91c1e040fe0fc38a397fd5eabcffb0de2f828d658910e6716f362be09a7061c1

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b4c12a827e68ddb09295fd4c1285369_JaffaCakes118.html
Size

65KB
MD5

6b4c12a827e68ddb09295fd4c1285369
SHA1

fce0f7fd2564ef83411571927ab06a6c5eb3f8c2
SHA256

91c1e040fe0fc38a397fd5eabcffb0de2f828d658910e6716f362be09a7061c1
SHA512

9d490ef1af33803456f00515acaa792ed29af13c9893d8da04fdb9750fec3744af6179d15c1891dc32626ad8d6379010ff04628bd11f30e52eddfdfca519db21
SSDEEP

768:JidgcM0St8tN99OIsP/GhzDJhNoTyOqhCZkoTnMdtbBnfBgN8/oycc8QFVG8sP/i:JZ+Pz4TIgec0tbrgaCcFNnzAC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7044c7ac20adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007e72696c16f0cda8d36159bfebd0f3cd3e6c5096358ad21414ef9e81d4f134bd000000000e8000000002000020000000cf6d179c0c0569c579c90376ea0487af3495a384f1789ff18857e1054e5ff04190000000f38d59dad958d12b41ab0320e275c075617a44619d4e84fe834b06031ed697d2c074efe3289b51025e7b6c79650224bfdc2538a12a6b70c21a57fa88ae9fb7accb1c9091c0f65f88fd1f9c980701ab496903e618dce349c90b9b94ca4dde000a5f559c315f880353443a59ec034bb986ae12d1ea11092bbce0734e2bbdb364d88b27fad8634c1ad74d90f55924015d544000000012e7d4d8e1299bbb0e98c6f444cc17869261321be83abc0a0c234a3e015fc90fd399821970280a1aa5fae5c5bc8f4263107544906fbe0dae029f4bc8856ab3df	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6FC2301-1913-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422637717"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e9cdc684c9c28056ddbe0ccc5837f1d94655f45ae4e6bdba78dbef6234a33eda000000000e80000000020000200000005985631e63421c1aac1dcedbf8fdb342470a7c0fa9b8ba98dea3cd4b0f427083200000009f812ad9a4670906a291cfe2a13d76ff21d83a955f18ddfe0c4dc4b4cae88aeb4000000015c543ddd172ecbad9c4b2332b6b878af743bb6762cafcbb7c0f9558ca7d85bdf6c38f3d3c11ff9c9039e2e6e9ffb0df5e68a9f17210511fd98fede7dca5470d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2148	1688	iexplore.exe	28
PID 1688 wrote to memory of 2148	1688	iexplore.exe	28
PID 1688 wrote to memory of 2148	1688	iexplore.exe	28
PID 1688 wrote to memory of 2148	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b4c12a827e68ddb09295fd4c1285369_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df8ff9bf092f78fd7dd5c5b20f0d7116

SHA1
ab72a1e80332e17055bef2d816109a6f61243134

SHA256
f33a0d13e1a283a30e9bcb0e934eb8f1af9292d83e752a79a2e51a389676e679

SHA512
458fc86e3d95f8d922e30258c53ff04b539e258121240a4b4832914f060611b1c35d72de7a9e70469393ffd5e52016d32a0237ef91dcb68352f518e0876061dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9766c3631a256de6d862cafaab337566

SHA1
f5acd2433f8791dc998982810fd988c0671c0907

SHA256
81a74eca23e903a79bd3e3a0df15b750ca395f125e61bdd077149d5327dff1c9

SHA512
dc855d6083074baa1c4ad8091fb4a5f1184349385a1d9d6fd86ba0b5a2f681773164b36d206a2dfdb3613c434c08dbb53483e4823ea4be0638fd111d53df9d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f30acfa33898f7d595ace3c6ba0ab1f

SHA1
7ab4559af19f7818aaecbf452c57f39a193a186b

SHA256
029a0338746b778b20fb0ca6982afe9a2ba0b8d09e79087c3e17195271e3506a

SHA512
a475fb3fb4086475f5d1338f2e65dd36eb97c8361933900fa92d0a8679a94fc1d15c20e1c6437f252ecc4842fd09d8d2addce29698e5062b57f925502127ff83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d94caef9553dc86836355b52852a2b3

SHA1
7f6773fbe96305e6fe34b5fda0c8475372a6eb19

SHA256
b4ad7960ff078d114b8d8a10f5b5266e7be6eaa9f7e78ee922e1b173ba0e0a9e

SHA512
97a91ca76efdc88eb2c49f9467c46e68d2b8c34378cbcb44ccb0a4b88e45b4be42ce9895c43d9368d155e32bf0c5159829ec28a2ff552caee20e94aaf0fa9bbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d80a7893583dce16d4ea1288361cbf41

SHA1
ef5850261752f45030a6d66d05ff18c7ffefa457

SHA256
20e18aefb8f4353af0ac55c5c0c33ff87f6f6ec2e64b49ada080963bda3411d8

SHA512
982ed46e1850a79bd5b21a2808f055dfd0e1ffb7a60a9cec14fd6e819b5980ea08dc5e6d98eaf946908ebe9c7fae3ff4806208af3690d3cba76100b58ef1afa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd720f21b546d9077aa62f59a3d82adf

SHA1
387876faf5984eb365cefd157e288d4b57a462ea

SHA256
5215335edc9a662a4700f4b72a891ea518bb87e70beb3c2a8b3b4f8516fc7537

SHA512
c6cc78ec881bc029e929ea9f4250f098436e2495d3bd6c8f13abe0e3556f55602624c244538947cd73064b1e78a6c684a4c48b001a9500cd27335e7f0f46746f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee23bfe954aec289cc822cd9c611822f

SHA1
0d85cd6045a45e773f4e64e1a76a940b8045335a

SHA256
1e0477cd51fd74d0cb3d719084a1fbdf15db29be7d589ecd57bb69a68f7c8e3e

SHA512
2e4f693fe38f14f7beb529209478c9234614f42658714e8e4c7389a7ef81bc1ffd973c2ca5420ead6d7abac8f65b8be0db269d26d3430e3ce088df65812cd174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
061a2107fd104ba80acc2679a427d813

SHA1
b0b47d4a292eaa930d4cf796ea6b50594f7b1ee5

SHA256
4b7288f3adf9be09f9fe88917b0624416083ab9e31ea43f2ec93bfb0a180486e

SHA512
640e6109f6570b32d0bd5fd38e98284532e687ba3631b839fcbfb19a6bf18587c597d200f1d4a60449c63780ab2964b7c6e8d5a5909db5e1973fe0f51d926dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf4b817b056020d13618d91ff58b9cda

SHA1
efdb1b9651e30695a6ad0c9d94476d8a657c7920

SHA256
7e75395dbceb3c035c68b4fefab2fb2e80b442efa94e1aad6e6f4c1cf64442ca

SHA512
abed934f654ef8f1b0bd9e4e36e32bd4b1dbe58f5fabbef1e263fbe71bdcde852cebde3851873f728709395714adccec9ba8d0e54e773a833af81af8b89dbe16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
793e8436de90ecf34bc7c9fe9ee5d715

SHA1
8ffd69ffcaef8dc40b7867831ab2fc0700661b2f

SHA256
3048334629b25c953e92113663b37c7382decf3340cbc3974bead4117a763d18

SHA512
8fc4fe5466f340a5cebb980a5165aec9a1ab8b7be7f491264ab4d2bfe4f1a5260f95c8ed7486839f3baf6c50dd81503335ef591741e02680960064ed7b0f680a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6982881ea7fbce55481964904f3fa660

SHA1
7daf5bfeb5e1b3cbf93bfa9dd18e2107a6a5f2d5

SHA256
e9bd381b749a30c5a71885f878e8f0055d05dd0a4f56c5d4ee8bc58cdf00b42a

SHA512
68f609473674a1f3e9451d9939b1aa6b3508f5bb00384aeabcb17e895882123bd4137865f275286a4705a5a55901935b7185b8807cf1693dd2f5a1a9f8cf8f69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc06d06086b59eedb678554f7a85f37e

SHA1
c8a09b89dbfc42ce8c195276de2d2f1b87510859

SHA256
c1b42c820ced2d9769ae3e36c0462b433d8a856a2647ef90e77b4186af164576

SHA512
82effc57768f7e47a31b512c0747d20ea55d6318fdfbc896790442a5ab687a5669142dede082a73d9787a00d1d31467b62fd99dcf1cbce32c5232697ea992df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
698969a6968c4227e88741ebea72a48a

SHA1
a37f6934479491189994c537ecc144406a665de3

SHA256
1f8bf14b5de11770aef5f2b5852d043df669431887ae0fce18a6233dc90becaa

SHA512
dbed272bec27b9cbbab24f1c626977ccc7339389643766e308857f1d0869a8d7f78cf61da3b290a442674e7249cf8d84b417f0ea984f43ed9e4afc8d1717dca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14d92b43de7911beb948caa981cf3988

SHA1
3cb84f6061503847f6b864b9135f284573a685e7

SHA256
72c914ee43368306a5eff71ce218fff1810f5855b46b53832e2b454ebe85ea4c

SHA512
6cecfc546d844c44c36d6018774cb42773815c6afa215061c0ed20d525534dc5df0686dd88d8e922615c196438b454232a91b9fec1125367febedd76f9a4b1b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3470c32af63035c4700ada17d0e8c315

SHA1
e9c235a9df01eba5e2fe8759f0cf875d2193cb9e

SHA256
e538f3579ccd3636b00874696a0cf181c7dc0b85bb5e0401741bf62b86b3ac3d

SHA512
322ed6a9e96a6ab98d1b248d7164622eddfe9fa666fbf5e6034f21b1bb4575dc193d9fefacf42eba5ac52e67be338d009d07279174b5656e22fabba4b77bc4e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab51F9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar526A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit