52276aa964dc61cb622518f3a8d1d86072e24f02159a51dd11902ceb4cb20261

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6fe70ac1b16c5d43c47b8e859a01d577_JaffaCakes118.html
Size

462KB
MD5

6fe70ac1b16c5d43c47b8e859a01d577
SHA1

666ef2cd89200517afb1762d718fa73b1d8c146e
SHA256

52276aa964dc61cb622518f3a8d1d86072e24f02159a51dd11902ceb4cb20261
SHA512

b7f1c8706b0a76134d217e7008ff5f1ed0fa4083528341609ac66a7f06c74bbd483c61644d961e4d89e9985ba21a9e95e408347b04afdff7b2fe7bae98976b6d
SSDEEP

6144:SgsMYod+X3oI+YhCsMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:f5d+X3jA5d+X3Q5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000e4e85dc2831a70499adc5a4ef06ed49f0936d33ed34ddc6dcbca8359dcab631c000000000e8000000002000020000000c553803b2c5182d196f9f4ba145169d300bc6238ae2d581af8d0cb41176ae54a900000009d6ea4b9048c51eae801479460aa0301b31c97189992eebe547605115130b141d036e51d4b143e3434d604e31e90e8ed204b24eeb9176c132b5c657e9480a4796e8fcac316d58990f9463ba81d8dd48df569bf4d7af141b734467df48e0cf9234424a5899d173465ffe656572b9a81ec4c6c9e8b8b2354f9cd55b9cc6413b049b5225b529778aa46e2eaabff3d63762140000000bad9cabc66f28a7b6d4bd3cd1d336d3db9be1e7ff4dc0fbfc2a3864c36a74bddbadbec54e91b4ca0f767c7ff6f7d8310657fc708aecae53cab11f8229472cfc2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422749347"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09ff99924aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0D3B2A1-1A17-11EF-A538-5630532AF2EE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000742030e088935893f1e596895d2057771a7e111b5ee48a01e1a522b2b8140bf7000000000e80000000020000200000006a878fab7f134b569d177e9b5e0976f3adf4b85eddefda0687b8c6448c0f4adb20000000dd0cf5496df5d9db327defc697f2508562089891e924230a00f6dbeba21e8e1d4000000015bc04d272365f7c585024d85ee57a1d2c36953187fd19f89d3d9cad87a032aa33f875c27d88a016603dc3be8a0d838e8f1cf3addb48a60e8e9fa94be101ef09	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3060	2164	iexplore.exe	28
PID 2164 wrote to memory of 3060	2164	iexplore.exe	28
PID 2164 wrote to memory of 3060	2164	iexplore.exe	28
PID 2164 wrote to memory of 3060	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6fe70ac1b16c5d43c47b8e859a01d577_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf4af010da8279f6f56d6ff656b7cd55

SHA1
25dca2afa94a790e816fe209830fff8dd0b99932

SHA256
fa6d19feb7c36655d2fe320d36fe8cb06db8c1a9a1080b585281b4b19f035f36

SHA512
aaf532b64f655679133fc77f3c43e3135aff9214e30b7610dc7593861f105e7435113cf3f3a0dff451778d77c1bd02ccd76cf455d1cf0c8f247fd0e7c7488683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7028ea2031ced945ace6086ef292571f

SHA1
e733efca5b28473d112f23fd8a1b311f90dbf3c4

SHA256
9fedee9d0af5ec4aaacc211d00d1fddd79c430eaa1f6ecf51286edb10a28bf29

SHA512
745f5f5a12399d5f6dae430544e679787a03a86da961d7a056596d0f7dc773c642a36b21d3de498590ea21393f02c80f6d70b86d58bf599d29df6a09ff40d5da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
770131e9179defc1ddf48b0c14830748

SHA1
bf588e127c86854e9883ec6b346aaf062866cc3f

SHA256
2dfbba22dca6cfa5cd35ee5dbfda2625ff9c979e7fa729eb1674dd512788ae6e

SHA512
b5cf574a1fa0cc1cd9d2a2d44e0f5de74d57b3db7374f30ef02cba5b9ee117c4c29c9985a9d1adfd10450156882af0b42d95d35b8799a06b4a12e805bd138e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb5c0466a304cf162266a6bbae43997d

SHA1
60c14ad132c1c263fae33405eeef29d85e5d3c85

SHA256
15c1c84ec54dc31078a70163d5c78238fb6ff149b94a1d94cc5369252c9a7aee

SHA512
7d752f174d097318e91824cdb182cfc7508b0f3168f55da9b0475876857be1eddbb597432fe93528656a024d37526eecef5a01f5664473d5739cc5cb114c049c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
550d5c8ff981053279a807da02bc131f

SHA1
b240ad2b05caf7a5b437137e6dcbb64daf6790bc

SHA256
7835b5b2ff2314d0d3b4750a4d096fabec61a2be0fb0219b74f6f5e34b547e64

SHA512
c6399a50d93d47fe36cba45aed4eaaa5548a8245c739ef8e2ad07f4a92fbbcb62be3963c05df76e556c24c5decfbf194549be6c31b53f2d07267c7049457265d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c5dc1cffa8c77c3bddf871998495b5

SHA1
5164de9ab7443ed1b2f6a3920c64cf58a4bad4d6

SHA256
539793779751b5b7edb015f4c6e645b7f0d0adec147a0d0786130e7d6219cd24

SHA512
94d6ceba8a0bc33c5962c2700080757052a861a68787a12dbcaf2ec18f679c574d9f0e1de840e8a163e101d10b970117c7d818e00859de3982b5692c8a7707b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ab3c19190e22206c9b76d46ae2dca53

SHA1
a883354b3d24d359a07be5b4ba470d9e698fcf9b

SHA256
01f2c198d7e161e61e9d825e66a8a9bb130895668252fbd861fa2210a21c6d3d

SHA512
2502df2732118ba25cac863c7d3e67bef51c4a40394cbb84d4606a1e22f332ccac6027ad944d7031d5b25eec7df433b950f4fc1322309f9478bba5ce8d5dbc21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcafb5899fdd726ebd47fdf7073c59fe

SHA1
a2ecbaf0c1650c209a62886ea844195e3945bf7d

SHA256
250aae317dd93e4512cd77d2b4b7149defc4a599830501192399179b6fc13b80

SHA512
3d92ee69f5b35ae24121720f25127dbeb72d60aa68f630d68121ea2c4ae4c36aee9341342e18b0ce2b5e4c4e28f8e59a83e3cb01529d916da9be065193ffb124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d02a18d69889583aaa5add18b0cafc47

SHA1
334e9c14d07e8fcbe05847c0962ae1d75ba544d0

SHA256
3b93bc1bafffdea3147e5e4eca1750ddd49f45dfe98b0ef7821d872fafbe2df8

SHA512
94bea3dad591344a3ca0b1f7d816121349a052b981401347e98e9950a2a4bc01b94e00a0c0920a0856ba1721eaf3a9266c0e1dab508288c234d1cb33115fc6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1df2e991a26b86d01220e308fe1b6d6

SHA1
2bd341df083576b565647bac548c0187254fa2c8

SHA256
5c391155c9bb64160ee2bbc6668924d689c76ee6803a35b9a3fd51cae2caa11f

SHA512
387441692ef4c8d03139e6ccd761b48d28d114ee31ebc2660f5900e102a592e800538dc7f60ff74da806102eb81016a6a595e30bf7fb49b03083236c1566bd9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b07b8e1478977ec6a9ac41d9ba2dc7c

SHA1
489e9284e821045db9b9b3bf36984b2b6571fa7f

SHA256
39eb1c3b008a79e6da2d6d0886d564f9937eea09f5dc92cf92ddd0f9d4d5247d

SHA512
2eef088b442349d1ea413184df231be5b34f85c8e726e584c6357ea05c26b0438db908b2e6638ac38568ad85b0c8cc22001afa4f5260e074d7bc72f32f92822a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9411418ac995f82f39a50dda40ba883c

SHA1
6465ca97b7402a6b06dac452aa85d89264071dc3

SHA256
a67d39f52346a1f75dcbeae1213cb29a2914f3aebaf254e19bf0261654a145a4

SHA512
5eac3d489cacbf15b2a9846ae439be5d6711a71c782d71a534221c2241e1259a166c156e019ce151cbf81c6852fdb6188489036c800b79603d55805580a91bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
257643bc2bc5b7160eb512c29d4892bd

SHA1
0bac3cb92ab17e24d00d640c7f7a2b23f461e5cf

SHA256
d23831babe320d63149018973dc3d74c4a90e34a09c4453e6b6b64d32a620c7e

SHA512
60cf21c1b1018c81e6b2d086b52fa533dc65b584c698aed065925c163918bb060d17fc27a8f1fec9eb386e3b8e8f3eae1c5a32b149da1bbd929ea5dc383ced4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db021c72a896d8802a2b3019372d61c

SHA1
26c4b95b08dda2c28f13d888ba64dddb68486632

SHA256
872020add36ae726bb21b1414692625b3d2535482d43b6a9835a084dc289f595

SHA512
6af6e53c28597055aabe26834cf929f22c81469af8f57de7ac901aab795c4a91e3cdf0bb033ffab92435ecc6c5a33b42fa2eaf293b3772d5da4d44ed585b32e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0052165c28859caf02fe230f65ad316c

SHA1
b4bb7823c63f8fd8a2c750ca821193ef5a418e53

SHA256
bced6abb3e40b1d308f5377f7505edd486d56e229b2a6e743194b7626f23ca36

SHA512
254abe60db62ad5672ef757401ed7a2637d633f6ec044264572962345860c5bb2c6cf8fa2459e20f7df93d1253bf5b988b4ac29724efb4c8f975e9bf6e340924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
062b20bcfe5aad3a9057a2b8b3f230d3

SHA1
87a1c6b1fd8d2f782956e12da846cfa576a9ef4b

SHA256
a504086043570dabe336fe1a939ac3e20d8c3376d3249cb404896720837a2102

SHA512
7beff00b349bc5fb43849b515372293e454cfe08e95b2fdbd40420fdf987e43a9446f52feab4eb6874ac76fa0089fd0ad9fc9bec66a07417d7b5ec9847d84d30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab428F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42E0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit