c834abf83415007bf3a2000fd5a9d5da351657e01ff3b736658f681fc210bd5b

Analysis

max time kernel
136s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bf7eaab92ba829d6fc72f0ae6d3fe53_JaffaCakes118.html
Size

82KB
MD5

6bf7eaab92ba829d6fc72f0ae6d3fe53
SHA1

7e16394e1037f0e04a8b70283b59fa01bea18a6d
SHA256

c834abf83415007bf3a2000fd5a9d5da351657e01ff3b736658f681fc210bd5b
SHA512

fef855af32004d078d2e015e97d2990ba77920a1a670172e37ba6eae3c90232064eb995de5bdf3aca81c3ea1d056df43515e53f33fea4b90645c4b8081e9c68f
SSDEEP

768:Ms4AiguUW1PrsClaMyCT2mUsh/w2J63oQjvizYhvgcccwJFBuf+m:Ms40uUW1PrnIMimUsh/tAxaQf+m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000eb3cc98a9fa4bee2d9e472cfbd07a9919117604974724c001db6554bb340952a000000000e8000000002000020000000719db91ded2231a24a59a41f0521289aa6a8388c0b2880f2ce9fe1e9eba940b3200000001e054ff3cb89251be745ad7df510350038640dd12db1d4903ec0221131eaba79400000001347a2d24c3a20e13dfbf872137e3e9172ca2b31618ae7c50b5fd454224a3a650edde5e8160b2145d74d32372753a831a545fb84e3c4801370fa645320016a7d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{594887E1-1937-11EF-AB84-52AF0AAB4D51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006aeed01fe78c9e9e39ddfafb98c4411caf9acf512110037c7c301fb132f0494f000000000e800000000200002000000071363ae1d567805873f61744086604782a942d61df94b0ea9c64d9355fe3f522900000000dd079ea1bb7d6de5d34b5c5463ba8f4edde3799ff9c75b5485c03c356eed517a2721dbbb54077ce0fa433f860473cde5e62d8e22c8ff6cf9c8ae55fd45f3f08ca8a9f433fd6e5512a108e84c75ed08e8e8a68ec04112069ea1063f7f981c124c0e43f9f008d1d7411a1d8a732f598f6ac59285ef863237377201a9e265e586bd8081a58bf8d338d8495d959c9e4346040000000f3386f41b71f3341ee44b018b68501aa1c42f329d397cb369d166e3cf514149c46ccb956e463e9d501ace9f895e2b0eb01988dc8eff7af75fe29e0d08717dde0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422652969"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7020a86c44adda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2600	2020	iexplore.exe	28
PID 2020 wrote to memory of 2600	2020	iexplore.exe	28
PID 2020 wrote to memory of 2600	2020	iexplore.exe	28
PID 2020 wrote to memory of 2600	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bf7eaab92ba829d6fc72f0ae6d3fe53_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
887882ddb5537c0debdd3226bb5bbd6c

SHA1
1ad797234304f466b7af7fb1056b36dc2ae32bc3

SHA256
86908ffd3cca317380f5aaa37e145d09d8100d84bc9278b245e04d00af6b536a

SHA512
7c2dcd60cf4d5435385f7ba0b669367534c7df932a916207f9f1fee41ddcbd7e8bee4b8e42e3d6eb6b87590b9a7c1384ef7a301e997c75023c42d7c202feed2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e97dee023da8a2cfe5b804ae9cb96d71

SHA1
a363576caa1b07a3d75c67edac9f4918c212aa73

SHA256
320439686ab3069c0300ba6e830c76a4d86ab9109d1fd2187c3bb499d89429bc

SHA512
3a09646df77a993a5a097435bfdb97349d95dac9401d9128759dae2ca1a02f7b7c75ee0680fbee922e0447f15399db8d3a50cf09f673e9a8a9260e8e3e58c6d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bedf17d0ece65d83865ffd4927c5c754

SHA1
788a488b98ca351d26db9b955e7856792cc9187c

SHA256
91913b239b274edd4ad618ddb79021156a5df5a73794c737ba9b88bf0bd4be7e

SHA512
1f87565db6ed008e849c279726ac268a00a5c690f0f8c5f06e568cdb32dac03fe426d8baeb33f9b552aa338714137965b96faeb45f773a5ac37fdd85824f557b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fa87f756001cf6309e0773a3093f96d

SHA1
dc78bfd2e8c5fb98f6007551f13bc9024a86cbec

SHA256
1c9f716713e1f6da367f84465388ee339e55a4a77f5a613d4b5c1608cb4827e1

SHA512
4bcdca41e4383d0c029dbcf61e632389c9b0b91046f2e1ae3071f370da70fbb659e4df33918d0b7145703b8f01491f47fef4af4e6c4edd3b312fb969e51d8f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed054220cd9b4c4a5af9e37675ba6fef

SHA1
7874ba2764ed91faad8b53788b02f34c3018698c

SHA256
b0ea7e08116cffb15554a362e1dd77a243a8ffe49d6ca4124465e7ec4a18888b

SHA512
df2587bf8fd67fe711ee3017b4275859bce42335a1e8c09368b5cefd1bb27fb60f408bbaf5cd04e2e050f199a114a4d42d76a3103a70d6b486c8eb27839d09db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be7b6d43e236dceb31a8e3189f46b5d8

SHA1
0403c2266556bad133a257cbc887e91570f0c700

SHA256
e230c7e8f5ced0def11c0ce7e09939d34dc39a910272680bf37520d9a3d17002

SHA512
5d3397f13850091e9d40b9e1b213985ac3b8b5c4912c0d39eacd88422c15567d57171c7271d7513f709834dc5cf27c6dc48ed4726ff8a3006e7f8dd0b8504952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea202a7101e53f6d366d5a7fffe05f7d

SHA1
c2fe0d94dd05b0aee3b24c2c672a2c23c406853c

SHA256
6fdde8a5f083cada11bd2132781bd125890cbedc7ba0c0399e29facec3562049

SHA512
81fee3ba011cc4d6266e8dff19842df232dfa570d77c4aced63c3f2c84865e7375813cba17580eaaed34131366bdb5eda87101b24f9f42f4280a3086b6af8cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fddd4af9b2bd7b68eb9a349249dd22d

SHA1
2286ddf394758d81f23a6e33614cd2bb83d5d9cc

SHA256
5f362be81043a07b3cd688d31273b0ed27a91e15ce51b9012af8d23ba5bd5772

SHA512
73adf4471447bbafbb3b247e7d8370a2e7867f3f57cf4eafcb82760589c8da68d8a1e6c7a71684ae07cce8ff18ac1684ec206c750d159659510514b46ca87fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cef2807ce2fd6ff0304f5101149e00f

SHA1
d8f9e493d8df4abfcabab3f9a0e47d8a0704441e

SHA256
702f1e194b839461c43ffd89236af4e07c3cbe198fcb5f87448d008673b38e82

SHA512
4488ed07d9c008692cb712d04752235a1e9e530f19187bf26096a21dcca3b424be949261896e3958b996a9c44b6ac2eb2482d427ed1e6e3a16f918505db84bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ee8385000b35f5659e99c8eaecc70e7

SHA1
28f90930036ece3c63d96a0bac318ff2537e9bcb

SHA256
073b75cb0e72aea933db45a7f8316ac4a4d51429d95e8c7f816da67a7e2dc75e

SHA512
6908de78a942b072abc8fd8993611d739bb689dbba3fa9a50809e8f9f608ad5e3ff6642cdfd1cbaae107cf338e6cb183c54e1256ea49efd23be974b69bec5f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2648.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26A8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit