e16c94b40330201f9f399011e6a9294077e263af59db854f44c7ca72dfcb5f05

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ff7631d353c0d94b6090488ee373adc_JaffaCakes118.html
Size

143KB
MD5

6ff7631d353c0d94b6090488ee373adc
SHA1

e9b1cab06e5dbaca1f8e6db2f111a8c3676867cb
SHA256

e16c94b40330201f9f399011e6a9294077e263af59db854f44c7ca72dfcb5f05
SHA512

c9183a557bc91038cdab08dc1e1ebacb49f3ace95dc6daec209ce8a84fdd31118b0245312f613f30d8301a6cf336b2d58303ee0c1a9373e64cef84deff2acca2
SSDEEP

3072:SP0Pu3mx7dyfkMY+BES09JXAnyrZalI+YQ:SP0Pu2x7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422750913"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{663214A1-1A1B-11EF-A2CF-6EE901CCE9B5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2320	2404	iexplore.exe	28
PID 2404 wrote to memory of 2320	2404	iexplore.exe	28
PID 2404 wrote to memory of 2320	2404	iexplore.exe	28
PID 2404 wrote to memory of 2320	2404	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ff7631d353c0d94b6090488ee373adc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83955c367dcfa0aad4815e85087339d4

SHA1
29273e4442dbd7ebd55c491dd06ed50218421e20

SHA256
ab39a6ea17ff82d1dff5f02769151969f3bc0f88f0ac5377ffc674e2871f381e

SHA512
f9a9c6010db8a608e94e390f99deb4fb78d7412c045f30b1cace0cb83e615c7c1b38a3bf0c14554b9f6081bb76309bc30d32e0144a2cc058f7744ab2c7230237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a851365500015ecca222daaf83605d0f

SHA1
89f1168c85df8bf063c9992e1e029bd033cf10d1

SHA256
2ae84c8fd4bb931b57d275a46bd2e4144302be98559822ab12bc9d0e7fd8b042

SHA512
00cca60a8fc490ef2caf0f258bb9f58ec0963e24a585a055eba85aeea4002c8edeb860cba887116a341ec1a36667b85fd747e6bddee6edad2d22b9d4c10759fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a3ea445ed1eb17058727eb11013dc87

SHA1
9b6e4fab24b88ce2e2af934f99876bb2f74cf3de

SHA256
f5552869ddd1c019c2049108834088c871de6d76df09411f5b427ad9450d6092

SHA512
584af5b61c6f5593d9dc9e3ea1eae860603d5e88e16c64b23cc9cebda0196750fe6ba921b0c3326016be2e234837db940987002836fa12f455c8e2e07797f8c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b711016af728fa3736b9be304c2d8f0c

SHA1
e44a6bf0cb5c4c3843fad7ef278e45b47f806e9e

SHA256
02da976e2c2dbaf92a8ebe92fd8623a669508449bbf451500d8fc6331f9740fa

SHA512
11795dee3cd1c17c26f8ec540607cf69ef9cf56b823fca400d0e7da6b798bafc6f335bc23615b1fc4e31c15bad40a2e70b5c0db67e2bca8a0f1c86d26c66d0e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c2f9fa3623a08dc4f01d7afc7033edd

SHA1
2128ae5ca76d103c69a5f3e80360e8b05d1b0425

SHA256
284c9fdcb5409a8ca16ea5c0e0f84ca7897128b29c82d271e41be20e4380755f

SHA512
c6591de714e22a4dd3cd00656da6e4c8b3b86fb163895b4d9be3ac04f11d98dfb59c25b2450a6d08b6d94e793e42ccb0b93cb63c19e0eeae7110789779ad4a52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f1392da1b87da14959163ed66fa9d7a

SHA1
534c8cbb42fc9f9db2f1dd6143cfb04e80b9cb24

SHA256
8bb7a1f061a73f3c14186a3f9b338a971be551e3fb562e3dab25a87c051d3f90

SHA512
3a11569be322eeeb3c841d796000259e50f9477629ae2513a4020174c0e39588d3954338cea8e12f399a66c30bc72972a3cdcb7074484b3597e2dcf458f8a8e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
473559c37c3cf7b5b96236e3283fb479

SHA1
74602e4a5c62fa73705eb78f4003741653d0a04f

SHA256
7245de5c1a3c6cadd5608731aa248bec6615ec15501b5c6c5d117ace8c5a0e23

SHA512
60fde5551a188a241632e7edc29d5b5aff930a834a682d2a888da41bd16289b7229741aafcc12fba57ccae06ebb5c460b658f1423e2c46c9eb9e571f89bc3d6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f155a1b3f06ae5d0fd4ed9c7ab9ebe64

SHA1
54adafee05e9961d40b8579d3c0eddd0bafa2be3

SHA256
4db3290ae42957547fbf0cde0b73e8e8a5a572a38ed2481cd73ab25e5d0a71b3

SHA512
d9bebaa41b419929a41610f90164b8b28dcdfbde2e310774f153dc840372083145e85932665621f519beb201f8cdfca84a9ac5865d2682e81207a3dc2e93a562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76f2116a0cff9a2ba7168a268464183e

SHA1
680b6d90729d74af21b834366a8c748dc0db36d3

SHA256
236fcec5f402ccdb9f039364c66228c6e2292503fa6b20a53634bda3ad19d5ab

SHA512
a74052f7cc2e8312236dafb3a36ef2aa1358246e52b6904dd1d0cafd3d9cfae94d1ccab63b3f39a0293661bd9dc31b55f90ca37a570b5f30b6fc5dbfca1edb17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab2d5ab2eb831ab348501fdd6ca69876

SHA1
561dc71bd9270399cdb78847045725a539eef353

SHA256
4b90f1f1eec854fc36e344f1837bdcedbf95c2b1222723953a86f8e5dca1348b

SHA512
32c4619ce89dae0ffb94fa5bcd680cee15d24ff01706c35c12f359766bb665206bebe4109f7094b9f99008160f9ed09312e8d9ff018c2fe509238b2a2ccb95d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ad1d4d31618b9b9b7e4372ff00dc223

SHA1
cc113f9d9cffe6593ed2abdff2df3a8c5cd1b50d

SHA256
00449dba6fb9af7de5c303b7bb7a6af531fa7cfc9a2bbc804b77600529cfc473

SHA512
3a882a3e8ab1bdd0c5bb3a0e65c99cbbab39a914ef37d67542fe7baf8a0ae406cc57f4fb259c056d104c08116d3fd35aaa966bb3abcabe752437f3349559d45d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea299119ef2ca0d0262e7374c652a4c5

SHA1
527ce5ab23e9c72f1bf56d4b0cb69da3f9d87298

SHA256
3bd6c514cae7f92fff5402e1d3b03fba845f2a978b24347030bdc485a77614ed

SHA512
7aee868390a925e7bf4669d730a8d901236f495e57b0ffaa473c3e5259f0ed6913347f409fb47d56e03465a8653c42950cd4e720ea1b632a5e370b2eeadc7997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da04db360db68295e6bd647b73468efc

SHA1
20da2913d752b217a6d301bbaa404e87cd52b6be

SHA256
22ea4723717143970dc4f663221b76f6f01e057f6f24d1141243ae11dc3b9d39

SHA512
f48929b88195a597ce081ddfd2ba56328b68e4a90e2cfe2cdd37b9bcb56b613063ec41505acbde50f0c3a24b16659be790596c3a57a4f0f7379f33a5bc107980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
820bc471426fb00cabddae997578fc23

SHA1
e27c0db17916517b73ecf1b468ad3ca08bb42457

SHA256
23f56ef48420a55735d86cf2be54bf0c132cc03b3d7af253d7ce6e5d6b35b20a

SHA512
d19c98d560f43d73be5cb636c8b595939ca0b3f7c8f3c8e574701967bbc69cced72c86dd24462f224854093dd142442b67abebe1371313359c2088a65deef290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
137a6e23496f6132bbe92f53a548b222

SHA1
6fb8a2abcf0c7d556f16c52b50a376be704b2ef5

SHA256
0bfaa5e850bd8e7c3029e7538197e897b1724f157838850292d00f307f955765

SHA512
e9dfd5d9a25fb31a679ed4146a78b6afa13d61c363a928fed6f22a8ac860df31b2d579eea3c5355632c9aa6de0f24cb5d3ad65431700a736ed7cede49f35d5c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d72a56f1d7de64ada8a5e0fac2b075f

SHA1
8be1480fcf3c3c27208226d0560bdd66f04fa726

SHA256
7df1f78802def5f7d72686b39736d2ec0ef2fc97895977aca237fc0dd545b37b

SHA512
91f8f9d667f046a44beb3e61d9d5e65c20fbcdd41031ae993045f9c344394729d67aa59b05e4de6c4956e9fa817d04dea29c182113b7fe8f73667b77b0402bd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a84de8f0200acb652dbfb05e0671519

SHA1
23e7e7895c972361027f0bdc9083f881e37860ce

SHA256
1b1cbd6ec24806a163162c7f3e4a9a57fb7753c31a476dd944786b2eace11db0

SHA512
88686ee515caca896bae255965446330b9bc58d48eea731adea73c07207aa2f7fe3c37b59b127ff0ef93d11945f1d2b88c2c71d3ebee1bc785ed913231aabdc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb05d4a77a6b785e3ebc06e60cae77b6

SHA1
6de30a52f36a1f01916e33a9c4303540a0cbc93b

SHA256
47b660b69f679f6c4920abae43d4f1ec1271bc6c97af2e651e25c63defc15885

SHA512
9921cbefa3f8b8ff0da92fcb84441716a93da84de3f2dcbe3a9ceba3a9dfb592a0f3061f68779329b76a9d062b5e266f6b06837fe81e9ca6d5efba725ca9f5c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE45.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF27.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit