f790e2a66d11b94bc532c8afaee43277b229ed07a4b7c11cc55523e387a368be

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cf0a9a5a5a1d9653af7cf295a876859_JaffaCakes118.html
Size

2KB
MD5

6cf0a9a5a5a1d9653af7cf295a876859
SHA1

5cb32791cf74345b36766b6d5d94d1f176f91792
SHA256

f790e2a66d11b94bc532c8afaee43277b229ed07a4b7c11cc55523e387a368be
SHA512

55aacd7a5b7f6497a6eeeccc79a40ac8612ac07c89ee906616330c68cc86849a0a3a2042660181e7f345fdd65d88bccf7eeae57abf3e5386295b77fd7bc9ff83

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c115f57aadda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422676493"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000fbd8175e0f811e7617f34f524ee9e6f67d6e23f61770fc78cad3c369cdecc931000000000e800000000200002000000073487d64b7c2dab415860d1726ea8d43c3ee26b4444f165bb4e3d97315c26a7d200000007c21f608beee353662c39ee0c93daeaa961c16d282e662bf578fe6bd4371e2de4000000016f59bdbb9a45320bc0062b596e8833ff483d23a3447ddc4ed2f878f20dd68672576ed26b6263d9ec5ef4511331865456334f0450d49d721560a1bacabf299bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2075AAB1-196E-11EF-BB79-CEAF39A3A1A9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b07048619286d3743c23db7e11a440f63945320b2ee07bc3f9045ada4167e970000000000e8000000002000020000000e70dea3fe864947500c1560a7f1a021f563eb6573043687b9e0822981cacb69390000000bfd608579c7442718663d8b62557081ed6aded1c5c9209221761bd4f020c15e4e29079a62a88378501ac6a4c368fdb7e13490ec8bd8169c1ad2bf85e4d9617e6a9f10407dbfbe8675d066124d6a48f792597bd18bc2876b5f608c541765200e54f237a086431095c7023894a91708d6767f401daa0e0ed54d31f94abde32bde224db5e62571172601f753619df69835240000000db6374aba7bb73e3a96fcd3c1516a63174516d550d023a7dcc546727ede70605057cf6637bfa1084b52fd3dbb86f84a3ad705c2f910f7b1fbb1f44b86ac46ed0	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2720	1876	iexplore.exe	28
PID 1876 wrote to memory of 2720	1876	iexplore.exe	28
PID 1876 wrote to memory of 2720	1876	iexplore.exe	28
PID 1876 wrote to memory of 2720	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6cf0a9a5a5a1d9653af7cf295a876859_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3568ebf3dc5fc153079a5fcd101f5c31

SHA1
53bf89661b01d468c681a51e0357535c4a723efc

SHA256
737e91de4ea03ca68c9c6bbb2d578b0df3a00c00f67cd3e785cc8736d7641abf

SHA512
f25fdd49be9d4b57b0ab8162f86304de92a5e0900ae23f82ddc7abf9017cf6716e4b3c18d2edbe18de062f6c863461986f72e6cee32b2c3d9bcb83c309d8e0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5a07c2f641386d28a04e7ddeae1061e

SHA1
c008158e4d7485c07c9a49f72378b1d3cae40b44

SHA256
c80040c01e7a24e16ec43d876c28d0db2787cb5bc64feebd8f7e4ba349e6e0b5

SHA512
4f60d918f151efff5b4a7f86e73b3a1012604e1462985ac0986b6b2be3af5d75638702464682c0fefd88b5be90908bb8b489573224290c1dec1c28dcf1f42ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cc1690914ae915cbaffb3cd615725cf

SHA1
7c5eb073218cf38d74c264f3c78f5397d14fbe6f

SHA256
fabe5f21863bd7dfca5e40fbf816a2230d7576b99871874c3851f6c98cf3501e

SHA512
a6a9f2295f3958acb20090fa8263c6d7dde570495fc0823ca1800689c09e5de17e08d6a3cac3d98f7e6bbd27b7c40f4a1635435acf2e37cdcae8db794e6f4370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c435bc18258d04dc1454b22bb5d7600

SHA1
fe9b88a54bc7586e6046d053919de644988ee579

SHA256
0c4469e4e3ef8c1737a78dc3729e30a914e2ab8352480b006d37eec9f2b5b2df

SHA512
1bc3f9847c8c84fe2707648e2d334e193ec0260f5ca9f67d0665d9eec819e9733d0592d44c96355adec0503cda1d7cd426f86082e65256f8fffbee2be114d74f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
030ddd32f909b4d52d175029ba38aba6

SHA1
bcc63e4e2daaa115beb08511ea723d05c9099a78

SHA256
f910a5a59bb4562ac609f35d7efe57df2081b2b3e70cf3355dced47bb81455e4

SHA512
22bcbc613da8768f0c5359f2a7ccfdab0545bfed2d920fdb63a69d9dd309486546530ebea11f26a4d59eebc29f206fefab4f08d806d6e589051b043652815418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc0e5359c3a3c3fa0b2c7e34cab1fdd1

SHA1
c9186b781dcf4c87c82f3fd60957eb4a24768b7d

SHA256
f284ea1c55fca95c021d055a125b439766d1f4696860734e09be53374c88b52f

SHA512
a75f0d53dadfee88ffddb6c623d741e979a48945eed0d7d849ea3da33b206f15bd246be2917a05e610c6c0bea5178f539dc66f6361ad329e5ca14196ce91fdcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
265dabaac41bff850cc7a36f45ec95e1

SHA1
0e9cea75ee71814ca26e134ec47bc26230329423

SHA256
c6058d574b304d5a9464f719acfaf89b8c1ebd0bcea8b26c8e5f1736c75c10d2

SHA512
9b3cd7c334096de9cb9ef35ee4c0c43b35a40cacc02f27e1237dee0bf742233e71b0a46493e16efc5b4d1780e82d25b625991262100667818ecd462469cba781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c22dd5bdd1d424c4eb4ef1d8d5e3ea

SHA1
e26e6f09663d1ada61bf5a0206fbc7f20a39d613

SHA256
721eea8f0444c89b9283ca6ee21ca3e7adbdc3107172dcbf1631a8e19851688f

SHA512
6f1fa70410eaaa30a018157b667605c8dc8e75808588b2906e13e31aba7a1ae4a893b401121f0911fe29df701d4a7c9f6374b5433dcdb659c3de6e37f04d970f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adeb6dde3ba247414e8a699bc54a9a3c

SHA1
67bc9ad8ebe1e189eba05d41dfeebb8fb96bc3e2

SHA256
dbc2b4ca1481ab5dfb9a475e964062cfd75fa39427aa48cc7965f3c47ae70f55

SHA512
c2ef54f9a8c19b97d03214e1995e247a72736b14fcba5ecc3d5141ec791ae45ccf3ff30599cb8e6fbd5174be0c35bde4311cc943a66ed0d7f6cc89880297e725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfd8f9857ac3b9941b70637b0a13da1e

SHA1
ae7509e4fe2ed3565881c4925bdb89e556f871a2

SHA256
465b4fbd7ce78ea537591014c2f622fda6bc6b1ce54bdb27465def129b9b81cf

SHA512
904fb1e201ca63edf9600ad52376c538799ef5afa3b7a72339cc0cf95218014c0fd463a37a4eb59afb052c9cd8373efcff00b69c428b01678bf75f43bcb569b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197eee6e43b480ab81d1f9c028b10f5e

SHA1
8100c08827ddc3afbf722be07d315d355e819314

SHA256
d68a8681bd67733c6c889dec4098103be1abff42cf39736471ab5135d112207a

SHA512
3984eb88844484035f499656f04dc8c4cb2b727851bcfd63d5b13c3d3da3b6167f19326aad8975c78ae680ff3fc485128d5fecbdfa5d75b9d21b7a340efb596b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
468564b382659b4d1d898221298c36d2

SHA1
67ed477aef6c01b9180c2a8c398aeaa83e97d0b4

SHA256
eb595a2172667fe8906550392ee086f95bd76249852d7239622160687e9b6890

SHA512
f105d08747bf7c834a1e751e2d1c47d26062d10ec82a83f72d41a5a544d5c1e2ce7294aaea93e7c92599e5f7b53b1fc306960e52d7ee313e95f56cf74d12d7c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3565.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3604.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit