895874df5550bfd4133ad586b5a54e0d050907d0528d8db9e6366e5c2963b5d2

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d28b0b8ab896881364f2ba80d7dbcdb_JaffaCakes118.html
Size

14KB
MD5

6d28b0b8ab896881364f2ba80d7dbcdb
SHA1

8d6d48e0eb5ca5cebdcefb7038ef8075373bd175
SHA256

895874df5550bfd4133ad586b5a54e0d050907d0528d8db9e6366e5c2963b5d2
SHA512

e266e25324fe92bce08b1f60bf72f5403568c9aba69e0f8bada3b15a7641e0ed383e7ea2319e9915280d785cddba936fb0e25c27149be91621b592a070d0bd88
SSDEEP

192:8SqF166QKf5+cixWkcW5aQbY9tlVMvOF9bk07JIBxA8ytcm3uFktX56z+LHLo4qz:Jy169KfYlWkctCYoH8JL32k56zQHLnG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422682445"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC1996F1-197B-11EF-87B3-6E1D43634CD3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1884	iexplore.exe
1884	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3052	1884	iexplore.exe	28
PID 1884 wrote to memory of 3052	1884	iexplore.exe	28
PID 1884 wrote to memory of 3052	1884	iexplore.exe	28
PID 1884 wrote to memory of 3052	1884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d28b0b8ab896881364f2ba80d7dbcdb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
42aa6476d841b08d0a80509cf98b1bc6

SHA1
b7eb339d38d23ed677824274b89e579be9762138

SHA256
2d293aa62a37d5ceeddd2e6eb07ba0ba72b6de8794bdc9cdd2be9f0c4911abf3

SHA512
3228c11d244959710cd7c366367f718d77b7d36b79519d3ff2b24462f35d1ab0b9b80a9faa85d832244425d833e831433dd2bc723ed88d3316e038ef036f1b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
498f36a88222be3335462335e6ce299a

SHA1
98c368f226e32d7c13d4571a34c54ae6d1e40829

SHA256
7606c1b7b6637818cc5b3ed73e50fc86aff5b2aea17cbe13e8f3248bbbfd2940

SHA512
c9b453c3672c4ef42a38b0314c827c53cb6ff4a1a19cd1bd81ec9ccaa23b10409fc1f4bca782cb1ea32e87f1f1847e6a8c3597e7d78c94d77d63d7295c54e037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
366a35cd88091e1602d8a6f41c1ec8c9

SHA1
2f861741046cc935cb657dc778478d21f7291ed1

SHA256
d7f24fab691151bfcf0821cabad973d517a83240a6243a10bee5a0b62411b249

SHA512
436cdcecbb81d8b7ad44f72ce04ecbd9960b699abec0420e2194e9c2ed0ddd4d5e9d107fd1260a8ead53947cc56987064efb4708b0ac6e7d10d7722650f388e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3e70667f5bc3e1fbfb345d748723ead

SHA1
f5d6d325fcfe77a9d130eda260c3dd87168a72db

SHA256
e8712714e9a390954a3807c8ca9ba1ff7b205e1e0fdd1cd30d9104a46e9d7002

SHA512
bac41150c0e29bd4b9623bd9ada59f1eef29249fa0e052ae1915fb9856031cae7062e89d5236ec6f90aa03bbcc8a7e8ca629e1684ae1ebfd359775b8862e47b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65b4398a9004ddae3e9dd5a9942c8afe

SHA1
633d5ee9d6163a9527e713a4e54b6afd2bf44fe0

SHA256
5f46a24a13fa86e76899808c2ec665f133351a9d9b559f5d3afde59bdd46b658

SHA512
bf01e77fecbbaa496cdfe1383d4c7a8626c0858f5bc05b061d60a6f3c426b3d5fa4130eae70694caf80ae998ee5ac35bf56019b09641d37d6b56b241f11b9558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d4c4b53989ff5c9d27bd62bcc3a75ac

SHA1
819f2f72c6a21667f14b95c89d53a671e4e8221d

SHA256
fffead0ebdd79c5b48217355e3d0ec2d00337fac15cbaaa7a5ecb31e1203ed1c

SHA512
228b34bfd0246af1be692bc3d4dc3bab2c75400622223531190615a889a151fa0b2e6b74c69895e4ba4bca7d66b4b7f80ec97446094054ad57d0e8a284444e0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b4c4faefb0b5bfd368bd936a9d04222

SHA1
e7ff6681c1872e6eb96041d8d57a80789a95bd01

SHA256
7b288a574e0d8140e18ef7e7763826ac6cfa2b8e13f46e2af29799120bef8717

SHA512
c34ba8f13444a3cc8c4ec196831b08028e80360f69dbf4f8c42a243aee3d049a4dd7a0a0ba091d868352cee71e51d16c372a3494dae1dc87a791bccd61e86e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7e4764781ed965e77573a611be1d300

SHA1
16ea0929176704a40dd3c4db5bbf864d4f2c60a0

SHA256
1fbe3436631b6d0e422ca8af0e5edd396662fdd385ca9e5dea431ae9671f84e8

SHA512
e79fbbe3d161d1e3c1ef4e4bbc543ac7abbf901cf42753656300b2f6e90dfebd9f38155f7f21276a413f7b5c7a8252835e00628d394a2f6da44cc4e81569b4ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2788156a60983a26d2369d1d75cfe951

SHA1
5db6002d6f2cdcf2edfa9578e615e5abee659743

SHA256
90e9b856407d859943568f86f8a113e7fe3738a9882a306aa7a0be2145affe6b

SHA512
c4523438171c3e849a4ac4308306f0447e66f2e2c602c35abc9a831ca4ce52f70400ee0d5ee285db47057b027b65ae399d000708849f523e5a3bce1a15725ed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4727c68864704c0622311941b93f0c1

SHA1
2678ca09b78072b26f4c611ae2d11519f8fbe245

SHA256
594bb98e044bc7871ad73132d64beb4d8b7df7b8205dc6a106a714d245bc4b56

SHA512
4a3a8e364669c799a8fb8818d102f78bb9d95d392221ddf9a19e87060b935192d56bb9b2428f36bce605738a3927bb5b489cc0314cfc814d8d1d7882c31f51d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7d58b73f118e3fc8c3568be9d98980db

SHA1
26a278b2961f2684914a14e94eac6d16e0dfd3fc

SHA256
05ff9c789f148f6247384b61f6cde1266cac336f8ac4d37647bc7f0aebb9aff8

SHA512
2c5bd1fd7f29e35f2dcedea464bc8ca1b515d4f4ca7c8e4b76152a052c122e1b39b64fbe350dce89e39a6e0faa6b059a93605509ac0f846a8e79edaa710b30d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18DE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A2A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit