9c276102e8ef835976f2023f3b875e4bfdf47377f7e8563f735ec23c81d80247

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a8a1807c186f77767af4eb5f1935082_JaffaCakes118.html
Size

52KB
MD5

6a8a1807c186f77767af4eb5f1935082
SHA1

219402c9bc226cdbac277ba0cfa6a9659b764560
SHA256

9c276102e8ef835976f2023f3b875e4bfdf47377f7e8563f735ec23c81d80247
SHA512

cda403ae1befd895d5c420663d7aaa720f7c10212fe546e4c53008b082edbb39e8722ff6ef97c0e9f9fde04bef3c8a10842b4b00c4df81365dacd3dc73ca85cd
SSDEEP

768:no8TcedgC/1+rfA9qLYDh+q1XYTyiS0TBIAp76aFw:MedgXrfA9qLYDcqcIzaFw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422619601"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000000b484d36338d2e6a2dfcfa816c274d7ebaf854e1d28f64a45a16cd8183ddf041000000000e80000000020000200000002ec23a3f43515f64d7119eb453cd3af3b2041a7e23925c77910d1adac8793a75900000006772eb4d2030f1f2a683853a3285a3d962c893a7493cc85c6723b7681789c2db411f34783db58c6e0ffff934f82e4c641308daadc07db0809456371b119679449b1451b9bd9d8292e9657768b43a4b09c061de0723a39d205e28a7e0dc253e7fe66dd74fb9d0c70909bea8fa52b3dc482df70443f11c730a27846c922fcd40cf2ec60b2e1047c88a5db2e96ad263464240000000d0d74c85384e7049c6f29b240c08823707bbf135299db0ab239f512461d434e72ea11ef7e5e403ba2c386d2e6f926082ff1829ca64e31da466df1b356792f70f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004935597b3b3c5b834b03ffd83a6c2dddea487c947df073c7f80a23c37e1c2ca5000000000e80000000020000200000007608ef60f077f016d3576775fe1006220e31121cc99eee6605ce6fc9feefe0dc200000001f1d17f08bd7237428253c5e211d13415662829af65b4f5376653bfa8cff59e340000000e0e74678813a352c6ce439073bb19fff436b4c754ce30f68fd7d72970a7a096b02ef01aaa11ebb0970ce15f08d7a0cfbfa148a2dcdba570004e11ea41fee8383	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAC96291-18E9-11EF-91AC-F2A35BA0AE8D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306f9898f6acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2748	iexplore.exe
2748	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2612	2748	iexplore.exe	28
PID 2748 wrote to memory of 2612	2748	iexplore.exe	28
PID 2748 wrote to memory of 2612	2748	iexplore.exe	28
PID 2748 wrote to memory of 2612	2748	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a8a1807c186f77767af4eb5f1935082_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01674dd13c8ee11b6bba13566320e6d8

SHA1
eea94ab4dd7ba2af8003a1ca7c199aea9b8889aa

SHA256
7315806211292b32270b218be3f8b08a6694fe74db4da6846f8642eab3683966

SHA512
ce0179688610b80cb9ac4abc31d257602943655b75353689f2c5afecba00ba02f2f28869086f4195b7954a7241679391d90766afdf26efc6b1955f8c087ce460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47abe789c503be24c85d3820a13e5733

SHA1
b3b2d417562aa262682a66eec4cbfb43c31101b0

SHA256
36356aeffcf28a45f6cb1871ccc2e8f1691eacfbfd47641c41f766a5e6b9524b

SHA512
e47ce444d142ba4d9317967de84765d3dceb89738fc8c17a4a56f856e63fb655b385268225aa55baad6b4f04e95554fb174e9032080bccf64ae4afda59fff9d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2d30db80f679d079b9afc61991deed0

SHA1
2cfa29328dda079d17becbc8382787e0470cff36

SHA256
da57fe95eda89fbd0cac7964bccfc1ff7d62d57d7723384665b86514f8d35dd1

SHA512
4bf82f8173078d2a5c6d73baaab5881926f9f12e31bffcc76db9d50bdf0cb0a584f3de5e8296c013cca20a243a79fbf1ce50eae4af0dc91e7fc6b67a682739bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3373f880665d692db2037d0e9b9f81f

SHA1
98b9210237ccdb2b5885bb1ddeebec6ff62bcf73

SHA256
f72c36e7a9c1ecd1be65024c7b9d0df6d279af8d7251fd5a9962a2b6d6d1cef3

SHA512
46e49e5898f57c3643c399b176e4da383f64670d1d2a4b8b8b11d8a668a00805900480cd4d2365a4be9e9007a1df145f0f27a0671c94bcbd668f52946b3d0a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e89b470bdf2920b41669faf4484db9f

SHA1
3666e41d93cb2d899cdd5800a2186ba6e13fb9f7

SHA256
e54e937696c4c42c4c4777f2778a5f215bbf25543d80e6f28285684662a4d792

SHA512
434b02a1b712aff3a18633000b1c2b4e3c0d8704959bab4bf4c54dee8d9417cd99d5ce19a0f8ee42995b73c768abd7b06b761883fe2526045c8c5a5410dbdf00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0fee177aed411b0dc35da68e45fd29c

SHA1
37e5fb16d8785c0cb54104dc79c39e3434dd99d9

SHA256
8672c6ba35f830c10d427b9947d4dbefbbbf7eb26e93e717a13f39c85076d5ed

SHA512
83ba5a8ac322dfc458fd28249db23b7fcc90c0c38bb5f6c1eec054e512c6ea85e83c16f0aad8ba89e986f4d9672a19f4393c579432114c05258764bcbbd4dba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1005e27409f5f6e4d53aedba29096d67

SHA1
59ec664bde3a4e4a548d17c2390248eed569f171

SHA256
11cdba002a2d1bab95b14dcf9f1ba1f94d290b10b1a9ce34354c73c2ba8f0048

SHA512
2eca8e9fe611f44dc60bd38bd4a0ee8636fa590f9e479d4bdbf29055f89955336061654a312480900ba9942bf76f4f66acc2e459382739b0891797646c2eedb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505dbf048092ef6ba80f32f7c83458d4

SHA1
37928fe4a1beca73057db36d7193715d430098aa

SHA256
ba1d1e823066de614ae507f299e6d2571e4e89301d522c569b50292976af7785

SHA512
6f349f96f3876ef3269078e7697c49c38ab1ccd79cf4a8694f1827eea755d90c59562961dbc98d468bb482c4db82b75d876649ea4e6d7e642b8dae62903660ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
599068729db6e65c694dca2cb8982058

SHA1
94dc839f2b03021ee87d544cdb73260cf668278e

SHA256
ddbb2cabb0ce72faab490e2ff50a8891ae9d470cd008f9a98263dfde9948f609

SHA512
64f4892e5e89571ffd011b9ccddbcbd23cd8b5f93a7a7bba8e727bb639846bfd1bb7d79d092ab7c1ac08306e01d02d077ba535eabdcad7f7a20d3c160bd99f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c13ab81bdecebd67d2e0c65a00245e11

SHA1
0fe0c9e45b8138aed349b607f6eddb3b59aff615

SHA256
d2a6e11aa496a01e0f8ab0c1fc4ca71edf598952a54047d9b27a08ce1b69155e

SHA512
f8bb5d3a1f3c87302df8fd42d92ec54c399b911b6105aada797f2608cdea44a7f97c4f1baa92482e5f75fcdc4ba967fab3bbe66e644b51aa535749b6acfae23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd54d02bab46d51ca6bdd28887d849be

SHA1
09417e98c7b5ac5cbc18a948f49d791fe3f4d355

SHA256
b5906981d09d46a37529d73c4d657001bbfa0aa567512969008f0e199da65fe6

SHA512
78a68d9c1dcee2cb69efe79d0b2dce95f7b92a06d9146d8140fae3f096be9f35e4f43bcdb5042fc72deab67352f060871e8080b06b0399f789daf7917aa47b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee64675786bb79c365ae4000f4a0954f

SHA1
f195cf003aee921dcef75ed5e5479ec4fd191638

SHA256
1f2ad8a10cad3c854d324f6364e544767967f4e1c2bd5f1a3fe97fdbe0da8d7a

SHA512
b609d655ce80238b4f027f0b13258e02caedb24537ed1753a1735ab507173e8d4a843e5cbb2719e98bd67c0ccdeb4493db65c9f33ac8b8cc89da9b3b2c20223b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eaa7e47497fdf94d686ee1f7725bbbc

SHA1
5fa91248e5db6d167fc83f7e8b46b2b22dbdc47d

SHA256
a05065014a1bb40dbdf1fe5f3dc2f2bdd87c7f46333c99b748c95ef346155873

SHA512
37379712146d1381a60e2a47d7abdd2125c63d1a1e6c3b0314a60fbd6e6a6d75d06b0e4da3f3d4658bff456fb31ce919b7e2e582d906d97510f247ff87a5d172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a0f58f060922a45e27d6982df9438a6

SHA1
910172225b8e915d62ba2bad170adf95cd1273cc

SHA256
b2b0ace5eb4010f294ba582071257248b0b47159bf23803519e9b13ab9fca75b

SHA512
eedb1abdf8769c2e0b9740eec49d8a8475921efe7606fb397e17bf998dfcd3bb7f58af290f282c15f25fc25856370cc11df1208b94271c0dedf3e82b07b050a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6395f450055b9cbf6c903bd8120d5693

SHA1
139cb6895450e5b065c5f11a4fbee71ee73404c0

SHA256
cc8cc3f2c645e172705d8c6f0a00d28f285457b080131e5111e16c65f38f5bee

SHA512
999336be321a209249406747614e2fb8f7eb561c68ae0b21222c147bf52dde72d68607006c9d50ea886cf6720d7bd29c575ad42b1e8783555500e922f72c3be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
934b9317c74751072624522dd20a9759

SHA1
6f7728af1c778bcf0af95284174de27516d248c4

SHA256
21567e5961cc33cd541466c27a6ace4495b9ecfaa5f286e3810bbbf3e970c724

SHA512
6327893bf702db367bace67d78d81557e40a117e792d74a6063ff2f21de67198f1998afacf4071d90b8bb82892657af1c2edd6d67d4368dbc2c9b94802d77206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43dbad86176aaf4326230627b3b61440

SHA1
3f19e59314a6d5f7a46474c0b2d5baefcf0d33fb

SHA256
e4cde9fae1be664796028796c30f40b8706d0e0e91ced8fa15bceb15ea59f0a3

SHA512
de35b7cd17a60782316c2722453a9ca3e205753c314484f047dcf8f1b69cdccc0a21539055539d5a089eb9946492393f46429c33f499d29dc2f2b834073165e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD7FA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD84B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit