24aa8ea1c8555fc4d0e2e407b8c3dd43c7371d4d2af14330774e7bd2a6e1c53a

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bd6c959228669411deb32c3b172e7e2_JaffaCakes118.html
Size

19KB
MD5

6bd6c959228669411deb32c3b172e7e2
SHA1

20eb3de732b48508c122134ccaa4372b5b40087b
SHA256

24aa8ea1c8555fc4d0e2e407b8c3dd43c7371d4d2af14330774e7bd2a6e1c53a
SHA512

a0ee3b1d2c3176ccdb80b078369e33700e3db9cdf4922e2309c543d885fdc11416e7d603dedc19d8562dae7af10445a6f4b7b74371583817ab98a3cc7fc44218
SSDEEP

384:ziXnKhgESuVBD8cSQ3RoIFIDQMo1yXemLxXucfIk99hetgzVc9MD:ziXESugc13gQMo1PmQOIk9Stuqe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DAB60FC1-1930-11EF-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000357c1ab58cc6cf40b5f9c7e74af95cbd00000000020000000000106600000001000020000000cacc6302d4e84b13a87529e756151c8169ab317059f65a9400d994c2a73c8b79000000000e8000000002000020000000fbe6a2217c1ded8821d4ae69d4c3287e34c3aab1256d58cbc475438cad2dbde52000000021979b532154cebe5127075c0e07419ae14c50647e87adaf74b9d5aeba3678134000000072c8b69a6e1bcf1bc6862abde12e41e8594d70745412dcdd403f14a14b86843d9ae57449b0d5474c7a8099415dc662c8205ec325f5fbf84a6d7a9d05a690bbbd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422650188"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000357c1ab58cc6cf40b5f9c7e74af95cbd000000000200000000001066000000010000200000009cdf71541a7a064d791a251cd44cb67ac4352157b7a1232894031c7738356232000000000e80000000020000200000005efb3fa5d740437943791f0c02236a856803a759bb0f8b21b89937c6d5d5743890000000bb21099f12d094930492d7f36544aa00093d86297409c5f868ae7289963cd03e8a1f09b893a4d93ee57bc93f5b5709e5058c3adbea57cd5f9fb92f80701968e825f2cddd5af33ffddca10ca9d46a17fc928d9bd0a7ba401bcd2d9580b3a49d6f6a11e771261ce0b5989a79babff246ab0f363ab04ee0e2bfaa6add9cc45e77799c548693530800d7a993cd2b3434225c4000000003856f87a98d8ce991a7904eb84a77179445acfc43301241e599862ea67990f26aa96cb395355963cbf3997eeb212c06e470e831c78da993b92b306cea556aeb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c020eeaf3dadda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2440 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2440 iexplore.exe
2440 iexplore.exe
3004 IEXPLORE.EXE
3004 IEXPLORE.EXE
3004 IEXPLORE.EXE
3004 IEXPLORE.EXE

pid	process
2440	iexplore.exe

pid	process
2440	iexplore.exe
2440	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2440 wrote to memory of 3004	2440	iexplore.exe	IEXPLORE.EXE
PID 2440 wrote to memory of 3004	2440	iexplore.exe	IEXPLORE.EXE
PID 2440 wrote to memory of 3004	2440	iexplore.exe	IEXPLORE.EXE
PID 2440 wrote to memory of 3004	2440	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bd6c959228669411deb32c3b172e7e2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c78bba540cc3ddf0d0e6b28cafe88567

SHA1
494216656794d7f29fb6bbaa85c55dc158888517

SHA256
19ea1cfdb75becbe7290ced1426927e243047b512b751a5e2261a8df881b3f6b

SHA512
a8d0eb0eda13159c23d7c9ccef81ca243b36e6f4b465e3ea3a8b353cff36e5a08c583990920d67de9b3a107192c79060afae53647989399f1a73d5d577bc2a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a389f33fe6b276adf9df10917be3145e

SHA1
86859fc3632d8ce9c6343d35aebab215db9ca6e8

SHA256
3d328b0a24f850b47b6fec206fb613f71cbaaf5d9728665b0a719c727f5429a2

SHA512
3f2a290cb90a5524f7984446749164943d29fee7c4ab398370bdd5e23187b97c1aad5f2fa9bedeaa0d9e24ede009ac8ab762d0e1f4f89ca958bd6fd7c101d5c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3b72d89cfd60b68515ec0f216ecb82e6

SHA1
73187af30d7720187efffe852e687a0b5d691372

SHA256
c333ab5d65d59b0b6a0dfaff3febf510d5bceb409d7ce95a7afdfde3323d37b5

SHA512
ffa306eb766818017afcb3d9ae40903ff91ebd29bda86d10bfbf8341c621293611b9c10eeb94818600941f65619caf137ac1ef8c4cd56a51d778b3d8f6381b55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1c5c3ca6df7226e69920cacf91368e84

SHA1
a59eeda632628d849b5578cafb3f16e7896791a1

SHA256
6dc59474dc9ca048b1add2a2d11c08a70f6da4adbf787add421ba5d9efa2b229

SHA512
c0b3eaa0a6760fd605076d59a7dacbcf995ee71b00e0ad5a55c6a51fa1d9dfccc7a3aa38fbc9b743efce55d0e41a201c8b53bc540c9f839cd649c266b3365740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ba5534933cf1615dc36476865a111f38

SHA1
4da8cbea0ebbda357acffef8e67925825c180a5f

SHA256
78dab5a1ba585007e87777b6e1fb9e6d5014a494e3838f355e619d01db296196

SHA512
2454a6c6a67dfe15d70966e8c2ddbbedf8cb74ffcc95fa2299ed318d00ae130bab7d3bdac13c690c6763335e5b098d89a564f590f7de2277fe77ffe9b3a7adf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
13bb66291dd43d5a74471ce105e3ff44

SHA1
3e14577ec8754b4afff5a293b8dc24fa8916bbd0

SHA256
8d37245e3fb75bb2173b6a28edd6a7fdd053ec32dfe5d4888b4cd232d1b907bd

SHA512
cc8ea8ce40ef4de26a17296ef87dc610e78296103cf23450fbf10b874993fb43681eb43fc62c8183c483a1a6e1392ed9c509dfd97ccdafc9f374118c3445d5dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
64f60fc0cb0ce948ecf977225c7968c9

SHA1
46c075f08a88870a3bce586d010cb7221d4be5f7

SHA256
1c06b59a59d4c710d6a81ddb9992c36319abe48046a8aca97e733971da62a98b

SHA512
03e81f995aa2186d798577564d52b2e477d8172489295f4ba5e072a3eaabf8865fc819166e0a419c2fc81e2ffa74ed8a4959f77fc34493b8f2d706fb270f9a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5c7f304ea9e0faed6e20107dec68d328

SHA1
5322498f05ce3ca9baa444df77479fc6f2cdbe6e

SHA256
7289e614ee21e02f9ea486dbac9bb844565b0ce5f70b2f8a76de38ccbe77e8f3

SHA512
4a6e314fce99c519bb42c261a72b7bc9f006088bf0f2e1bffdeffd332cda2d8a549939e1485038a1b93d80c128bf8bae9d883a5215dfd2a4ad055c46293b8f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d1751471783ecbd0e2dd4c2fb6be1dbd

SHA1
ca884ccbf806d27e46d0807ef936ecced53c49ba

SHA256
834edf475ac07b9912cf78a8972cf012be90195fef8f0bcd79431b9c5191ba55

SHA512
8c83e9a659fa7075f21db5210f0f13afd06cbe7235814114682a72051db911d5d0a9594694895d3aa3b17c04cdb8f14655dff172c13ca8ed0781159dd8307b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b9fa612eb895c393abf7a27abe6135fe

SHA1
3a39112933a0cce1a01cdfb078d988324dc584c3

SHA256
1e34d68ac38165869d3d1dfbb91c16dd9344ac677d8a8f797cdc3702a9db942d

SHA512
4b121ed66f78892e04f2675ced88e77d9835a2b1d58492dcd5753dba3d292800b0bb969fe357b78dd32b0ae37c8292d7ed3ff47c3326dc48a7df53668ead8548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f09a517d45e7a445860499d6d97abccc

SHA1
b0ad7ccafeda4361c41291eb5e8b07c2bcad5ef9

SHA256
f7ad70f1c47553e70b9253cb56151dcfe267582e28fd2b6d053bf3f938f60efb

SHA512
70d4542abf218aa366d12823a163137a6cbaab764e97dcabcd8b8a1177481c712785578d6ef6f56ee78b018e2ba56ac5c7e170287e49d6f86f46030d8e8ba800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
68b47e74ee02f5e6f332039c302a5262

SHA1
87afdb6c8a1ac15dc3282873a6a3bd68e8c7ade5

SHA256
8a6ac57495ec2fb4c8a9062c01effc54f20c0fe7e9118018ed0f83e06a415487

SHA512
3efb03f32c8745ec2d69dd50c06514417488eb5f218cc5384e7202c23841ae9a52fa622a96ca1c82464d86a5eb53b1f3059c8a486330bf8cbe8b291eb093a285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
687aef3c3ed44f8fda01feb7a23c30c4

SHA1
7ac74b2361a8fa00cc06a0aafd33ae8d0711c585

SHA256
2638614a3e1bdd501c690c5f02702778db98d698eb941a0c1d2baa4595d091d5

SHA512
5192b73739ce18f6133d73b373a773c402fb206e2ddc5cc7912baa834b693d4e410fa56bb14606f22992530e56d9d1e37f38fb38e63784df523ab69090bbfc68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e50923ddb3a95c62bf72ec1870066d0b

SHA1
787806da99f6b8ab48813e8794c0460e2ad3aedb

SHA256
9f4fa00908f7b101f4c3eb6d76ddf96b3c63923f5100554c26d066e7198d6c5c

SHA512
b4fb909ad6ffa7752e7c34e77cce8ae6bd1623b3992364a92330d1e71892d20b157d0acd94169b1caf153ca95c2fd8c047925ba1b8c3e41a0b4f3d686d7c6500

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB474.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5F1.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit