27f34a4099d7f25886c7bd0a9d52fa118bd8feec284ba6dc871fd6484dbfa27c

Analysis

max time kernel
119s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c336c4728e7df64f9aae12d4d096526_JaffaCakes118.html
Size

154KB
MD5

6c336c4728e7df64f9aae12d4d096526
SHA1

5ab1363f43975864790b7e8ef57c40e0214b571b
SHA256

27f34a4099d7f25886c7bd0a9d52fa118bd8feec284ba6dc871fd6484dbfa27c
SHA512

fa196856f4db8078b253c835e366e6f8133e4ebec3c0e452c98deef6ff26e44f33abca0806a6ff57621459190e20e818c1ba1be8e0bf6539b8d93ff94128927d
SSDEEP

3072:atg3ghsBS8hI0lx1yapW4vseKUsQ362tJjjt7BjtJP:auKUsQ362tJjjj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FD09081-1945-11EF-8698-5E73522EB9B5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d5f5f4ba673e40875228183dfee89a00000000020000000000106600000001000020000000f238f7f9882ad6a0262b61f6db601cc09febe83e2ec545b4081cf9c457ef6582000000000e800000000200002000000001cfe2371082efa8e400c9a0b7b637afa54e49184fa91ed9d3974ba4388fc2532000000032973d1da7c62dbd433e15ba52b2b248f83a97b20157884d3173fe01804998b4400000009d293d8669f814dddc4390ab4eb85337c5a12ecfe4be58c54d799e901ea2ef27595e01129365dde637d1198432ec633a3cbf7e3e6afc70099068b99b247edc6c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4d5f5f4ba673e40875228183dfee89a00000000020000000000106600000001000020000000413c6ee463aae19fbd001de4112784525ef74dca7492366f4ef560ccbec7105a000000000e8000000002000020000000aef3158e9f10827a64ce78f53a88b14044960b42c436114785d67bce74dcca5290000000b6128c28db0c92027e4863c80d51b0758d46fed4151589d3115e5d0058594b75162600f260fda5d0231293a09f6bb0d29d6a56b236ae7963c0d58b868a72aeda6683b0ee40c7ad52d1eb4c7b8114cd0da64aba62b0b2a385154794db741788374fc98b5595b588249303bb847f28ca7410ed79a96586afbc6b7b32423c85b500f4d2bd5567fbab9f170b787f1ca234c840000000cced44894e41e2da01aceaccf05c30d7c55a72107716555d7c14270352e85894e397d58d51a12323e5ace2b1577672e205772fdf941cd0b64e3e0ae872aaccfe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422659018"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c071a14652adda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2812	iexplore.exe
2812	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2204	2812	iexplore.exe	28
PID 2812 wrote to memory of 2204	2812	iexplore.exe	28
PID 2812 wrote to memory of 2204	2812	iexplore.exe	28
PID 2812 wrote to memory of 2204	2812	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c336c4728e7df64f9aae12d4d096526_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9f43cfe3c09f2349db3e69ebd676ad0

SHA1
5de612c52e1611a81a31cec9fd91de8d58f7467d

SHA256
c74fa20ae08d45f0e907abb153be6c8c659d06d7043b095808e26feb42966c89

SHA512
52dd0a258d7d9e7642f9d2a6d3d3ea8651fb76d6c314161681901eac1fc11039b9e2c8e83bc61abafe84cf003c5a0cab3b069772eca265e13c795c55d47cd3b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72197b34d3bbb79b5bd883cc9e244af5

SHA1
151d57b13cd92e1468b8531c73107ce4f25b277f

SHA256
6f3f217c0e856269b0c894d7151fdc541a6467f61a13d633c5e8454870b3104c

SHA512
1c85f50cda2347ef2a7249940055235f53f18a610af3d7d1e9393cd7731a46d5b07e5d405a5fb1de643383d59f4f0dc1c786cb9c9fa318e6c16ae5a099af5d21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5c8fbecd3608576a3433c57f997b279

SHA1
c107840d9408d18db0da95eb76d6ef84795beaf6

SHA256
a38166504608b598f0d3f41dd9b239275d7d3e4fa52c7cfe902cbc6c92d0b8ff

SHA512
582fd8b221b98988a34eb04cda689218ba487c93694b51b05954d6e13efe535417b67d8192a4d05daad2c7dec9a935866792b00530fcb0868fd7709fc708fa25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a2d948b6d94851e1458b38beca6461e

SHA1
33e1eb542f7e6e5cc89717a8602d3f613ce12598

SHA256
a3650a6c511cad94d3f769e0fb0222797b6be5d9a5a3d6a43864290c909e88b7

SHA512
fe111e85add6fc58d12814831a336f6559d7127d86b856b1109f3bd4fd2d50b237c81a8def6ea4c3ae67a264d118e386912c75e95ee7276f2f33e09b3187afc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c1c69c8677eb6d9fe9fcfed3ce788a4

SHA1
be44a5aa731b24f3b6e223bd7e7d8cb8fa9c2a10

SHA256
00f7498ba1162e763c363e1a575954da27035a047c959304d6798741f45c3231

SHA512
81f7290a153167db6cb8f4f26ad878808bd0eab5a56b4254600fb7cd21281446b7eee73a5751117d02b08c671448b95724b359775606a4b7238d8b4b1987f18f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2db2c0997bc929b9d19e27dded146781

SHA1
3b736262efd5cb40e312975aa772b4fef91bc14c

SHA256
46d5c122d77abc5918186968d39d12d069a30da462877f26999a843ef83473b0

SHA512
c261054709d5db4b708a2fc8639bcdc108d6dcc45935fa6cf2506efa5a414ef1ab9de0476b2063e6480616832b12873b2ab0ca547214dc786b1e0ece3b524d0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8871e0970f99ea6f946285432c8a4ddc

SHA1
9fd89e76a97664b572c1dd2d720e88aca008aab6

SHA256
bd125fc17f0a15a1c15511a27b0266d12ef90420cf887c860ebfb0eec5998fa7

SHA512
ff181a5dc6c9a10839b1b5d8b57771bc032ffb65fc8d25e741fa4b9bcbd02c539e542c68537ed9c68a2440c6cf68efe621664b101461adf7e56c918cb7c9ca2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa189b14953c0e2f2343e5e641fe48a1

SHA1
f9df2672a39c78b68e1a70b3b0ebeffc84be9b2a

SHA256
6930dd1aaf6f040c1d58d40d403709232498b9aaaed1eaa83fb96defa9c60a66

SHA512
5ff1eec127d2d1f3fd31cd08ecea738ffb73e6317360991f55aa685c27ca0e8d60c8f0cb89b41d88ae6b5fa6fa22cffd32319b57ce4fb8fc15eed5b5e52b85c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa382136fc4f5b6a93e92744bb3a1d1a

SHA1
b5a196838f424181096de26e2e4a388eab2d12a8

SHA256
486aec95b7eeb6e616bb05ae5c6f808046ae3075f62a854232a431489b625f43

SHA512
a97a02dcb3a0370460144a63f6adc23c72be9da97c007c2071c1504cf66b912b36c64309456445e670fee854ee0c2c543739dbeea57f6eae805b5da2c572d827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a91b0c4c45e32bea0d06ccc1bc6fea2

SHA1
752474f4bafa082cdebf6a791695abd7245a6c0a

SHA256
98a62dc441f0b37a0893669a2160219a8f8d6f2ab9956ecb720559bffd771ede

SHA512
c6fa8071421f650d630fd9bfa7e11d46d2dc1e0ceb5f4462a0942d504f9073590a866112f072062e5858ee1c93ef873ae90dea7a9c32252d31d5a3c547bd261f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a409ef72d2de74835973edb92e9ec659

SHA1
825cbac8506658e40efd55faf87f0a95cd1e63c6

SHA256
0ee0e7f23f3993f44602fe0c730b502d8302f9660a6e193ede3b4735ba7dbd82

SHA512
30ede5fa569203476f374a16af1035fc3244d7c3b12874e457126e1c22c2f3e1d4755bea2fe2e3c8f53d510526e5d84fcccd44dc3ab748deb774dc80db98d0ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c13fa5dd4932e162c3d602a8656a0e1

SHA1
f2ade71acf856142e9786a078edf9fbf7223e9de

SHA256
9d02f8570e7811db3014eacfe9483362ce586e650a34b682cf35508073af2459

SHA512
6f7dc9ec70879a45001235c7e3b596f322df6ad8c185867be4c5c642e98fd4232192177b9b34d0340e951129dda823d013b640f0124d7d4cf073675e3280e657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d5a4b6c43d243e09c34a575ba9deade

SHA1
06b9590cbf7115317648229f108e10eaa6a96b1d

SHA256
434d5f71598212de95f0ab10064e4c377d5d55099343a74de48aeacba0de5824

SHA512
3346ac2f639450fc9506f2d174fc487b7660a3871f72e92d20ab7989ac3c5738c2ae4c98bb95381b936785eefad8b02c1b97da108346d42930f4a30fd12be575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\menu[1].htm

Filesize
93B

MD5
a9e0327482ee7bf293e61c3cf5b588f2

SHA1
ed3c53cd36954bf3528999fb93d2f098a6665581

SHA256
22618d8acfbf07b854a4ad0bee1be896052706f3fbaeb34c0d8268ecfd7fdbd4

SHA512
1b126163144366e1250f1be076208deb39185856c1d7e88c52fade4e78f94e232f4423671d39553d44ddf28fa040c9bd0c0cb5e86fa5a2fe26489f7a72e476d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBEEF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF82.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit