b28e3e9c9dbc705d63fcab2ec0a46d315f6892c6980b3dac9b45c0ff98d3ba31

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c6aded902c199b4696b59ca29c81e6d_JaffaCakes118.html
Size

18KB
MD5

6c6aded902c199b4696b59ca29c81e6d
SHA1

88c03d6394913fa7097c6ea3c4e2f3088af62e71
SHA256

b28e3e9c9dbc705d63fcab2ec0a46d315f6892c6980b3dac9b45c0ff98d3ba31
SHA512

a9a93e3c7440d82c5b87030cafdb2abf56a0658c385ecaad50a2a7c62282eb328b1556f361f0e275e0d48c35ace4936bce7f6716488c86157232eafe89938088
SSDEEP

384:m56ubg1ZT5a59WEa2ftp63N/SO8q01gla9g0VSeJn7/7ZCU8Y8Egq371sg5huwNi:/uVY6OD06aqxeLnyB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000009b017654312c428dcdf41f91af0b32d4c10c8706d6829b51688b5e47955c245000000000e800000000200002000000056e423a4f2eef2192b7de45209471f899686b546867aad88eeccbed8004421cc2000000037e10629803f5d6f906bd7c7da958f954b82a2b23513eebb624702aea75a0092400000001ff1f2d35fa5381eeab1b9473060657bb77c24b9ba193b4c0a77d13b607187348feb25e3b6145951bd8401f91f9f24b3722e2b0b226f1dcd846f3a3fb72a8b53	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422664085"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D5429D1-1951-11EF-8189-4637C9E50E53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000c0181fd8864bf690ed1a7bb930be393eae5d557f8a3faa227d702b03740e7a52000000000e80000000020000200000004590b86850e8be7fb968abfbd285d812a675082bcb372a94d2aa44a987b1f123900000005816d965673d730a433a3d6d67b946567c62bca397ee246560a41c70268275bd2db4884c3789176bc04860ebcdd466753177a8c8cb9b0b420dfef4b13608d394b53c828a70125fd37cda1472e185aba3d6d9af3b6ce16ed3e46d90c031cbdb15616ff351504821e9e9be954986339c76911c0fa07643581d525e57bf903b90247d9326742be3bccb9dcd2d8ed22794b640000000e4b451cb4718cfe8328ba431ef6b47b456fe60ee358e4017f1027a1ac98797bd3506d7b69d4079aa4d261f2710f824c14b49d79021aa802b3c2c4876f19d498e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02336125eadda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2780	1680	iexplore.exe	28
PID 1680 wrote to memory of 2780	1680	iexplore.exe	28
PID 1680 wrote to memory of 2780	1680	iexplore.exe	28
PID 1680 wrote to memory of 2780	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c6aded902c199b4696b59ca29c81e6d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0b531790a6f503dc0f2de9053ae14e1

SHA1
81bb11878f59eab67a06faf39c960557b17b460b

SHA256
27ebb0fcc01221b064b59f0bf31a78bbdb129c91f5f322cdbb1c73fd0143aa06

SHA512
a76ce08963ab9cc305114eb1496c5c6df193de0646158dbd6dece4df9d196d3b9879ce97daf8a3380a296c3a548f0f06fca8ff4acffce4b77f188a5bed8cf14a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15f8963aeabe40fcb55820594bee6321

SHA1
abb98de3bbe3f7d9565346b3233c8368aeab5835

SHA256
1b66e4153a91744139cb63742a5ec8b70142d20903a19f20edecb482650175ed

SHA512
8301bf0e898b45ccc5da4f3e89af4a2c469c86cdf12ccd1e02cd5efaa99bd2ae74bcf08a1b73641591ca4d0f7b7080ce4798dadded3083236800869fdf3506ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a0823c41d3d11801a4dec56ec49cf7d

SHA1
18fa01e0f6a1e456f4fa51d0dce9af7bc36cf179

SHA256
80671d2b145f9a8342144a66ac96dda23a4f5334ef637dd808d1781fd1298d56

SHA512
085a673dd5822382a681542fe368f602c6f306166674d8ffd6a13de116b0a35a2aa6891d7bc091cc41d6f16b3eddf81f084acbb799f82bc4e93da9d0e5066c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
982190e442405deaa4519ff3ebcd889f

SHA1
cea08d8480839344775352e6526002f74ad23bd6

SHA256
823ba0d2dc58194698fa11f2a5f925bad68f261bde917b4313956421bc225a12

SHA512
e51cb69aa156c5fe9f31b28ce18ac6c56495896f7cd0b2703714e3f1f60fd8fa557741a06b04523bed6061ec38993940ca1e43e8f43fa287a2535ae121205832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19a59e8464c3c0f4b9389734a1fe0575

SHA1
71de70445be54cc03d0df264424372ac8932a587

SHA256
c44e39c64082dd82847ddbc40c0f2498cc0f7ba89ca1fb84688911e4521895cd

SHA512
fc4f1780c968d7b33e335bc879b14c6ce4395b14164b9e08ba4d89d0fa4c7adb3651c6ebe59cf90aca293f4b1a58278f51a685f762f06c64be8c8ca17c22480c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b40a48bfc532634a59e9b0deedb5addd

SHA1
e6c6b2c36c608cee093bc9182af42e821371be57

SHA256
2f3a7bdc051f3420aea7b6288e19d354984372da2c2307d2b201deaa42b17973

SHA512
7e7f6eccbab8949915549c5a5f0a6bec9cc39cec67e8f1d71b572665d8dafad0eb561f978473b9502baef090723d784d7d11d546655ac5548079d29f7fa8cae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b51415213c8d73ae4180f89c0414e9ad

SHA1
4bc7af93dd5e4686248f7250db7a7d536eb951fc

SHA256
b23528a00761757f3e19acba98d4d2199c4e8c62b0c0ab2f72e4ddd6c61e34eb

SHA512
f91431f9087cb46240e99955c7c1ec04427ef99aecc0544bffb80d99dcd435df49521edf3e79bd8230aa1754b90cb43cfa7fb2415e5d8670b8f928c8d87bf855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2c6f4e87d495db5f217fbd00956f048

SHA1
7d2c01ca33feb1aba0412f46087536865ff5546a

SHA256
2f6a819f1f2bb785fd816fb2012a21e8d56590f1827bcfba84be6b1aed153c2d

SHA512
b2de8ff44334d92b5be882b5ac8124da8dd23c86b8393d3a311ac6aac970f0985f570de07a59446147120b5d8a536b91b50d65f349afc512df5edcce82a33a46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
478467960777229a87e970e7b5bb56fd

SHA1
d81fa29cf4af16f15dbe8f150610e06ceda8b7e2

SHA256
671368851d28acf51ac1a4f87e8bcf231debbcf421657ae49be2aa6fb85a1603

SHA512
946816d6e74a92f0fdb43580a45390eea307cacdec9ede48315b1fc35e7a6b14bd02fa720e80140e65b36a3d7fbe8aacaf96ee02c45901988368b7e4f93c2b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f74e14dd7278b3611a0ec160dc138673

SHA1
4c285589074fb6414c98c1c1de71ed2f02575901

SHA256
ed7d3ecb8e4ab19fa5b05fe234cf9626a25b98ebf91d2a4fbfc207f0972eb505

SHA512
db655cab8cca3bc606a23f09571ffd8552c003021923c860f940deb196445872224af58de59003d550b9e453e520d9865a4dfc39fb3ee8cac49bd85b82f4191c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b034b163a3866820c829f5b8187d56

SHA1
5f5fa29adaac0580bfd64e64f47ce9dbac959748

SHA256
6ba1c054f0ed030cc8c1f603117de1ca6434523ad0ae04ba5e4eb96162b191ff

SHA512
d93651d91f0240f04e5d71f5616c8536611e38b844f3930bf381f5cf8cb01f94c0c6c1f38a624026e09bb06bce894d1a3c129dff889910473b677e3b51ec1c96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
218b1a63360e7ae90efd17c9aebfd990

SHA1
e1c1c2d4c32fb884c965b89ef801e3a4b5e4f00b

SHA256
e5ec8cd0a49608f38561f7b982701141420c0f74a692bafa8c8b334fcf7431c8

SHA512
9477bf80422df79669b6f7b4fd395604d334a6b6729ada234bd14cea8797bbf857ff16ec2935b8e186dd7cdd8401c9fe4e20b7884fb509a58145b512f23091c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
776d53a2e0ad732b1009ad716914c749

SHA1
965ce120eb1c02cf91cec5a5389621ea90c10f4b

SHA256
69ead537e7b9ea38f1b520d8a3887ebf2f7ce3c728b21e53bacba6ff1bfc70e5

SHA512
cbf10e3c7c93f149d14332ebecded56d56f65f487772645f9bfe8e908975e859a8d474be327b8ab71380c270662f0dce4c1e1b995ad54a8836e164619811b0ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9934c0bc92c180a08562005ca1dc6579

SHA1
79742147fdde5b27e4f642c0ff97bd15eeeca322

SHA256
5c8c36e112a0503ed2929baa5ecc30928045ae8a133b73f71d14e4a689c677a2

SHA512
3208939e41e25552ee6aca3b47df82fcf525a8463a27ea6292a0620f1411582b592f3a5ff345fd535ce157a6e3f465f50f31764ec6e553a9de1c842d250edb9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BA5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BE7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit