29b2b99a5a3f4e2a01a8d7d945ab624d0b1b11a639cadb34e692c7ff886c540c

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b2338595959ac125179398c8e7b4f9e_JaffaCakes118.html
Size

3KB
MD5

6b2338595959ac125179398c8e7b4f9e
SHA1

168c0b15cab4c7e1377f8dffb0438d97c8e973db
SHA256

29b2b99a5a3f4e2a01a8d7d945ab624d0b1b11a639cadb34e692c7ff886c540c
SHA512

07db2b1bfcdb84b93e1bcd4175a6197ad302fad960370a5c20348d98865e99c5c0ad72318a158e88a51b9ad27de1bd6eee079aa87780edba9b980c5cb98e75b6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c511d717adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{020027D1-190B-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422633924"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d123525075e2f4408b939cececc40cc50000000002000000000010660000000100002000000079cac44c63548ccb0f93cc481b402a55748e8150b00549d59698c0fa2cdb8fd7000000000e80000000020000200000007983513d9cfdcd0c420ea96a5ab998a2b6111ed487e7237ae20be424b756a2cb2000000009f0ec57b46cf91a4e1773d08740effe7e08dbfd0835931d2fdbc5fc3e5c9ebc400000004672eee2f9ee2ad4091f722e1a4c66b5fd87b6f8c7de0b4cacb65c272f73f47e918d9f8055bc98e9393a5ca7f8996550ff351e074d5396db47505bb4dcfe9c67	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d123525075e2f4408b939cececc40cc500000000020000000000106600000001000020000000d781a8c9319531193eb1004b9d7f067a2615295cefbfd40d67013ad541a45f9b000000000e8000000002000020000000a40ec73cea76f2aa3655550f5e1a9ad7941609f65e96581234a649a3f9474e0d90000000d3e252a78e2b0f0f4702727f1dd46e44df9cb59a4208601ed7747197f92a3478b88db467024bd35198561f9de25a74881c7e05efd8aa35ce1ce95374d163cd1de0e74e48d41b7cf7052ef27b78479186445ba6e7d7a1602ae00e08abe9959641f96e30fc864756ad1ff2fd3a23435febe34619f4dde75b0e64a667f6ad7abd071e45409c4dd75fda83967bdcd5e2490c4000000047e1c235b9177764d1e5ae300bbcfea11c83458ac05e08fce3fc628eab1a4dd4f05307dbc8bedbc9f4a1826d98cb3123b15d2662edbbbb8d2bb1d0f67e0c20e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
856	iexplore.exe
856	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3012	856	iexplore.exe	28
PID 856 wrote to memory of 3012	856	iexplore.exe	28
PID 856 wrote to memory of 3012	856	iexplore.exe	28
PID 856 wrote to memory of 3012	856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b2338595959ac125179398c8e7b4f9e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81a6c0946dcd497ed6be1ca75f9cff4f

SHA1
8e109daaa533854984aaa0e227ec2bdca55fe59a

SHA256
8baae9bea0fe6789f5f3181735c9bb0bcb2feeb5a1363af12050ec4836fa81e3

SHA512
bf1fdb52e976c7488e09541180180d2f667fc5f7fe77c145e72585acc9cb39e51878240d52a5165ad59403fa04a89a3f06fb8bdb7ef0e2ea8ac1d4ebf49e7272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f45f9ec4ee58923b63d15747a6f8daa

SHA1
1db88e7e5c1ca30c542d796daebfd5fee4c06cea

SHA256
d1467c529c4bc94109fc8a1b2759aaf1b84ef9109b42161143796bfd6615e766

SHA512
9e5f3f5077fc0972248e4b80459e09466c28699961aba240c3e858f80316a63333ffacb9486fa8c69c799405a6cecbbba72ac8b1c9af8f6d1136125338f57b82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40dcb10d287e65593cdf9fc46a7ed713

SHA1
4b70bb565755cd3bd10808e798aa7314ae98d7eb

SHA256
0b01ec6d3ce15bc4894cc317c6c8408b6c18967e73ea1e8ad6a54acd4e1c2428

SHA512
a5dcd84002517ccc395714ce2939732b84e367f3a5184d0fe547862c65b14bc8dfa85637ab89b392bbb9effdb611a76c16c27028ca9f98c9182935a4add24ff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff90317a525f8eaa4edba31c6cdb065c

SHA1
923f58d34578b657e8ece6047e73974514585c9f

SHA256
0582badad2077fdffe238e6749dad15bca9d5c01409d0da97dfd0f13d86b7415

SHA512
f625db4eb6c9fed5ae71fc9dcb0ccd3ff24acd15189760aa5808a6a673377164594d4107c9e79bfe59f4a670952b1cbf7df350f2e4480832c2a0a53a23a41b56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
938f5a7ee34313eba111152a25e8e85e

SHA1
aab2284d1f57f608fadde2a16299f7e4b8ba817f

SHA256
fe6baf999fcb92117467f3080c134ebfbcc49c19fc3b0d2d52b8d65ecd6b7923

SHA512
45f7b1901ae932e05407d8fa62a60f8d0449db64ce985fa8527cb50a8ab420b462a390469465a90f9b35c6dbe8a8231d921234509363b5dd81bc996d222c63c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
237a96a70a218b6164206a56a2a3017f

SHA1
6a4d598d0877e93e2ec4aebd277ed567f641fea9

SHA256
cac6fbcafed1d85098550d9651e8391826ee185282d6c997ed7995c2fa00d35f

SHA512
f721e9cf506831a561c7eca0295b7273f19a52ab076acae4201ac343090a8d3dee025ea00fc3d5a901534424019f51ad7855bfb39f688c496d43f35bd603233d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6d4fcb6dbf8a5dd77f8d1a16876d66f

SHA1
8542a7f9338235c02a5021bf96cca8fc7b54cc19

SHA256
2a382b2914f562971b833c1ffef235794aefe16b65add5d4ac6986478f555d3b

SHA512
2babc1b34cfbbff5953ccfac833c120af3c9c8f51ac5c1a5a62a8343eb300b397159c7aa8d4f859eec302810773576a74d6cd7761a4db2e7819b4e11079d9ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b743bb73914f3cd58f295cd5d060cb9

SHA1
b763b333328e8e93644858991852401e56786c41

SHA256
8fa3a0ef68647f7014cbb01de6c8c506f878f1679982c6c20552bd3e6514cbdf

SHA512
93574c4eaff7f706a7bcbb65db8f53a20fac0f374a908822e7241ca8b6d0f2a8291d7e548796b78363b0631c9a7d8dd7570b6fc327fbd6594ae41a411fbb5a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0f398fccfa05ca90163205e79a40e4b

SHA1
5738af8a78e94e4efbc8ac8317214417c80c83fb

SHA256
75a9554b755a477e4f0eb55fb137d591618e966f316d95577c126c793c9249d6

SHA512
7664ac723a02416fe28fafba17bb33fa6145150a5a31572f49f651cbc45e092c332ddc5ac78bee896d8f657ff4c96d47c9553f5b697533f40118b2847b671aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53ba3ba47db58f9838f86f55b6394f34

SHA1
796d6021c7b95f2e097cd5071a4ff35b91f7337d

SHA256
f11fa8732e028c3def5163a48af4667d9320248ae0aabf978bef10bf2a320b74

SHA512
1c6d4cfcd5d27a322fc0df6da67af25d45843c738f6d07d5c65f4d1c2ca6e6ed842a49200730afdfc106b3bde5bf05d5e232dbdb540bf42a9328c38381c3d1e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67a38a5757b0d501028ffbeccb2e4469

SHA1
54c7947df941af3f2f15c2f0201ab6c66074b081

SHA256
ff6ec4a207c1c57fd28a0cbfc31e223618cae45873445c0c4ab92309049afc3b

SHA512
60437914241895d535f28391afadd42ab586880bdf4c3f7fd2fc027572d858a1124f255c8169711620b442db60e89b76e25c1ffbdf277c4091107847472c0c21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eab246a60857f74f4ec293cff063ad14

SHA1
8fdfb0c4e5f17ff329ca40093ced969b67080206

SHA256
c32f1c29b83ab176d41bde7e2dea8067365f98cebb5b9d0ba657c98d7c75b405

SHA512
1a1808352cddde3f2b527b56380224b35e8f5ebe18b3ec5a48adf50110b6a68489a24e04506a2eb0cf4f9581ed1590b4e5ccc0e0e3a8fe7e9ace54b344955c1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
749189edfcce400c151cb46b173c9801

SHA1
5a1171f50b36c665c2db342e1bb9216cfab80418

SHA256
94170b99905a2532b6833d91f930f2a779af862c6b3d653f198f5a7fbc0fe88d

SHA512
dbcc30b4b484c90cc465b7284c40443e40a41ebff3cd4aa09257915e41221cd46a39961288bc4d24133cd30d94fd6f96cf80b40bdcd55cb191a86559bc49c32d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
636556703efb2bf18692d83dc820b49f

SHA1
95efcdcdc09351c27307a6a9a2e239ef981b8c88

SHA256
69b40134dc1ae0d527d28fe271a4a21ecf7b5ff32224d2ad2fa732d9fe7117a7

SHA512
a223477748a72b89248bb643f9abade3f595be1f6c795ca26176667e6a3be4cd411c2d1c8a48650f93aed4dedf8416c92e89dd3fa8507295d251ddb41a0ec1fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA585.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6C0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6F5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit