1d7ae73e49e252e1d8cbaac4c43823db4a5cdec6586631ef64755c2bd1e6545a

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bcd66333e5843a79877c75c115cca53_JaffaCakes118.html
Size

31KB
MD5

6bcd66333e5843a79877c75c115cca53
SHA1

5ed4f120f50946b0b375bab80bd69dad75b0e833
SHA256

1d7ae73e49e252e1d8cbaac4c43823db4a5cdec6586631ef64755c2bd1e6545a
SHA512

db0dc55a383014b92ba487a6a1c55999e105203c8918828281f52d8a46a689984d8a11d4058110424defe60af06a6f2ee9976018531425f2def76378fbe819b8
SSDEEP

192:uw7/kb5n4nQjxn5Q/lnQieANnDnQOkEntj/nQTbn5nQmSzxlRrV8lYaIEPRBj5nh:eQ/qQxSlY4wnQ48

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F952F441-192E-11EF-9B89-EA263619F6CB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422649369"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2924 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2924 iexplore.exe
2924 iexplore.exe
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE

pid	process
2924	iexplore.exe

pid	process
2924	iexplore.exe
2924	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2924 wrote to memory of 2552	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2552	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2552	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2552	2924	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bcd66333e5843a79877c75c115cca53_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
26c7d17323d815d7bc1e7bc229ccd236

SHA1
581a2ca2c7150ce87436fd78c00d7bf388f4da5d

SHA256
5aee26b299ac972b9eb4d12eaba16fa5858ac9430e43f088361a9173484543fb

SHA512
73d4964b68f62b7a62ccd9567adf5d09bd871e2746b6f036c832d7469e684edd1dea2f1be948ed8a4088f683a1f4136326296d7ca4f845a94a4e1167a6cfbd22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e1399bf90eedd7c329294ff34f69007d

SHA1
b8cda7577d328c71d5f264325f366c289fb4c265

SHA256
3e35203b893e4d147c1f559fb27db4839724b2f8a8784f55252bb60418139a83

SHA512
2a938192f3b88d68d2e1931ee68a7e7f4a5c1c1142b5b77cc71309a5c068460b75bb9e9cb12b383a9f621f09124c33a00c77ca135b64c2522f45c0cf175ec8da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a589a5027f2db7a83d65e14b1fd37d40

SHA1
60956f6acffbd5df8eb69b94b2e48d71aa3247df

SHA256
4a8c22a6dcfc4dd885ede7de25c404bdb1f2e6e493e9533aef1f482605be7ba8

SHA512
f7a4a51a0419b413bba47d83d64c09dfb4462d3fe8e45775bcf97fc1a3645d6ba42bf9297baf40fdf2dfc761bfbcf467bc7e44c0e342f29844199f650c5d77fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
131e0332e7b9881b329e7a2da44c6eef

SHA1
c8d6eb4c8c26201a4bb03a2ddb01f4c1d3f52edc

SHA256
1b0f0a18aa421f1c6b5cbb786bd0aa42adbe1abb25b7c6f5b0a176273b9ea5a5

SHA512
ba83eaafe1a969dfe3139ef028c6c63a190fd19c9d6d86401cf123535504c5b137d5e67d3abbf81b8a1dff4ec8da50cec4e25e0053f5c376db850801912dd786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4fea0a5596fd2f2cc59d0e3779744862

SHA1
9a07281899138e277f04aefd19cc75f44fc8c16c

SHA256
f4fce99b8753293bd4ffe2953a053940a0408ad2b2fda686735453d4cb088075

SHA512
614263509ed4c1851428909cee336e3682b6109e9110fd11be5e1ee7941edd149545fa894d122c2c457b29e2f170bcdacefd35e0ad433b221b6b15875bf8f604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5a78ef779fea6e1d54bc49905dfc0f32

SHA1
045cea058fc6a6f66d3d02ac02a38b8b48d84b09

SHA256
927acb4de4c8ac79d9889e8608aabd0406908a01c682889a5f16110cfb40a86c

SHA512
9c847ed3b8772593920de2679b5a0ca3be1e049db59ef722693b6fe3c5c395ff5efed35c4f63030a10cf14f856cdd0ee842631c04c1f51f2e860bd285545cc6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1acc17fadf6d600fb6444fb539934d4d

SHA1
aa09c9d7a8d9348274c94b3f0dc60f7e1875a08b

SHA256
1a1b3a2e5af64d8acc047a34c337c870c6628e54ffc6d2242ccf973c12572ae6

SHA512
7435b84a042f2b973afdb6a95e770e5d56f0e9258ac0bb9fb21e98850c3ec4d82793d0b748542d78e04e0e25727c70f7b36ffe99076faed6ef5037a6c58bb7dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
60215747428361cf76471087cc2e7868

SHA1
365664e3c15c9498a3ca12c7e41248d900549a67

SHA256
9c79e49f9b65660335ee969f8931796146d94bba03361ebc122fec22d60afea0

SHA512
358ecd79f6e5878154eec283ef6bd9f1c2371fa99c34669901427a1b6bdb50887f46b3b193714f4abf9cdb5a17ef289cd034e5d21c67b8b5a447c148cb286723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
aa1585130affd30e31d8830c122b654c

SHA1
d6a4f6b6c9f5eb6fc3cb742b0ea966c90c4fce46

SHA256
4fb0c2973f4d87b69a99e4618fa5d8b968a60cfe16c8819b3cf6a762069b7ad2

SHA512
d042ac2cb5522aa4872023f90a5d4c4e2b0667fe52c21e2ae7ca80485b910651994b72d288adfa7c48257e27cb9c448ee789cbd753b13bae657fea143ee85436

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1719.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1807.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar181C.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit