1f266be3fca8b059d3b0d317650278c37e808148e256db59c26d14f9f8ea396d

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6bd0950ddf41416e62b9e42997606058_JaffaCakes118.html
Size

220KB
MD5

6bd0950ddf41416e62b9e42997606058
SHA1

bbbcdb1efd1ed720b95449dbd87fc4c6a2e0219f
SHA256

1f266be3fca8b059d3b0d317650278c37e808148e256db59c26d14f9f8ea396d
SHA512

b32c64ec8f905feef34f2064d8558add42814ab7bdb385f96ffd50fe05543ea3b3be3ba155b99cedc76fb96a0ea735702bac8f925fc7557c2cfc09cb34989b59
SSDEEP

3072:SJE3uucoKvxDqcyfkMY+BES09JXAnyrZalI+YQ:SeKP0sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F654FB1-192F-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422649594"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bd0950ddf41416e62b9e42997606058_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c227b4395ef3fe9abe0b2030af1154b0

SHA1
5796d20dffe3114aed0fcd0665cc34c87a576875

SHA256
a412e041b3abe4978e0e090532dd7b2e7c55e37ef27212f88b7fb3d5755a5b75

SHA512
9156827a8fba9c5c19dffbd90e07c3055407328c2e96b304d2bf2d2d30f8634702f8501aa99ec80b01490307ce60cfd229578592dfc2f8be5011d31a9fbac9cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5b2872a369f9d4dadd524bad150c7d4

SHA1
d6c33b5ba6f06a0d2e30de9d96ac6a11cadf590d

SHA256
00a56a98d2401cdda7394b9f4c3e507f91328fb42c6c0c5b8cf3abedb2f6100a

SHA512
083bf9094b14b68826dc40eaf5e5d102f33df40640c40e02c657d618073232f942df60ebe01cbf4215e0fa9405c58df69f31c173b87ef2c58ff9acbe35757b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa63c01ce78e4aedca69270e04fdcb77

SHA1
9dd4fa043ccddbb95872b52b09754096e558ffeb

SHA256
6e09128cc5b4e8a10b2b311e5d33c3eeb63e7d92eda2cfebf7ee1fb663f23995

SHA512
9541b2b9fe390fa2379eb8a61b8b202ab1954d5df67a50f42d5e1ad727a13164c99bc154172d7fffe1d41f4d5658d64d69417e2020f2378d3666fa69db7a8e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc8e6e7c7e84b525b4db6e6bb21481f

SHA1
6de64d0749974bc29d9c39112719499836b1bc8b

SHA256
03e8665a420c5af193f58adfd63de835ca26703936c27290ff5c196cd0117281

SHA512
7621a60dbf97e4b83f164bbac19631104c10b5faccf48b0db6b9896ee46b88331815bd7a25729cdd94ca06fbb172669cef999c5a5c66a2df4cc6ac7baaa05d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa5ab02c16e04381ab7b4b4c6dc46403

SHA1
ab48c0dfcdd1a4582658ab29dbacf6c1328c3d6b

SHA256
87513293792e3708c7a435d38423e8b0f61206b87eaed5ed4d8260966992839d

SHA512
68893db0348075547a0d57bf27d1875d62e4711abc843313da74f9618113bf0c33955a57c821b3cec11e88ad4786cb77fcff1cbf99cf278fb25d5a4e0f263f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a10c521308ce89f12d7db7115c6b8a1b

SHA1
9fb200c1df372e3ae8190ed1e96dc9e448bb2f97

SHA256
2f9ddd4dcf922bce28fe75b0ad95cbeb52f8cb375d124541e5c6ba5935a88542

SHA512
3163c0f1b5ee0715539f3ae1f19c307acc2bf835d2b2ca93a6dc50982a8343cb32ae8a37d88b82b0e7f2107cf32aba147584a0c78e9ded2b590b6ba165009b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e3fd639245a26946a2cb8fc08284e9d

SHA1
3b8c9c90dc6edb703d54ffde51b6c985444b8e9d

SHA256
489cccde307111bd6b11f5acb1c132487ce65dbaa8b83010fb6bb54f978a08f5

SHA512
4fe9cdb12160d7c244c731dbd04fd8f2690327d6f4f96aa4996d2f5ffe2dd4e5ef5cf89f51724f59fb7790e7e1454d880069a05add9a5bc24a5308e5b267f807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb41a8c0855a49765d3fb6b2acbb89c6

SHA1
3b6a0567caef63e2eb78404b922a696bbba35cf8

SHA256
03bbfbb82fa50c35e110da3df38d4e18ab22df6546bb949c05548fc3f1732ce7

SHA512
58fc350b48eabefa88a22e838dd67f32eb21e18f140a618b98f2a372c895b5fcf3dc524c5491c31f3142943b48779fb9428eebe21142f155ec2a48b70af6eaae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
598edb93fc842a7cf11db333db1b9b06

SHA1
4b65677bbc622b586ba7f476a770cb6a66fdd755

SHA256
1ebb28bf798495c47fb3ff7f3c1733bff493e93388791d6405033f5a6a8d1851

SHA512
899fadbc458afa7810331149508c2540a69ec5ceae26bdab3b57b317f80602312be1da2f80b9bf071fe72983d588fa452b87b52ec94a96e48f54b02846db30ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75f1eae4f3fd0721242a336883cf8e10

SHA1
1df9551d3cdddd7f3063282f26e3cd831476792e

SHA256
a9d986d8e316c068fc44ce2ff891e43235090bec318c2c6a602545e20590f95a

SHA512
514f97a47594dbbd7796cb5d73c56085d9ba9850b988e617a8ce41e67bd3ab3d3280a82327a0b554e3e2c9b28f0cc1fa819b60b178e5adbc632c6ca7d716bd56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
172cf14c40baecb572b2b83f61892c1f

SHA1
121cc32d567385809d76ff69b7e34c6c66945884

SHA256
0833fa8ed216774636b8ca2bb4dd271ff419fdce0da555c9f185871c61be718b

SHA512
cb7b340919fb5dd0dc2019e053f86d10a2ab2ace69cce5afb25b66657e7b50a695a80844b6d310210620f4da7b1056ed3ec2bcbb6fb3698f186fee3755074595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d237f1207f22f8336dba27c7ad396b3

SHA1
7eadaf413d2a1d14dd11d58f0617294f84d79493

SHA256
ce12c0ebd620b6dcfb6d6c2a7a4e8ef1167828377173ec6c3cd4490058e23c12

SHA512
35e5dbbc783dc5c471986c99fc3db5ce9a19b9b0c058d6ec2446c65729dcd0717533f3a4ba045720724c905eb3220406cb6ef54f8cdab5c8d14b64df200e3517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b23e6025aff074e9f305a2df04c851db

SHA1
bbbff4abd455c6a8ddabf515fc582544b927737c

SHA256
9e6dc6aae09c7565745af725bf102e32050ad735e7d51702c86327c2cc05daba

SHA512
feeb4994054ee5fee2bdbd6455c68d67914f3b92378afd6f79e86d754faeeb89f5e60d61e8e6822a33c6ed96f342fbf8772ee8abff3b3b783c352e12a43be623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08a80aa632739a83d474b6a76a274ff0

SHA1
4c010baf83b59f2fa89cf20a2b07a3f7dc2578e2

SHA256
4c131c5133d2d8e3494ca26f414415c8a8ef9b439881dfa26726e8a6eebd6969

SHA512
afd01826d1cb7d7a29982d99148cf67b98f01b66d0efc3b343b72b63335c4abe77c6c8e8514c2d1df5c4bc82bf271dde6254444a12798ca9dc086fb73602e22c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df22d7c7a442c4266487e27b75b44926

SHA1
3d265b72ec935535a2b1fbfedfacb4ee9a2d4908

SHA256
96d7e7fe6b22c0cb63a462b4082681ea72f630230b93b6f62952e3b3bfdbd6c7

SHA512
7595ced164aa9de26160a9c1327945c161e0cefd8f32ab21b005b671e18c5717cc8d14a738e0dc503dd5fabb54cf0af9fa99757a231c932287a7397bbeb439e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa9cef99c852654e5a8cdae485053241

SHA1
f850aea98804ffa013fea6bdde784c56626974d2

SHA256
274987054ee7ebcbaa671ac2a618c6c150deebf1203da0c9b8663577ffd9255d

SHA512
9359d6f471aabf25e8201e2d648ec9cb385f71188e76ff30e6b24205b2f5b734ce2ed3433c90c2e68c14ff303dceecdb16003f95a68af44220b9b308a797b1cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86b6fb3940c8a20c7b60760165381ee5

SHA1
b91bed21591cee20214bf5205d3d90077b152cdd

SHA256
ab9f240c73853e2432e1ab9c7f5a57862b0c9afb4959583d8ec6ae8056b197ad

SHA512
e249a2ece024ae5456f928b98bf0cb494b8695a0e5bb6e5e4fc80d722ca0fe9fc42ca8b06c24ad7b311680fa14a55250e59832b860d6dc5a9780d04e66efe016

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar66C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit