f655cd44044ba06da15b6d8747898a802e9126c89794bc83570fe730a53ef65b

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ccc5a9ccd942cea1f00c50068d69c41_JaffaCakes118.html
Size

34KB
MD5

6ccc5a9ccd942cea1f00c50068d69c41
SHA1

bb1ecaa7e623366b71d2caa201cd6095464ac84b
SHA256

f655cd44044ba06da15b6d8747898a802e9126c89794bc83570fe730a53ef65b
SHA512

be2fea50d5abaa8f62e5d76127a407db043c1808b078d737f1c20db8a6d07fb662d6859995848f35b2dc4bc66082677a9a2ef538278f3341e89bf45420d42215
SSDEEP

768:gL2DPVaq9LYsbkm1wQPPQeyhikjIB37RmICEYwv6qF6zADy704Kv5:82D1H1wQPPQeyZjIJ7RmI2wv6qFcADy4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D08DBB1-1965-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422672811"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2812	2876	iexplore.exe	28
PID 2876 wrote to memory of 2812	2876	iexplore.exe	28
PID 2876 wrote to memory of 2812	2876	iexplore.exe	28
PID 2876 wrote to memory of 2812	2876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ccc5a9ccd942cea1f00c50068d69c41_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d91c42234ce0074ba8bd818c8d7ad0e6

SHA1
2176381dcf5e94fc772b76cce7786c3c5397f470

SHA256
30d7bd44578c9619c75eeff620c66ddd0356f0df3c4f7a76e943ebf7f7aabb57

SHA512
3aa6322d963583a40f19e5ec4e4f04cf79e92129f856f203dd2aa634e478cb566c5af33bbe2c0cbb929ab32d3df73b82ccf9a5cba6b2002303705f5f67965f3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3d659a77e2f0d150c7ea03be9b97532

SHA1
c1db85c3f16595409d3a7a4f2f1181a7c22214ed

SHA256
35cea37f48604ba093be887d520d4d1ea956772fba8a615189f363e999db9e31

SHA512
65eb1828ca2b2408cca2c86bac4979e6183e37a1d2a49703bc55a7561067ecea7e35b40d981b6eafd43bed9316f0f6141124d4aab8ad879d86f5631505a1783a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a8c1b44a4f693729486e1c511e04a8c

SHA1
fc2bc45ad0762605815bbabbbb5164a876c68f41

SHA256
12b857377f2a5536c7af50f4a9fd451485fd6f5038b0460436c80f99f7ec6722

SHA512
e94275b7e343654d503ea9317aa280849356644f911c8ee8a112c9234040fcdd8634cda4a5e3150394f6c4cb65f1b66383b6d398c86d232a6097b46b778dd0f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
139d08b9ae9893e9d528de111d12bfe7

SHA1
2da60bbaea5c19b3cc0f2b3737c1ff34bebd1b33

SHA256
71b88244aa5e72faf951e781c0d7e7d9b4f62ac4d37d99255a941d0a221deae0

SHA512
32dc425b38264c024f50b43fe7d79eb08c3c5b411add3c53c5a2481f182fd44f90b8c710a6291679c79ad622654890da2369d6d3828cafd5b4802931b1f98ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67a3e27ecd8e7aaf7fe4023e88c4428e

SHA1
a93e706f4bd41a8a0348ca45078dc86162498925

SHA256
9bc4b4865797100e63c56a4286b4fa13361e6e136d5a8370f6f37c0065d6a269

SHA512
7e1d5fe740deafd249714af727bd1aa488be604c2b70791f62a9b5140db2779d111ae362a45fe5134ab31b6b1ee2a5611fe8d68c4e7a492365d99547fbae0daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5762756db795da8395d1662b75d2f241

SHA1
2dfab337aacd4d03883b1fe36696198bb5115afc

SHA256
8bfb704277a5cf1c3a81c680e409572c36c317e35f441ddd4cfa9cd21de5d5bb

SHA512
cc43948436924c28e3cfa231c0f849b1945dfe5c400b4dd787d0769c8cb7489d174ef1dc535e267cc5fa005198e73db43f278a23779b3681f35b44b30d93d759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbab38dba36c20b20570905a93e66ae8

SHA1
c23357279f0e538c87b5aa10ddf65fb6cb1a7dbd

SHA256
1d1563413a226de511b0fe69c7e5e60fae98c525f973f69a7e434ff8b8d92146

SHA512
b08304c2b1c50fb157aa884d4dd701be3d250819a121bfa1c3d8792142ee3883a3d4f3c3d7930bf1bd93fb713f0077c128f4d64b1ab997f1fc88c127efd9e51b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b6fd83da3aeb3ad5b6000653f00d5f1

SHA1
b2d6aa50529f8415075552019ce08e05a510faee

SHA256
d977517da569342042a507d48efd4149ff5b7a7531599097066ec3378227ecbe

SHA512
f4fc1f83299188d17d71dab2c9b075fc65958381bd5e5712f9d36887ebcd22df8cc65b7cf79038b5328abe2f03628dab8ab49b8db80cf2831c478752bbbb6220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b4a85408df0181d9df969aa27c1f268

SHA1
650579f15fa30362473c60166cc8394aacd26962

SHA256
92bfee8d0d03b316d5c06092ecd8e0b54aeb93d25234601aed30c1505d1ae96f

SHA512
e0d20d3ad5f4d644b5e65052bba22cc49d126a3e29782d56abbc0711df796ec035321062e1bc89f0dbc171c14d107c6626c3921bfc56e8e884dd465f849d993e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91067cf495136f65e26b1a18c0cddff3

SHA1
a1ed4ee01a032a6fc6c77a283e63417b01250bc9

SHA256
41ebf18e142e337a0f607b622fc134994aff87664299ca3f83e5254e7b213aef

SHA512
c5fcd11dea2e26e7bb378e0a8f948ba9ab03b303a2eefedd2a36183474213929afc4d9cc9435f2729459f5c989ae19c5305bfce3031397db00014b4aafc90dab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2de283d95f9f292a643d4bc7ce1a331

SHA1
fdfcf6132628ab0e801d8cfe3d8009b4058bb05d

SHA256
bed3addb66d00ffb56b0cf26ade5c628b4caa3dca2112f12c1f625dab7774761

SHA512
d19a8034b75a736020e11516c191257de29ecfe27aa3593537014c1a0e2874aaae59d24c09d27cb8b6a40c5dbb5c04d89c759e93865c3f7dd17a72cac5df6d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9112199dc376a040461981dbe7cad65f

SHA1
93af8a9362127f624fba75184dc251e9b33deed8

SHA256
c88b322fd71cf0a0e770fa727f077934c293401a2e22f47d0f7ccf9be6505161

SHA512
fa125e86a562ffe29cb3a0813160401e72085c6a35a25cdf73ca6cfc9db6fed3b66b89559b6399372aa827016f9510d2ec00120e645485460608d9c6ab4c09ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ab4d65e644e011b94acbf413c80bbd0

SHA1
30e1936b4095d41ff4eda538f322e7ed858125ce

SHA256
55d2f5f1f6edb1a2872a9abc4408ae8b532ed0b39320c0aa6e4aece361d58aec

SHA512
dff2713643ad8000a435ff5b60d02b3f519dd45b39e0ced5bc65a86fdf8878343624edf21a185dda479fd8c6cf3e88b5ec706eb6a74b8a2c07669fc90b1c3e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
772ac15bc0e7c0f7aa3ea74587c0e6a1

SHA1
802cb758bcad049c53ba4fd6fcceb17bfb812354

SHA256
eff13f28691cb88a4a980f7e8c89a96d307ada478b17df7dd7da7c6fd635ac03

SHA512
617f0754eb607f646253a4bb64d3f64c721485e2d985e8bd18a6cce3b065918adb6467da63af93f28772224e5ae8f4a80abb902335b4dc0ccd66944bf2b9c653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fee26f8ebea210ec4aa15bee562b9161

SHA1
3f2d86a2efd540b163ca6b044b621210b1b3ce78

SHA256
f1008c6d1d80deb0975cf73ec18f2f9031cd5c7642a487d9b144307067ef80b8

SHA512
598731203b15ba3b2896f55572f24dfca606fa135e0e9f2556f0e9c1e1694614a2ec5f97952a87c7ef1abd575512d8706d48c247f450964587bd037e860949d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f2bd8da35ee13c0549c7f6236c1397f

SHA1
c674b735c85763817bd629a644a3720db64c90f2

SHA256
95d1ac37b87e958900ef347a7e78bd14d39b38eb1f470b5957ea831b6f8a6762

SHA512
a18beeb618a7e512de31f9d74a77757bc6481ead1d8708c145eca96a8016c01cfcd0cba369c4af6a946db296e449e46f2cf12839c9bdb3f66120b3f8f49708f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff84236d53ecfdec3bc1e2bf804c9e70

SHA1
51953679d448198e5640824965b06fc6c9906217

SHA256
2300104a388c903d2a62d0104ce616e6b9f0cc1a6a8ac5716d003aaf872977a1

SHA512
5d278e328af296d668c9a41959f77c732de54ea4bfb109c7a21c508020d1b76bde142b7c002f38130ea9c19b38a54203f4daa33a30d82ce71bdd54729154d1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9398.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar94AA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit