27c72daf918a2878e5813983e12d526549fc05310179676eeb7594e2780362fb

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c8f351f3b027f3b8c14693dda901901_JaffaCakes118.html
Size

148KB
MD5

6c8f351f3b027f3b8c14693dda901901
SHA1

f46884afab4784e2f9fb55acf536eb08f374e80b
SHA256

27c72daf918a2878e5813983e12d526549fc05310179676eeb7594e2780362fb
SHA512

3e0681f426fed92e6e3b4c36e4bdde9ef07200b37371e4f36bd54e8a431317bf1fa4bcfa79f242b130c8b1fb7ff3c6ceadb967d9845eae16e813990d8524d817
SSDEEP

1536:WbrWtHQj5HIw7du02f8ZV1OyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP06:KoyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000802d2b683330285f16b6a747bfaf947875df1ba0e5ab270e9f23c4a324ed29f000000000e800000000200002000000020e4f62578e88b83a03a375e226e74728f3c043bc2f33c47295fc74b47f6e82d90000000958976377d1ecc3a2ed0e8d3d4aad4dcbab43269c78a0cb950f03dec42e5c74cfcf2d0d23c6e383c6f265d80852d5e25e3317beccc87294c957c91cbefa2c45ebbd417934b5cf5df82351d35075d91a99cae2d861119f33245cbc974de99008a338683ff58eca2e7b2de67e5b7e266329dbcce54056b7262c701ffbb802a8950215309fc2c2469ce830a2b7c867a7c034000000077c060b3f9b24836ab38156da2f95231221f81c33f438424e19427b47139e91adcbc8318ebaf126091aeba656805f3b66f886158be0491b94e47690a7a4074e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307402b565adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E05DC1C1-1958-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000053c1ab71f7782642198e85e7377db9808bd081b3c1f7a8f1c2e1b1666ca1240c000000000e8000000002000020000000bf8cd56885539919ac29d3c64fc9b07b596a38ea8ed72deb2b1b5fed92d3dbc020000000f465bf64e2c2f9275d4a5edba992be56312871a3b80f9ed90d4e4d5aa86017db4000000009ed72b81a8c703e825ff7f0905cf47895ba082f3afe94ac19775d53e01dc95e4162fe286d02ec3ad5b38b2392326bc784f74ba1bf3230544dc462b36b3d0635	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422667366"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2168	3052	iexplore.exe	28
PID 3052 wrote to memory of 2168	3052	iexplore.exe	28
PID 3052 wrote to memory of 2168	3052	iexplore.exe	28
PID 3052 wrote to memory of 2168	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c8f351f3b027f3b8c14693dda901901_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0ff3439280ab0aaf225e75a46300a08

SHA1
f7e85a36a30c0795ca6671423301b42f549ac3c2

SHA256
4c54f4d11b555eefa6d57f939bf74aea01228306d427166d39d817bac6532167

SHA512
04a530370524e21b0ef5cbd3152d3d0cc2e5495883e8dba9aae1e0531a8e328f55a7ce2083353f0922f3991031f6474fc14fa9f91c16c61a189b1c1ceb4eeb3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ceb7867e7843ecc76a869037e120879

SHA1
53967d9b9b4e3de55c2f026620b1e2a79cdd2356

SHA256
872c8f01ae1e092a5ccd868dce3d504c1d27aef3d2da2a5654b425bcbba41667

SHA512
952484f87a4af83f3cf13762e641b4a45e16edfa55378098decd204d224c9e75d6f9bae25569f5d531e05bd41e4c9e0c5fbedf8e59c52677c5ee901137a871f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0fc1b5ac2a374ec260d1d2df9ff5083

SHA1
fd3d8e0ad8e760196c67e59ab777fc6011ae8a38

SHA256
2b906066d3b5e7d1437f0c31a8b7365daf389c268ef7269d5af7b6de1b914f71

SHA512
e3dcc7c981aa12471516778aa36b46e58ca2652fa5d6edebad691eead18b326ad3bc61a6fa0c267eb010779c90ffa32b6ca07eec05071aa5f4dae08cf9b50626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af2ca53adef5f961229b3f38759c8134

SHA1
31f3cede47c343d5377d1312eb118e05637238a3

SHA256
12e34355636a9ece0fd7a7192b354e3d7963252accc615ae40774b292347ae33

SHA512
b93c756ede0acc3be306a7884e581ea31f3604492d326cb171b898bb2326c8c26181e5a7bf47798214cd8f9bc429f3a35e79b64ab6d0cb6380e852f7af2666f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34c2897068d019d3ce3160d111a9ef72

SHA1
e73e19ebc10e1e9fba5f975734dbf1862ae92327

SHA256
47a931327cb4b5010059c97a4752f703e34e66ceb4c576d3f41c12452a15313e

SHA512
dbdb2695b9107e0e02fa690294b4005d505e0c9fc6954c81856567dda86ce48a6c2038474bcc3a975e42012bad84750886fad6553e792a90ceef99d774c1480c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26b7dfce0a9147cd97c3fae390f5e67c

SHA1
871749f6bf4d09390b84465b003a5a16617ac1f3

SHA256
39ea3cceae5b949a80f284ac970c96c7c82a123b3b03d6fe3008907c265b5fe3

SHA512
e0b85976ce927bece49a0b8df00ddcc14bab15808f5b24f437ad0da86af01bc9834fc21a7cedfbf520ebcd772e96047d1e06323d2803380f80ccf5aeb957620f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e85aece15b5dff7ab4d676080e9b432

SHA1
97e635a9d5eccc7effd804c7af98e02e503c2016

SHA256
68ddd0e5c6e22ec8090ec7fd691ac75b375774a232f9c866dd5843e7123793d1

SHA512
e8c8d735e47e7107f67b7f8cc7f17060af74cc94849c2b98cc5b49e45273442e95cae020b182fe4b246ad71c798791b3d1da56a6e1df0425d08a214d575b8a43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c3d55f1df461c8922778e47d003fc24

SHA1
67605f2923d35fb35022c953fe56f635a27e260d

SHA256
e6734e7f005d6852070497091075da9b313b7c9aeab5a47b170ebc2dccf05c2e

SHA512
6a19e1c4f04ef09e57ee19deba67e74941d5cecb530339880747da63c8a8e0145892e6b20bbbc6314dd7d0d7dcdedf25c1273a9676bb13d2939ec10690869072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
098613f540ff3b5cfbb01b2eb34e04f5

SHA1
6cceb4ed8bf89fb19dc674b9c48c1dea951bc83d

SHA256
2d92ae0583c9aa387ae963b1a21b156a26542269975024935d6580319d3b6790

SHA512
4c434aab6e396d50e97220aaa18dee38adb3c748e8e65a200c94c95d581f541f4f866a400ab1595ca0aeed204573f81508e6fdae94fa294a25a601c93cbadf9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec6cce87e09d0707f5d953575f47a796

SHA1
89e1b41dc4867649269e29cb287b0ebadf845372

SHA256
88d8bf6fecb25faaee2e21ae1fa1081879d2b9f8b0dd83e68d2ca05371c2f279

SHA512
876ff22fbea8d00b84056092e0cd83335534c63c034166f3e4a670737af9c894ae786a912fa2803d2b8feabf5c2e70304b5b6811ae71d2807caca92236ee293a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d29111ccff1a9c40ed7afbfa67a7645

SHA1
80a0d367809e543ecadd18c39240cd11fa3cabd3

SHA256
6edc30df3dd0e173586c27bf63626c9f7f0b644b51d123ddd45c8983b22f5c4e

SHA512
bd6e9d68e0442a9d589f1be51dff8b96e8030e3d24779698586b0650aed3931227fafd01c6af3a4929a80289406c34a0a5c54c2de9d601fdb30db426c615d242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aabb5148f7586e7ea5737c91d6fcfbf

SHA1
aafc8c6810df68092e3dd85aa878dd9d03f2a6fc

SHA256
620d682350e6ec1fea6961000a3c4fdfb72f56644efecc7e171a49a253a87e04

SHA512
83bc76e0f3bae57b4f16f74f7868cff6785af61119628e46b587ed1c1eb6414b83951a8c8f476fb7bb2168e698d43e7cfdf112a1dc910a53697768abfe117209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbb5debdea14ddc2037af305d4992c80

SHA1
ab2958f6eb316d602f7b3f5db502dce914e9fcf7

SHA256
2af30744c929cdcf66068d495889559cbcf06f94c3052e13aabbadfdccf467b1

SHA512
81e6b3f1879dc098c58e512fe01d2e2d4662568dafabae8675519ace067a72886756bb55f05a315136b1eb2004cf31fd3021f757b46ae9cd4550aa7e7a10bf96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d147402c7ee59318c2a0948fe6712f96

SHA1
f2d17e28cfc60f9abd9f3bc93b915e223fdd5483

SHA256
76d3b372ec9057f28173bbfcfbaaa0aef8ffe5e18a3418c0cf4f211b86ee73ab

SHA512
40202ba9da4ac5e5ea8e9d913449421bc27045f3b791e3855f12196b74d20466881c5c589629f42a997711f96a7c0b897511ea26f6c8ffc9884a3d85af093b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
265ef44b20cff5a97238f970cea307ac

SHA1
a6a1156dead896b66a7b384c33ea290a8b6a1b96

SHA256
c1da168c592c812edf5e8eee517ec678802ac946674ee430ac06e0ba905b643b

SHA512
71a5f83a96fb1fe41d3a11967614fb2941a85780ab565faaf7d3cf54173f7f0afc30f9773f9c7afa73947fe8e031cfd91c11b116c96b7ea2dcbff503a5e67ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BBC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C1C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit