abaf6460e7f5285fd980eb6b6d5dac6344cc69ec3753cd0622d487dc5661e195

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b95a814345c1e42b752bd75e96e3c61_JaffaCakes118.html
Size

60KB
MD5

6b95a814345c1e42b752bd75e96e3c61
SHA1

b4ab9712e83a5d4d2e7be198ef8ccd5dcc902cbb
SHA256

abaf6460e7f5285fd980eb6b6d5dac6344cc69ec3753cd0622d487dc5661e195
SHA512

d5d57504f733f1788c428b594fdae2ba5dffe481cabb4dfb9812bb60c48a3cd258225eae5932a25090414e631cf4963c8e932db005c9e92c2bcbfc0fefdcfd47
SSDEEP

768:JikFgcMwUc9GeCSXuhvTcGXzfhoTyWhCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/IH:Jd+iR0VD2TRgec0tbrgamchNnWC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7fd6f63811242449e1bf528fdaf851200000000020000000000106600000001000020000000165062822db68c11bf2673fbec15271b09479aaaeb4518162499f6300b18f3e1000000000e80000000020000200000000820d4343b88fc97bceefe145ac73d0b870af7cc3c652aaec8d138e9c000020320000000b869824483bd6f0a4d993de3bc70cec1213782851e3b1763caf0563bafcffd76400000001bcefbb195105a3b1f337cbd09480cac2408b54672ac1fa0b7db0745fe1f334985f71d535d008dc66a178db7a5e12ee79eba0f6400f0061f74f77dd63c51331b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422644275"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C4F94F1-1923-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b01bf22fadda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7fd6f63811242449e1bf528fdaf8512000000000200000000001066000000010000200000005ea7bbd54a2461009d8958c648cbec3e19e0bfd2fa6de9e44a8436f896e2f1d7000000000e8000000002000020000000db6e8736f8a50809be1ff6626c045f714f55956eb86b58a10f2e27c7c23cf9c1900000004c5d1363ef75fb5fa0f2c62cf7d70b8e1cb2d34bfe028461300ae2d12bc70e3389ed9c03b8c66f3c43d770c1cc66f8e7d2d90886c4a4af4650a1db1e46303c73eab7b6041375fa6758d204e208347ec4eba2b2ed169cd959bb9d1dd35e3829ecea4e7a596a5767e9e74c5a4ccbcee2e44034955effaf6af7c0aa2168291730ddef92a006752fb5ca296e533560810d82400000001d6fbe3144d95b1d0787b69c6659e302942dde98200128fc45328d5a5be5e85df7c790c187b0f0371cef63f5042bf39fe52c7d7e7c054d177909c6fbdfbf6b78	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2464	2888	iexplore.exe	28
PID 2888 wrote to memory of 2464	2888	iexplore.exe	28
PID 2888 wrote to memory of 2464	2888	iexplore.exe	28
PID 2888 wrote to memory of 2464	2888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b95a814345c1e42b752bd75e96e3c61_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b81ecbb2e35a5fcf5627a5e61c69fc2e

SHA1
9db8f2138830e3dd59e64184f38fb81e5ace3c52

SHA256
691e633b4c72f99d1360c2d51a1889ce4cd59a57ab7691818a81af6e9bad4523

SHA512
bd1418e6a516246ab14f9e4de63d7598a06c4c3a78806817e180e9f8967ce5a4bbab37460b9a7188340bf856c37ed8f0ab6f0ef2c62a9ddbcab4761d92e7ad1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3849c2983da3aaaea0a23ce57ac17b01

SHA1
fe70b71924d67f8b102925eff39b128bcda1a81d

SHA256
cd1f0749696361b9afca49de176baa91f37c6f24b22e4af81fcc819248c4e98c

SHA512
62f6648b9a22e422e24573cc75758e5cf489eb3625199625564c5c21603767a2628f93dbf2ca949bc42c51b62c7c39b2ec89a21dd7a3a9147dbce20890de74d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
822d42a5856987a3b0235bfe17dc19b0

SHA1
33f5e4be0bc494871bfe44774af14d03f3aee59b

SHA256
5e178276c9663d62df9eb47eaccea8622196a9ffaa15ef44a3476cbaef39e1f7

SHA512
16f4678403f34da9bdeaf8a12c039b09eb99679bb5785d478c967770b184bb68622e5ab53eebe57e6f960cb5eb49d2e740b12ee56c80e594ecefd927af519d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c265a264bf9f9108ce72f6ad375ace75

SHA1
5dd2ed55e7db9c842abe1fe331ff29f2439b026a

SHA256
2888d2851015c950a28b15f635bbfdb7f41b92f48838951f46b5796379cf73fc

SHA512
d5d463c6890bb4b1372d2a4e021a6fb5d26987a81f4e186b0ddd1b1b4f110a1f4499b3b8a2551ba9de77d502ed06cbc1171ee97ee119d2acbe7d5f8f153e3a67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff342898a06931f85fcbad4edaf4a9c4

SHA1
c2027acb4d9ecef861c590ea2af7917c8123e056

SHA256
0a51b567215e291426c87ea71af4bc0ccf7894129099f2f82a72db6546c5bd34

SHA512
9a4157ce2dd80844ae6749a61dce3df17fc16f9ca0e0154a3368353c7b783a3ba7633cdcf5cae604df8c6ffe489e438075b9cb5bcde7fff6136c2718b1fb350e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c658d4aed947b45bbd102510a9bb894

SHA1
fd99a0813d11bc856ec6c6f3e614328003c36105

SHA256
5e7d2fddb29f3a930528bc1db87ddba58300e9b2288cf94ce8116216c9328040

SHA512
d90918b59b57ab75e6f0735391ae23cec60a732d666425a7a3615f2091e0d0d7df75c35ea7b8e32208623a91a83646af170f9e6fa3fa322aefc138daf93b096c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4a64b984d12c2d12ede85f67a9ad97a

SHA1
226f1e1b91727325de27742756c8474aa78493de

SHA256
b7799fef334ccc500542f3ab3b4aa5cc28b322eb6be5d5046605c302a889aef4

SHA512
9a60102faeab28bdb52d00c7cc6fae23b1ae06049a248ec8c37ab43812ebe143b81510cd2a67df560ae2802040d75ae86fd0dbcdfa5a085f8911de074dffcbd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1a5808c90319aec04b38685dd1cf6cc

SHA1
93c134c855d21276c88f6ec4bffec9e8ea22029a

SHA256
ce2048196fbcfa97a023415ec823156eb670dc3d10bccc8ad53af188bd2e4ebf

SHA512
28d9545f33e2e09b66538affcccfbc9cd1d1e0eee657e857736539ccfd5655c705f8337f3525d0cf12bd42b4d3812ca0dc6dc5b7b18fb8fd0498424783e71845

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB33C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB70A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit