280d99ff83777e4ee4264d01d783cc56097d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b05087ec31cef6cc5bb1ac1a62b16bfd

SHA1
04d0b3cb9c741472b9c9d57276a590430a2b563c

SHA256
a734a935207f5b2f9d714f6c467feaa0c47f1f224f03fe5afb9332c774f647ae

SHA512
033d5f110639192b77e30d83be6e09cc51c2a0ca80e81ec0385a1a25329ea0e6d5714447486b2c301d01512fd524c1a2674c19f2d886ecb12e1ffd833807a202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d3bed8e0425944ffee9ec133bf3997f

SHA1
b107c10f800e55eb54962f8634725114291e0556

SHA256
1c04038776d1bfacb843de4507e15b0e0b60f27c39e9f4e3a074abcf309c5dc8

SHA512
19191baab888ce4b66ce5c1f347542eab2d43ad7bd74161fe0d74a5bca902bb2de8059805e509c3d1a8137e88ec9bed2514d84849d51d7192612b76cd70a9bf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d8037df682a80be76a330249397758

SHA1
5ba307a377b90ed856271e39a4c49a41ec23bd50

SHA256
e01e9362d18153bea3c18930ab38536b24dec1472b11fcace875baa3e27bd27a

SHA512
4da18de5d2f5c0c8686aa650c9ec8debb69a3427a796bb40e9f32c40acc44f6262a40c64e0dbc009aa6000edb391fe20e82816e45ce35f28404c5e24d1c030a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785b548f44bbd83fd3c47ce7b8e60a60

SHA1
d7e2f9719d666170b98715875a41d90f1382edae

SHA256
6314f66e6634fc18ad3619fb15a471dbfa2b192b5681488af4e1ce9203d96cee

SHA512
4bb8c2036870f8c2a59ffdff32fa1be87eede031ac6b425d2f8917bb44c6f68bd1059a5b2f3f716bf11b223c03fc7753ce27e161cf931d8993813fb98b53358b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
576864d6c59aabad4049f8865d0ad983

SHA1
4d9fe1c99b2f0fb9b3af770e0b8ba93d16e4a61f

SHA256
be7b3a68b0a62f61a308b6d2b8407f24a172a82851ce4a76bd952a90901f560f

SHA512
f2b680bff89a3e517c802192d2386233685a69d76637cf98bcbb5ae3f6d361d2d38a90cdfe18d96c34275e82041fc08ddedba4b95701ed95e98a57438e3ee902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
131df3a0041c1031a36482cbc0e98f7d

SHA1
bf2f3cf9476a5f03ddfe0fdd8cb7bed5d4f97289

SHA256
3a4016fd156ddfd761f7cdc5378e386f2a5aa33c705c3529f4099096fba13f96

SHA512
23a3ae05e0e61c53b2c0aa0b0877b47627be61e81307e1e870f394443f478647c87407c83e1a4ae7490d8b179635cc57601ce7c4b7d36fbc414bbb857be8ad24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3431fae6aaf186da1b98e5da28c9f4b

SHA1
023a9ed6e56cc7eba9002d67eca9da4532484e80

SHA256
dd2f5e6feebda4a0c0de7463dd9b17368d3fef1dee81b4edf5a5c814dc23340b

SHA512
08624d2bdc768c4bf98da777de613981cabdec905b039729e98876c230ee3f611927d2e4d85976d212dd511834eda7c08863b289d878e9042b9dc9616907ebe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14f53cf4c5452558395ee1159c0ba031

SHA1
e70a876f532f0046c910f6e40ba15dcfe8c0ee9c

SHA256
88a80b5c88155f72e0aa6efcc2e30ec841de1449e41ead7361e10204f8a7698c

SHA512
9cef3d4fae4c5cd0b3f4f0f359f23b7b0815f192594d5035a3d525290e1c8dcce88ae9c5d31120520a4e19baa1a4b40776ad2bb8a8572b21e0be818d08aa55ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c515f21be923777dbb9d3d7eb61b8127

SHA1
9e3e7d638e8f6e0fea280af8d4136c3e74fb88ae

SHA256
47d811734a405f0b99784df20ea4fcab534498f9905378ddbfbb4e17010ac76f

SHA512
ba8d5d7a4c70ba9bd4dedc55d8c77acaa438c8ed6bbe2f4819d2e8a441071d0d095122e90d422bf6c6ece3447211677fb8edb4dc680ac55738eba6ee2f64292c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02fff55f9b638f91c0c2e4fb3a41ea53

SHA1
67de867b2d53e88541db7115cc654aa9cd3f6d38

SHA256
652abfc42ee847e6656ceb3aa1d848704cbac6b3d75aed4b975bbae83983e50b

SHA512
de4e44d3e05393b338a1d3176810bc7067e32ba467e3c87d4198e44cc8e1a01088f5a7cc9aa3e10c3914d50a0f1acc8f1e99f672ef5dc78d8a79176143f40147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6eba035dbe7f460c6aeaf5698e1d1335

SHA1
c225fa5a157cc877bc1d2684738a2f9ae232eadc

SHA256
33bb26bb3bb22eb227723ef699715cfacff881aed696f308af2332a2b75b033b

SHA512
a3e0aab8caeb49236fd2ed49790a5d9dc0a649b755871ddcbc145192ff9ea85fa6dde0182fe44df9f24ec2907bac7207c831faa6288358028143c93b34c31c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4052.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit