4ed4308a292347a86f18e5802b9d6002f1eaccc3b536758be3513db707489804

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a151f8a7519d4abf32a8231d69b13e4_JaffaCakes118.html
Size

138KB
MD5

6a151f8a7519d4abf32a8231d69b13e4
SHA1

15b1f6c99d745cb7a38275c102dab4b3237b3323
SHA256

4ed4308a292347a86f18e5802b9d6002f1eaccc3b536758be3513db707489804
SHA512

3df1f02e50741ceccf0eb7a04ff01b4554a853f9a6d54a8ecabd24b93d528fb860aaeae140a4f2714486e636bbd5c92d17e72397259d96cd75ae6d3c98ce6d3c
SSDEEP

3072:v3e2njkyW1IsLZU3qiSFFOAA9A/LmtLlbgpFfeH6Gk46fBz6g5:v37nG1IeZU3qiSG9Vt5ULeH7k4CMg5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ffcc425ca830d236dee132979d31ae3210ad3352ec522f598cd8ce81cd9508d5000000000e80000000020000200000009d5871957aab8e1f55b190fc2b22b3c08636fb99f4bc2d55c76bfd1936c31b29200000008bd77e02ef5812d1b66de77c9deae747d1022cfe13f95c0bc55e0afaca2df5ea40000000bacb712a6f2b4f1a18df91f4c196acebda7b6b1f6f809f1ce05ade2a94b3082b62734f297c908dc23f9c7d00c357777f5f4cd89f99049a4737174d220ec92803	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AF602C1-18D0-11EF-B0DE-E64BF8A7A69F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7058e414ddacda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422608677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000051a4d75ce60af955a0f962a6eba54df6154cd6f9d0d51b74fd3790b8c020ccc8000000000e800000000200002000000083b03087d8c4ddb6d9d51d3b78175e6c09f9c9f80c57ad47f4e14638f7f3af2b9000000075b7fec60a8e6682ae8e1db78c70ed6f4a96b2bcfab881013cf85ece1d6b09df335010420a60c1530160f8973f194d5a9b01f440f2bb5b5dfcf49d46c6b9b32286ce35cec84f067b1f332c591449bbb31baf72c55f21e987418664b1056de13c775c7a4e9418be3046930273e37570b3b1fb43bc8ecf006778354ae27e5f5d218a2789a6f0390da2dcc592a1cc82ea3b40000000d491e134a7a20a9bc9918444c04b963e0972cd8c2c7179fc8b769b9445e48dc29196c67ee61181e78bee9beb66d6d81da955b2023d5748602d528564b38309de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2168	1928	iexplore.exe	28
PID 1928 wrote to memory of 2168	1928	iexplore.exe	28
PID 1928 wrote to memory of 2168	1928	iexplore.exe	28
PID 1928 wrote to memory of 2168	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a151f8a7519d4abf32a8231d69b13e4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46c4748dde7518321c6d5600704d8e17

SHA1
54e45d4ff166ec151eaa2d11f7834c0e9f7e1093

SHA256
5fabc787271101afdf5fffbd7a241fd5ce849f990a7978e5b313543eb109c2c8

SHA512
86ef0f310337db400cfc53d5e83916b7e93e617476204363125841b11e9c86fa513de6f82b6f47186a3e05affbcffac3726c455716fe19aec0cce7ea2e05add5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fb10a6998712b62a6bbe3c25114192e

SHA1
c101eaf5dfda68d646c4821cefec6afb21edc167

SHA256
522e1c8fa56ac3be8e088f3a27f0409d5955246895cbf10d7c7cbbea7daf2f1c

SHA512
41f15c336b359677c9a56cfa9e16b04f2a21bf27ddb551a32046c2c9cb4be04b929875e9c2fcc8172d6f28a5fbf3f2abc2876d7ac82554dbb949a9c684b934d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9d8ea8d19912ee60c9c63a287724fda

SHA1
1d6bf6ebaf0d69397223a243d45c56c2ebedaf4e

SHA256
ac1fe5ea80baa5363fe30de48e710fc388c97208a49586d6bd9030315cdd2bc3

SHA512
7038fb0c94f349a89ad5737afddbe36ac4257216e141ca372380cadb53f8d4572dd8cc6b1131f20a053d826eef765bb66b1e6b9c0a4f482398fe12a5807341b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfb28832f01d1462eebc964187601b48

SHA1
8cc57449d6fb79d11d53d8b5d44e28d4808e0b82

SHA256
780a354c984cf3379ff21cd9ec80ba55e3a6c0716c2eabce642dc3770c5aeb57

SHA512
27f01e53abb3d4b2b8955e145d34e6c1820c59fdc3bd1a1af00e42f5fcb3708603eebef13eb3eb33b7698c456771866f56d4507f3b2f7316c253cbd45fdcf958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5afc449043eacc06054ae9cf0eab7404

SHA1
9f556b8a4b465ef2247ac8a064743dd1981e9dfb

SHA256
45113db23e917a633efbe9033d0b9c918e6583d903c7fd815711d96abc57664f

SHA512
043f06a912ab2c2ccd951843d9c4830f56aeccfd835ca24805ec3450d9a760953c0ebdcbec6936cee795a5a0739907e6271f524959f416f6c605b8a4dad70333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaf25d32d55af7b6be5a01b52d53ee3b

SHA1
9a7820c54bc92fd4f1ca167c4133945514fc5003

SHA256
72b3553c6f57e54f4baeb54f8304c93e25a98932d1c259cbd9e84ed6c5d6f997

SHA512
5b2399e57e3a9a76e83222f8674db7b54ca9eca19f20f11bc2a9ba5ca18c6f51c74b58851a8575a40947cee95d999e900204c2b0c1347a3ababe29f208086b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff7b10a74a9c7102c48dd90a2fda67f9

SHA1
1fb40be9cf9714784e157c01b352863e79bc32d8

SHA256
094272fdddb2d46956ea81b75d470cb011d41c15025e9be97e6e909d66b84058

SHA512
2683f10fbe0cc40bfbe5deac148d43a7051b8f319e21ae6e9551063ad90be8fc6df7486f7d20492cefdc8b1bd8b2f38be7c923f71e4d9810bce64bd66ccdb882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
facfd19f83264441f696b1179ad5e9d8

SHA1
9665ab1fe2258c2bbd91d4983e0282c3fd8ab2bc

SHA256
4da33564aa481010f67b8b20cabd407212bc6c38e33c97726b6991abb9eebb57

SHA512
0872a082c99e3c19ce05c8de0e90713dad8b5a4cf20ca4c09da9aae2c24c3436f57188acd3a5e98dfbcdf036e7fd1aef8725989bc1e1fa75787a8815beb6c17d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c7ceff0b9ac50acf7ad64db1277ae35

SHA1
d7c202cc639d950839deb060c87804b13b6b48b6

SHA256
6ffff072eb0fc5185b2143d99e65cbc79c6e954d498cd4be208a9464f1c8d509

SHA512
ac6cd7d30e363c2f81940f586b492bd7b17fb09ed4019b444d2c59f32e779188fd18d25874534b32ddc7e0bc757c050f2dfff0435f382a47ff5b61ee8fcdd3d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2afe3650a7734f1d5c9e44fc6e5527b

SHA1
9955bc73e9e28e9f20f38f007e99f94f44184f5f

SHA256
c8c2a6947ee62bb2fe0f626d9d7962cadc7156a0cf011f8b35d5fd04e0d4a595

SHA512
9b86aed434fe6f8c72c008297b242ac3053c3ecf0c4cee2512b859c31b27326fa5a65030ab31ef57583bd2ffd6799dfb6a6c69601681854df07ad1e76576886b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5fd189977823b0565641d847488d2c9

SHA1
feb5a79f93128388b4d1ee29d510e9906cc02d2c

SHA256
51437c34883482f98a16ba464dfec9cb8595ad33e4ff372d44d91b8727539d7a

SHA512
1d183ef4b74f6c4704249c793f737df4f4dc9b423c5c682825b99f44cce5b962197ebd6f9487624aa01814fbce6953ca26cd0734f495c1b4b7701f183b214e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0233a1a1120b5578658bf7a89ab6c7e3

SHA1
058fc3d2dee092afbc4d034bf15d64ebfe3ee4c6

SHA256
70c87eec9a296f14337d904b19e8e02cef0587bbb24b20473205a314b4e1b279

SHA512
ab66373fd057b26535847489cc53e6da6bda783b2630353ff61150ffe5376d31876a50e1acce882bcb22725a54efe0bc517190d1b6c9b79d7612afd490f407e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\widgets[1].js

Filesize
90KB

MD5
824beb891744db98ccbd3a456e59e0f7

SHA1
57082a005d743ec4a7f928a928bd7bd561078c7c

SHA256
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

SHA512
6c19e304af16ae43504a44eb60c542526d0d8f635e4f57ab557e93999ad608be99c25354898ef4826defe63f8ba72e4d09c5eac445efbde4587534ca202958e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DFE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E11.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit