4e438c0671d96486d8ee7435c91a71f9a59f98616c9e0c77ab3316646facc66c

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6adc5ee83db54a0f2d03ae8d5085615f_JaffaCakes118.html
Size

7KB
MD5

6adc5ee83db54a0f2d03ae8d5085615f
SHA1

24a5d7dccfb0f1e1173bbf096815410465254763
SHA256

4e438c0671d96486d8ee7435c91a71f9a59f98616c9e0c77ab3316646facc66c
SHA512

deb217ea94d7737e4d7caf0910ae13eb983392cf41a65e529f6c7510c2741fd3167b851c37a5dbb667090153b313ce0c96d033e35f8b8d6dd3022215dd476c48
SSDEEP

192:C8x2Wln1DOYx8hUO1wOOTDq9SQOTw9HWje0XCQ:/ln1qYEUwJmZnE92jeQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C56BD61-18FB-11EF-822E-56D57A935C49} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2593ccca2f8634f8fd5bc472c5e813e00000000020000000000106600000001000020000000a248a7de0a5b0f0b888a9e775d22c28198d8bed54cc33e08bc5565946a83351d000000000e8000000002000020000000786ad00bbc9962f8a80cca6fb34587b1bbfe76ec28fc7458dbc7a202d0d1ef6e900000005df76bccfe418629b1096011884ec06a2ac5a9aea536cc236d864d05140ac3bb3004afafcd43966f7708bd62e241e29a306af5515f67afceec98ba84d40b9c6460fec1388e2c36bfeedbed4c88b791ae35141c055915b4934282fdf59cf7f92c25262ed3522da74057e1c4fdca2228baa9dbfcb77d0353e26fbb9b4e48e4e3a607b420b9ad6360a4e554dd6995c5f6df40000000bde0acde749fb3049dcab50d2edc701e67cace859169d20f2afebd2af2c609ebaf62817482f0d976a39f4aa2b5a410f2c815cdc0cfc27520c50d51bf3d6c8fa8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d3749008adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422627256"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2593ccca2f8634f8fd5bc472c5e813e00000000020000000000106600000001000020000000492f119e59979619f7add16a858832eedd63b7c40d705b2cb34b823b6042fe7f000000000e800000000200002000000065dee9e05964b569b0bcec0f02e980941d75219961cc345d7ccb3f310c02864d20000000face987abc0b62e753b6e84eda9b21f31744015fab602f9ed39a2bdd017f070e40000000abbd374c82871228eb42c3d5f22f6966a369e5fc9f9b4d318396c3618c4327377bb40d2d23ba991d4334a3e09108e203846577b847f912fd83e7187469015ab4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2324	3024	iexplore.exe	28
PID 3024 wrote to memory of 2324	3024	iexplore.exe	28
PID 3024 wrote to memory of 2324	3024	iexplore.exe	28
PID 3024 wrote to memory of 2324	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6adc5ee83db54a0f2d03ae8d5085615f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
44604bb4ac18161a5e19fd2662b054ff

SHA1
04c17b3b18b7685f37346d662f2733409151600d

SHA256
22a54ee28bf090d06086551045ca2cc96f6208269c486b66529798f7effacea7

SHA512
6ab6d5137e6aba01e397f5a2164f2b304b88563191e8a0169d92936feebc52c82b0d6f26472f924d3cb534b476f9cb2dffbfca4d20bf689bd2ab69cd8a6d198b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
26ebc7822a9dcce03669a4b6dfd97511

SHA1
1d625318d34c4b0b7350530bfdbe868f428bdf0f

SHA256
5d52878e551f76e9d9ab65ef9036840211b213269fc9050ca406be4c35ece80c

SHA512
62228b53eaa624c74d828e9720a7e2705fc9b95aba4758d849343b88bf25b0a464958ca9a87103f9026e37b92a5d01b5080d613e6ffda11ae0ffb89bf02b7057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
942926f8b93e42e66462fc9e8a2f12b5

SHA1
fb9eec0dbe8545feb4ce5e6a26c5c70c13565141

SHA256
58c039b869d1825ea0017ce48e4167b431dadcc631acd9ab1e57e78743e3b512

SHA512
a7a7a997f80cabcfbadbf3a5897e74523d03ee3e15bfcd60238e88f15d2f6b457875f883be8ebac7ba2250dc313acee7e6a0b05556050df9f4dac38afdb7874c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3f8ee9fe4653d735a7fb36425f55228c

SHA1
2bf34ec4ca45fef8a48dab5fa7f8a9db68870e87

SHA256
42bded2c71ec61329db02a75f86be8e5511c9c36924b695b65093c3db1fc00c5

SHA512
a7d11bec6f59ebc8adca235842a1af2db28ec9bc2eaba14506e95e67cf70897228a9d4ea3dbc363462b0c5058c0be56b1b6f30977e49371ed70d775bcf89c6de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1f38d13ca17f39bde8da4ac1eb41cd5a

SHA1
bf4a478ff9b9f60e7645426738e9e9fde8d2e6b5

SHA256
7fd1eeb484c7c38f46e878d3d82404f6498848078c6648ed01f3a9fa14d1d7a1

SHA512
a9bd7b6150d789de2843f638cd9524cbace5662429fcff28210fd1a71b6daad3ca14a8f37b2f731032af13988c1fca93fbe31bba39476622dd45032a05a059cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6d676bd3faecae2c6357887730f9ef53

SHA1
7cd50d8b97799bd55910046ee8d1670b9f6135b4

SHA256
0f7cfb2ddaed3f14b40d13a0ef52e6b2c03dc9cd81736c12a64f777e2e86449e

SHA512
74fcb0f7ffa05d440c894ac336345fa0c32c3328fb70e3be33aea01df1dc1e94b0cb04de7b2215ce7fb2ccf9a6565edd6153b9d65ac31ef3866394e98b0dcb1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f305796831a2b960bc8e288af2cba924

SHA1
680e089cf9287d3ad610603e8a246d33d76d2eb2

SHA256
af5733c79d60f06057dc089ccf592443b4040fdf73ba2a15dbf3e43f3e957568

SHA512
c0b87af9c2594cc7102a3117ab4716b1296964bf582e761a31790b8e70c1b9fdf50fa0ab14e81c2d95a4329ad5132a81acc21d9718f0154f7aa747a252416ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3c58073f6c6cc607d9855b8e65190f29

SHA1
ed7edd63415d1843acfa94cec5acb4f8544124d9

SHA256
98d1bf3b7dc5b4e83a5214fa86e27a7864d102fe2d6a8366505753cda2f57685

SHA512
d4f14d1573db1106f467e6c1d671114ad58d8a34c88d9dc2a7d5655d7222f10199ec681d6484b7934aca0cc00fdf568200ab65c0935281d29630871afa6e06cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
75db0bef535a9e190fcbf92f594b75fe

SHA1
b1d89b62d768f707ad19c288abd69ba56f00fa52

SHA256
3d70e985c4c6d905ce6d1f0e82b320a881a08f62adece3028ffc4be1cf37da0a

SHA512
9f4c282ef9b2a9e59396fe2ea9090d1005ae470274e29489a51f39b8e77bbfee2cf376c67d37ca5e663a43e374d4a319b7d600cc103ca70cfa6862400fe2db39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
54537eaed827747c3dfcd3d3ccbc88ed

SHA1
a2023e219aa95642692aa88a3c5fe48fd45aba27

SHA256
90897bee8cf2f79df54fee53f6ce268abdfd579250ba495b7eecc2eafc7e0613

SHA512
6d48d5660957ae4220e41546860ae2f0896380d3a669ddfc295ade72faef9de0428dfe05db974a8e6ff5e5e10160107baa6aab416dfd71d6a1d1dd4ecfdbc27a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0b5b85fa3462f70f5a46fdce302198f3

SHA1
024dcaf87bddae613842e7fc50c5b0e6c59442ca

SHA256
9085c948d23aa69a9fb035ccb24b9b2a1f57cba2be46c7abfafb6bd09a5ae87e

SHA512
5a2584fc786915d6b88067d454e01889af33f49d98a85ae89b964aea7397a130956582f8ffe9d803ddabe03219a6fbb5dfebd99bca335c2b64081f192e9ba5d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E4A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FBA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit