0cffd2eb69129ac447a31f334b63600872b918f65691a942c6a3a7ed12612061

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe596c084f9d8bc2aae15f3c376b8ee_JaffaCakes118.html
Size

51KB
MD5

6fe596c084f9d8bc2aae15f3c376b8ee
SHA1

2c184cdec25266a6837d6bc68663f941e7e3ddea
SHA256

0cffd2eb69129ac447a31f334b63600872b918f65691a942c6a3a7ed12612061
SHA512

5dc36a032d7108f2dbd239144b18fb18c12ffeacf0f61cd2f07fed178f62414d1d43ac330f6a9c85479a6d0304c9664a1410ca5fb6c740475257ae3cbcaaac0a
SSDEEP

1536:FnG0bUe+6+ORRKWjIHhJlFSUFfhH1fO3BdNRR6lBhtlRKRFJV5VGR+N+:5G0bUe+6+ORRKWKlFSUFfhH1fO3BdNRM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422749235"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ec0c71ea534c44ea519079c6fa77e130000000002000000000010660000000100002000000001ec59ed7cd0e00e94153beb36563d5508bfbc2d79f9ecb5db2240c6af24fd20000000000e8000000002000020000000f68a1523667e9efbd5d4daecc156a4e17c08c56c7dd29a3df36e38ea985d832c900000008cf238ad368066fc8e730113318a5f06f59c0e091e9809f2addcb4c20f51449ec396416003ff8f23e36fb4787fc2525cd0247e26248b9b6e6bb4b3183cc331c2831bc620ec06909b7661f1106d38395663701bd5a3a3560f3d15af1075e20eaa3c3a72f82bf32dc56d1b69f413ce551539985fb667c15ae880a9e02ec8d42bea27942a21b4ae4da17bc10fd38ae7d5b340000000ebd642133ccb977a22202264da6bbf44ceefda367e75e127b753f8825ba285f0170a4645f24ef4f0d295de02d8ee26f8a32f097d0e985c69851d4cc45a5007f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E0C1DE1-1A17-11EF-B20D-42D1C15895C4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001f245424aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ec0c71ea534c44ea519079c6fa77e1300000000020000000000106600000001000020000000acc662fdb4f693ad55f6d0c979735e5c5a72fbfb19179c9289a54a5b0143ead8000000000e80000000020000200000001ad73120f4d968b06ffde53f3b9baf1c17297d2e9d575fdba9a32165d67c941920000000774f9c1fe1c170a9f09713feba92d9dd1aa048dc71900786ed537183e01f6c574000000064198412bc0bdba4a6c5156817846d27c9a44ed227fa151df9f5bf53b3f5ec9cc77fb08145ddc4a8949404c3a677fa3ebbcdafbab65fb12369bad8bf08314f0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2660	iexplore.exe
2660	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2508	2660	iexplore.exe	28
PID 2660 wrote to memory of 2508	2660	iexplore.exe	28
PID 2660 wrote to memory of 2508	2660	iexplore.exe	28
PID 2660 wrote to memory of 2508	2660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6fe596c084f9d8bc2aae15f3c376b8ee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
461a586cd898fe09c0f13a059256798d

SHA1
d9922179fdf046bfceb8d859c7cd2abe56cab996

SHA256
50fb10684e1171ccd0da9c9d5967fa6ef982bf99a59e20f3524a5b368af29d10

SHA512
2d449dfa1239e6d2bb8ece1bc511a53efe2599045e87d92b2430aab94071aa8d4c3236a9f7b621d0207febf5cd9bddf8858b5fd0c04306df7e2e16ce0e50829b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b431fc670878764d37231fdc83658fcd

SHA1
05ca00b5e68be0ba53be15f64ed8c69fa22fda58

SHA256
92d4f76c6d7de329df82bf231b6c80cd63a42472309f1bd69af80b5a79a1ef3f

SHA512
2c18642ac20d97ef1b1b9593e43c587c7b68035f72b173c9030c83f28b6e6c5c78e479997d95e4671a47fcb1400c07e2c8b02758df7b5f84fa62bff36b026b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f36b49081147bf155fa12a76c8eccf37

SHA1
dc7b25a2af2c1839ff27a406133b5027ce4a5363

SHA256
83ce6e7b453e4eeb509212dc393646c1f827b41bdbea4e51dae960ca73f80958

SHA512
6b9cca820e1443695cbd5eda1bdcfc6be3b8c31a2e7e864cc338985ec2849d079c7a1e289620ccb5bfecdad958c5d3c460c603fd5480f4e219d8e14ef850052c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
392a402bdf4bfeecf246fd26d74232e2

SHA1
1a6e8baeefc5d71a0bc3e8559704e31ff4e58325

SHA256
fab37b51afc9ff3b8d5154a1f95bf3319dcb2cd0e457e3e5962037991f4d3f50

SHA512
89b7ebcdb76ee3d94eb9e9aaa5b3f7187d55bae2f42021ee25f11a67fe228169278b56b1151ea159e75b5feb40d3f7c8d673de2401cee7976ba3a4566410b991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
306bc92c8a75ad0f70f239d45ecfa64c

SHA1
925554f0df24353b945758d5d5f3ecc07ad9c659

SHA256
8c870c852e4ef3f52349f7ebba5c2b3908be6d9158a3bfd2731cff19a9f9df9d

SHA512
33d5260d4af055ad41e7aca90a845a2040c48a5b6bcc52b7352d9b8304fbeb6c0bf49634cd5bef323835de22f702e6825ae22821287ebfd76657327bffebe28b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be884e047f862a98a63a5fe660c076ed

SHA1
85dcc9be5c3f7996518af71e368c39d6ce194420

SHA256
0feca9a1764d8ce2e79ca4ddebaf15697419f7e56423e88bb4566b916deef591

SHA512
5d1f2fef8e694b99f817be55e274a18cd05daca968c45978a1ed2a655b8b19ea684c482c0b9d3ef7e8c992904b05f508a6128934d0b1d524225c21f9a5af7166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8151efb892ed7ae3a9854943cc7b9349

SHA1
4b2558a2769cc55bf46c85bd17aaefcc58d2e250

SHA256
caf6544629a7f67ebcb77bababc6e6f4cad9e8a6df6b874b2705bd43ba1cd306

SHA512
315ddcdf465968d293d31febe3ef0e7e619b8be2b82ea77c4eb6ce291743540b460ba64aecc22b0286cf272be1a3e6b4d7ef409ebef4a7620a9bf239d9d13322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b2438fd59c172f42ca7b85bbd9cfaf9

SHA1
9b523139cef6983295fc621364688cc1c7939d3c

SHA256
3e19d0e9a30e35823cd1fe5a2d6dc53db837a71fc0560f024135d5cfd4ef3cde

SHA512
516adc4674f224e541d6b528d00328c57423333f8d60b697c92c241aa7c0f90199a1a1d62f6a1faafbfc6f4dc6d969923751457ed92ba86232b76e22fc393760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8836bfc64b582ff0bba23f6d502082f0

SHA1
38028e3ef47b699b8e3b72b9ab0201cf1131eb73

SHA256
ae7c179e30007e204920bd4e85e9f0ce56122f13b921043bc504e0e8aaa52b68

SHA512
65a5ead59ad291645c3272d33f121f96194455e5fd1b7c6326b30e2e7efe0a8b0b194f5683742abe359f8daba8ecc5e90d8cd65d5f8044ded47ddbc40fbc9ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ba020483294610055e514e50ef84cc2

SHA1
c14ae17edacbc20d4c1290e81b63b796bf41acd3

SHA256
c9fd8ab7b5f651d0490e27b5487ec56fc760a3af9e1cd8f45545458a1b941773

SHA512
fbf9afd9c2d4d1d936c5290f6db4a7b5ab366dc90bcdce1cb3e023d864445fba7bec2c4603d4294909f2da80763d06c10dc84e45f01ea91669ba51ca39909710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9272dc2e45547596c7273223f3293871

SHA1
e9ccc6ca478249cc07736be8b5261a7bd76e51b8

SHA256
ee7e9b41f0c6594ca05350a074e66e52e33d425fa10cac9da72548f2e57b1484

SHA512
1c3249ebcac1f3eaba537cad1bff924565e6a413bdc4a4a5a1a84bc4cc1980e13d0edc05f2b14b3f9b9d341b79fc8ef58305efacb0e3ecda1d18ccb39cf6eba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b67291774f508f474bd494be574b848

SHA1
dfd9cb5ef31ecd99aa82a458bbc9ab0a0a6a10d4

SHA256
05c32776205bf791697c0fec58606d76304e747ee200858a16f58a02d5740e19

SHA512
76b21134c05a6db01832f2c52f30f54519de68fcec048a9d694e002f59187300209f7b4180c1c150f8d211f23eb225a449ac4cdbe84be1697bbd9519ffcaf8a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a481a485f4b318a3dc699ba12150668

SHA1
6662d6cd4f671e0a16ba7df643fe1a1e417feffa

SHA256
4fd9824054b688188138d4a494322f5d2dd82a800b67f6db9dc70c018cf9b53e

SHA512
01ae76af08a4305c67cedd4c1adca31e98e5a2604e56072bb84a36fb5612914b791f595b7c07ef6f13f2ea74d1c37a21cffda48b2035e60be683b1d901d1225d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
367b8aa7866a4489c183915a27769854

SHA1
93274e9395b5fc2e62cf05152e64dc9dfa381019

SHA256
eb008922adcdbd166a8dba9378f5c7b2d9e3ffd465f16141b2125e33524604b2

SHA512
aed25828d21c996506786f0606c3434ee1f105880a3bafe7ab45094234041aeb7ffbb0b90301c3ddeaea5e7e61685624710dae5f4a795a1a3df2637d5d851707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2da34ea6583b1b2c82bc5d5551ed4a84

SHA1
d70bc98242fb196779909bbfa6089596d6befbd5

SHA256
baab67afbac04a569ea46ea2480f36a921969acf73f787ad9b8526a12030c54a

SHA512
61e45431afa356ea82eaeadafb909962a287f68b8b38f8822e34fc0fb1c121c063624a786ea63ea1ce2c895bb655c7ec83e05e09d39c8b586e423e58eff05ddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a37103226b241164fc3507796861dc1b

SHA1
52d23b407aaf367187beb5dcd26252ba54b73f85

SHA256
037e4284be60bab9215fdfbd205e84dba56e5f2b9d53d6a042ff9ba3f0904308

SHA512
6d8c629b62b58447c310fede28ab62975a58fe4ce28d4ceaa7d65b76bc58f11f2817ed477fe2150afed2774beabe959cbba1054cc6cc8e06c70f70c592666ab8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E4B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit