d73967fa85856fb3d5d552b61f9903a3fa5988e84e76c186ab5099d3a52ee827

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d0e035cf3bee6ec6037222f8f8f7e33_JaffaCakes118.html
Size

4KB
MD5

6d0e035cf3bee6ec6037222f8f8f7e33
SHA1

9932342c7f6368e831e26cfe443a506dd56a57aa
SHA256

d73967fa85856fb3d5d552b61f9903a3fa5988e84e76c186ab5099d3a52ee827
SHA512

3d607fc9df10064263c7522d0fbbe621c779a908417eb3af0601960cb07e9d827bad8c35aa56a9172401f95d982e54f49be91a38bc9f06d2f3d918cd4e14281c
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o4oJSeld:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7F27AA1-1974-11EF-A6D5-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d53c95101dd41a4187c856762727c1f000000000020000000000106600000001000020000000958fb855ee19acdad31459ecb697d694a33d4e75a5ca40220ceb0de54ce4c5b7000000000e8000000002000020000000b49410cf0a22d531e15e92b91ef83613c97fa83b88db899de7da7d1596e0fc802000000074d51be7cde2da4e3da69567bb762afd27d6b14ff03eb1ac826124f33437e9e740000000679bf14fee13a3cb78d51a4a4565bf6862a5649326cc97f7280d70398f043c3c98a899cc1539e019e4b6eaf602dd6978552253c2fb37033759464a791dd25017	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c030deac81adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422679378"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d53c95101dd41a4187c856762727c1f0000000000200000000001066000000010000200000007f3cc524b5e4ff243e771d1ae1813e581f61041308f5e38d5a5a01e0998fce43000000000e8000000002000020000000db0728386e00e634b404ad68488e4cacd3727be03281e42747f328239df49a929000000043547722392f9bab8b1dfcac1c60ef73ea393bf3e6e083334765332435c967895ecebbc9348dd984c7bc1f76f1aeaf2ddba7b396eadf9fbabdc94b9dc70c6bb2ab87c8c1d7ac1af12692dbb28e6fe58eacf721cf3569179086946c2942fc7a9674df60100933147e57fd7a5c16d6d6064f7300ff28f821b3d4755043e1ae04ad25844847974a96b60ce694636e24596d4000000074a63643c3c097401486de6b89b5c05df78227561c25f9059945eb9133e1ebda256cd121c73f440aa8291b513ad72196c218e8a369a6803e6a945e0e9fd29d88	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2300	1640	iexplore.exe	28
PID 1640 wrote to memory of 2300	1640	iexplore.exe	28
PID 1640 wrote to memory of 2300	1640	iexplore.exe	28
PID 1640 wrote to memory of 2300	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d0e035cf3bee6ec6037222f8f8f7e33_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55628321ba4ec37116795aee57a84ea0

SHA1
10f4580e67527ca5d36e7a156f5d57c94f7a884a

SHA256
6c53eb5ea6afda63dd8c794295fd17e24f4e3e0a326100bccb66db3c4ff5aa79

SHA512
9cf3390f84b9670e122187d0af903e1071b2dd8557865a3b5316e8ba774d2dd60b3c490d120d45d902fcc92eed4b8451308824e73cc78f2f97418e5cf19206aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42106738cd32c5fd14f5992a9dce602a

SHA1
fce8da56349ddff9697e35d6aa34c666ec3f3338

SHA256
342707f90578ce7808e78c3677056a822f7b1ea43f48ef8c6e2bca1d8876b625

SHA512
e1b625502d68448371590c63718dcc87ee7f473fb0c9964f48831e269a4ffed8a93fab08da14f7fdf6ea62a8aa695fb9fdb5882efe25140ab5d7bccb5369929f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79947bc6d7a25330b61fed7458e5bdf2

SHA1
c1dc60f7ce8ee28cc83e64ecd607dc78c89805b8

SHA256
3fc4cb07c6a564fd5f2e27b15061cbfbd109421278dd2c2c02ea1b46220c23b2

SHA512
cfe6835d591d6affbc7fc3313f6bebb4db495d39c3cff9c191366ee08d800e4d920554cbe005d92b8b426223ef9e59e51c5d6488e65900134cd57011f80431ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa44e4446dddfe79042ddf3f932182c0

SHA1
4a923c8997ecc1d4170eb3395233c6cfc918a6c0

SHA256
3aea6e456e5fe6067f4812095d213a89e75d6081079b17090688548ef555f6c7

SHA512
b15497061090d15909839251a03904b98bd3bce1cc012833413a831804efacaabf92df7250ba6081a4f51d9a07b64b42ed6556727f9c9701da1080c2fd458d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f004b904db3f119ee4ac638187790ba1

SHA1
b9d8384983502e7331f9dfe679a3a17ec528bd4e

SHA256
0285cad5524b38dbcb638a9a114f443466f5f2363c2e5919f32c7752ab7ab6e5

SHA512
5d1f8b7060ac1abdedbfc74085c22bd25b9a6739705a09e1abca7ab06b04f416708cff203747b3aa778ec8956fbd9c5e4aa113c5de69889b41334ec43d6f05f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7ef75db0a7d88067e957d8a027df268

SHA1
d9eab2e9baad8ff3cd8beb6b9e4888cf44415168

SHA256
ac4ff3e79bbc7c0704b96cd95243f10057c8e3b8801ed41e7145f5afb4c48f7e

SHA512
d1731846e8debd931acf8d8caefc8313b5a8662aba1ff4fd9111a241d49041db28850da43b79117e0f08efcf3900c82b9f52c63074a3924de9fcf3f9f725ee41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d791dddb4bfa688220e24e265a531c24

SHA1
7d7c6e2cb2744c20fdc6a6bc2ba915204a925a73

SHA256
e3a820eef4f06e8240a649877d0ba2f33a5c4a1ce48c4e835d639a495fc70251

SHA512
bd4e9d5693326852b26dfe43423507da09d4037dabf1bdf4683a8693cd3de687c282531aca459adf9653507047b81e5ca3f95b5c1f294f6d24926882b9d88b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82ac15ed58f513089f0788231ec283c6

SHA1
b20a6eab3af04849d55c065b9f1f4ec923722e30

SHA256
1ae49450ee219ff23601794f87327cb6ee3abc2e801ce67bb03ab7c727d91e5c

SHA512
3fcc043c23393fb20052ca423ac7d152841afc9f4ab419404dbe02439700e1586d6fa0c85fab7d8a90d3b61aab2ec2b586b50cdf4b9cd58cab0c97eed4253a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da51b1845f23df618f23d98b341fe10

SHA1
fda6da4ebc896f8d8dcb6015c3a1be07b133bfa4

SHA256
5fdafe6a7affd8db3108764f087f6c46a1a656795c44f123b4325ee852cdbaa2

SHA512
abb55a058157a8acf378377656624782681d66bc93d030145219c5708279e868582187186cd23bda9cb532729db396d090ac3ab58f12dfd6053988ec7c821e69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13819bebbd23e667d1e0fab49c56100b

SHA1
6cb440dec9660905dc088ebec20348e0fcdf09c4

SHA256
4c7d739911a693a5a861c2bf1d700af3cbe8a5ba630cc2eb975861d730f3e0c8

SHA512
8cc7b953c37e8ff6b0d95bac703ae889163e3e8fbe8639f0eff72c037a00a32bccd94f851524132cc4c7dbcc819f2c1c74d9dd20f21c6c0e789f9520f39bb04b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a7c63d1ea1775b1c1b851d5cf7095af

SHA1
8ee26b6c0c31395c3e915dcdac4adf6d62743e9b

SHA256
4459d13bc944566ab3bd37af46076b88b19e8c9557573ba2a706ec410d74ea0f

SHA512
1af411112e447530307f53b57a8eb86ffd7fef29b350b2ced823c54889d174a454e59b757c57b4a770c6be7efd9f7bd6f699c4286c94b74c4173a63d17af5872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8781a18ec57898db978a9f990fa8ee5b

SHA1
2ba6601cbc3c0208563ba854cafdf38eef18d05d

SHA256
a07fdd42080423623583ec0eea6eae431902d4a12816e20f68ea50f2a6d10a54

SHA512
ae030e209cd3efb67736ce81224b8fe3ee6cc94d1b64a0626bc54c6f0fc2aca9f041f57a2c6f48c1514aa54dfa814bfb0607154813627315e676067a54ca9a2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCAFF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCCEA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit