6b9b128301d8a40b9af494f7de351635b93c220efd3f85007282176fab179496

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69432c7a1eeea70f813a131ff2af2d92_JaffaCakes118.html
Size

6KB
MD5

69432c7a1eeea70f813a131ff2af2d92
SHA1

0ca6a96054bd5b2c6e034331a104b2c1720e998a
SHA256

6b9b128301d8a40b9af494f7de351635b93c220efd3f85007282176fab179496
SHA512

7169adfe9e2ec82291d4ade4ea8802b7095b8373d374741f7708f71e8b5d8c90fda53e875d8659e86c997823a49a40c2b1625dcb09fe460a543d21176f9c93bf
SSDEEP

96:IhM3sHfib8TJyYdtgk6bGQWhWJEmgWDjr2a:IhM32pZXgkGGQWoP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005a802a62013970fe88411dbd94f030f61a58894005bdfd35d9a47494132ce8bd000000000e8000000002000020000000f84ce1f3f843613af52b003e83a1571f1a9cd8981899a1141fb971ca1ec46e0720000000620c74cd62adb473e683e4f206e7d59176ac7d14adf20a623b7b36f3ed241ffe40000000ddeec92e9e2da4f2254b4d88a930714ea9ba8927288b16916c15436bf13684ae85267b4894a141eb6115262f61b7d986a08f176d41803399424e4d251d3febfe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70df892fafacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B0EE4B1-18A2-11EF-94AD-7A58A1FDD547} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000040ef50f2d2e091693865049e8505632cdefca5e3d223364dd39f8414f6f61831000000000e80000000020000200000002e04b2194864782258b13579607904b730f1eeca9ba468d1d8f0ef2f254a9b4a900000004bae0d8b251e2a21f20b1340f477162c23041f91a53d5f84d007d4e13c2237a3f67154509b34314952362ffb037f53ce4dd1006e2ccf49d90a435c09d7cd5644bc6d4a16f2d6976975b7b7137e9506c79f519b4204ecfda6832060e91d7480f0964adcb2283f946a6607e246f2421ee4795875ec7feeb4c9ba365301ed18841a4cb9fdb35129a4e332d2f04d51c926e140000000fa7928b5f797df9400e2d94fbc907d2f440e602a21746315c9c5fbbc56df7bf68ecb8b62695bccdd4bcefcccd38fdc262fbda53cd238a5905bc4f4fc2f7a0ba9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422588974"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2100	1252	iexplore.exe	28
PID 1252 wrote to memory of 2100	1252	iexplore.exe	28
PID 1252 wrote to memory of 2100	1252	iexplore.exe	28
PID 1252 wrote to memory of 2100	1252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69432c7a1eeea70f813a131ff2af2d92_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8abe8aa4dd8638f0225ea2fee4391c4

SHA1
9f7da3cf65461c34c6bdbc986502eaafb33ea771

SHA256
576e7e6b0a48593e88c31e7ef6377ab6da23559994e0b9addd63bb59221f7e3b

SHA512
ea0cd53d4944caaf819f2d07cb368b9e36c16194f1f50cee07acea20820667efe7ddd8f89254da9ba6e41d03ad5f4325c30c13861c319e6f3f8fb7037e1c402e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d27f3d3dd76fb244c408cab987f55753

SHA1
96f0a5d569cc85f81fa7a2b887669aad1de94521

SHA256
218f733455d49f6ea3fff81fda8261ece3c0f8f4aad0def0f4af067333739af3

SHA512
1bb72cb4f0876759242919ce93fa865d6d58b40313e09cc8590a65dcd0f2a8c1b67500b71f0f021506375ccf1ecb8b8de7e795ce2a4ba6e36438926c02efd159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47aeb38a8d02ee64a476d87066f12cfb

SHA1
4492669d1f040f29115dfb2a1a84fd662724f60c

SHA256
384685e097b93f0e1d19cf2a8870601a1db8466486a65d7ed466ab1229e27ce7

SHA512
4b2fcf32046ec8cc9df588f157c83a8d3a5a2b18d262af45f14bf82de3c1d4775e0f924cf9e83131a2b81579f6f2dced3c1d72150332b2b6894d32f1e5d416cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
006600512cc9d78918de6d1959aa0976

SHA1
8c8401dd27d99a04901517bbfae24b4275acf45d

SHA256
6adb9604ca4843dbff909ec4c5973f55c9443789e4716ca054a770d135aa83d5

SHA512
fe97b82518c8f09cdd89fe8a8d5aac4982cb62f7ca5a9488010e86f8c77c657fd60248e356be7862d7935c41614476df3c97d4913c64bc083f79b6b5142d142a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ab6b8cd3b82ca9055a8e4417be0a17

SHA1
de041f25f1b953e493fb1765a33291548797e64f

SHA256
ecdfbdf4512c56c56c54176b396f5048e61c58ec2000880a24489f03b1edd2f9

SHA512
4ab21ad1391ad6268995372df32df43b1d305586c5604a1fb869a7b51916f127dd5a05219a544ec5e47e04b04ac8a1c4b48ea76e69d15c5a64cc1c8bd573c55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f89696b62f5cd2a74a7a7da25f7d674c

SHA1
65c05927832ee4f5cdb1ead17b79012bc033bf05

SHA256
cc9f9795db04c3758a812f03ab9f4889ef39d3b6c86519075dc094e859b96a13

SHA512
87f9a8de19d8420c08f82238841ad466a4992663682f8e6f746062af9a2c7805d1cb30a5a01eeaff518b2f20275465d99a344a1060321f417f82d8262a364ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d600e8b5a3e97864989a68524fce01ef

SHA1
386a4e185b50e9ed4ea1417a4dda8c3dcb2bdc84

SHA256
103dfeba1605f53516ed67b8a73626ce68862df7f8f7cc3ec0d5342e5fc8ede8

SHA512
55ad8e429e36b682039905e402108bb6e2dd6f6b1b36da7678a52ab94b4bdba368693ee84e2eb765405966d790e4567663a866edff96d8559d5460bd8c6c6d4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e727636ca5cc8f2028535bd8974f8ec

SHA1
f50e8dceee0c122aac95fcbbd0c1b69ba3119c6f

SHA256
1599b941c106ceee6df88b55bc3e0b805a19f111ae76b16daefb85209504bef8

SHA512
f1ba5469d090962f925ba07e6ce3d7e3b9e9d5861eb8da6b83c0088879ff290fee70dfa57714a6a2700d3ca84ed0a13245674313e9172cf7a9d52e170764670a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a25ce3f6dcc9869e99c4800d497b81c

SHA1
aa967a2c22f90b95590da6c1f01a580197e0acc3

SHA256
50fd41d9bf45ed67e976cde6e10241c79d3465ce1e2d222e4f8a178153f60a6e

SHA512
638a484f3d4fcd8045905a57b173b860599598375ed32361851a6760957c469162e7ba64f74a43e61727c05c7d1fdb6722d233512643a6edae0421b81c3cf28d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
556b5c92004ec0b2e806885be86ea75a

SHA1
3fd724b711b90556cab481fea1101fa0373c984b

SHA256
e61b637765d7413ef7f239afdfbf00afc65189baad5e4ba883433aaae09e4d00

SHA512
b2861d329ad79008cebf124725bcd8de99918313ff6b6c2973a091dcf41a5b29031b52755bf0f38e0355b211dacc31fa65e1d4df1e9eba2be4e49a63436cd1c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ac4eb781052587749d652c46f907921

SHA1
e4c510a70bfac45bfe37541430932403bb575eaa

SHA256
da61e6d6001ee18d58b95b72a72f5020044c4bdffb82ea16b88a1096e81230e1

SHA512
ad156d0a18702090df253adb83253ec35ec49fa87ada48394671f1f9c15883bb30b8ecb649384b490e9aafee93b722f84e79713e6bef564f76a68c76f384dba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbef63fb840e88c6cfbdaf178075fbbe

SHA1
723f557c46534351c78cd4d1ed1091557bcf4ac6

SHA256
45cb9eb9b8679daaf3aae0d99f1ad50499a666c30650a3319d36bccc58a103d8

SHA512
6b1f726d1b02f2e35da60fc301393d292b99466d4ceac9e4c725201ce563cfa49ee4e3a4ea11fbd63f694bc999f48bc530b30dc619e4e02cf810ae9390584d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E3B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E5E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit