15d9f05839fd3525ce2ac2ae695f2c4d02ad4b1d2e0175acff30e0449610134e

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6d56884c71ae937a5f87cdf056bb710b_JaffaCakes118.html
Size

3KB
MD5

6d56884c71ae937a5f87cdf056bb710b
SHA1

c90877470abf0e956bea01ec0772284974b19aab
SHA256

15d9f05839fd3525ce2ac2ae695f2c4d02ad4b1d2e0175acff30e0449610134e
SHA512

590335a30794fd55716d33bc74ebfe97b7cf4d0dd356d492e508bc74d3c76e57641495d209679e4264f6e50cc5449f53294f4a74293940453e954ca592b1f0d9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000078c212f29e8d81ab7fc2545dd775edbd1bf379d8d659a063535ea5c025bdbd96000000000e800000000200002000000047ef892d68d63352c99d459df999a14fa23fb0b79da717cb0aafd8bf6769c3a290000000d8cc734e3f30a9be51739bc7ac0390cefb6db2b9a7a83f179c2c06c506d739baa245ad4b08caefdc7863da7645dc20fee016b371cd0e4551aee491c659a20b314fa1c6be298531d897029b6cc0ca5c19d192dd5f12286842781859130cb4bb2d0d3c04e9df5eaadc6ca70d20908c440928f3dbe62af064726d60a8aeb80f76626a3d10ce9bdd86af801c0382108ab4824000000041ef55ecca7738e0ae3d8a9194124f7d57e027e6e6e4a83ea975d24a89b6a8ac741abcf71be4c808949de6f49708aa83170ae5ecf2c4b8e505167cb78a8ad873	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{836EA7D1-1986-11EF-9449-6200E4292AD7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f2115893adda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422686966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005da5e260a537661f5dab3d8f68408e99d8990275c90ac1dae80c7180fbb59e9e000000000e80000000020000200000000b156c91bc953ed3184cce50e6e3bd909b36718e2b215165b63074c16d2b2c4b2000000044b21e657e10df2770fdb4953216f0bcaaa66934ddbb887c3a710ef73846d864400000005f027d909985bd541ac9cc8bc4cccf0f169787fe98310a6789e5bb53a2ec68fbb18bd74179a3f2da896b97daa29680538eada60b7ec76e7696446e6d43c0d448	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1744	2128	iexplore.exe	28
PID 2128 wrote to memory of 1744	2128	iexplore.exe	28
PID 2128 wrote to memory of 1744	2128	iexplore.exe	28
PID 2128 wrote to memory of 1744	2128	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d56884c71ae937a5f87cdf056bb710b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a867dac1237fbe47dc003330697e0cc9

SHA1
eb2389373000f1f414cb184857bd29d693a359ae

SHA256
fecdcb5107179a7206aaa7904ef05beaa690f1e01b08920c48fed5c76061fcf0

SHA512
84229fa3bd45466446609872d7b91c37b198365246e0b40ef0f77a33296b2cce1dc4ea2f6a66add081989eed0e55313741e37ddfe3485519ff4826572f14733e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a755d918e102bea0e4a63e09716689c1

SHA1
735a3e6dcbc85f37e89ec82ca1be494e75a8e1ff

SHA256
d4390806eaf3a42703853bee876dc49302b2f0faa5cc88c82750f0ed9af335a1

SHA512
c51b1fd67660bf2a362ea3b55227fef3b5dbbf3135e6ec226a3a4fa50075ff1d4375adf8f5f45ba793e0a23bf2f3264d05626d062566345d678fcaac3b81052f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a4e4c8d0580a80a87497ce61bd249fd

SHA1
e6cea8e0869c9465afecd6639e12dc6cb814328f

SHA256
9816fe63051d4236697b2f1370ebe874c8586a07b029b195e09a6a06b83ad8e3

SHA512
3c9b3c8887ba54b8be2d863f4477d4f71eaff9f275e23a49ad258edb5746ffe5b2a65c234c78441455f14ad0ad714bb36f0067e278ae2b19fd438dd31bb028b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
304227fc973d9b8654e4cadedf95a965

SHA1
9efaaae950618c88d91b39159c76dd213646a158

SHA256
c94a4670813ebc4dd3c4f674abd18e6eeb2d8ebf6eeae431ed66261554d9e99a

SHA512
21ac54ea009996ec65c475a2d294dbace75f913b1765a5a0e0801fb9f2a3d82a33234887b2bf4bcb250fee7b20516a54426d7cf444f4b2bc9e275f634ee80664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e6a5b9265dc56bcd8cd8d27f189164a

SHA1
950b8c5ad98782c9bcb9dbe497e84d03fa2ca650

SHA256
3b3ecb30756dfa49819dc5d8a3865b5ca554c35d8f57dab9a73f1b143625dfc8

SHA512
c72c774ed3d9f205e1d1cdec799664cf735685ea04a89fe8210646bdc88acb4bf72eb158c7abe284795a3f187cd17e77712fbc5a542f50a9fa6dfc835f993b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e220b8c253df0afd4e06c93a0400b2

SHA1
8c95c369c8f27da340cc974fdd0a432bb5911326

SHA256
5b786e340aa8b7ef050f86bf48d66510bf5caa6f56113da6746316b168ea259e

SHA512
f15952bc586aa9e2d775e1213fa57c91b858d2b24f7a923781774ce906c6830fffd0a70415bf2443b0da085277ad6042f2b27c2eb06ae32f3aba30e837542264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b0de6dcd6316e1f4c08059f6a566a05

SHA1
e714957ff784c752f1a5089586aea18403630234

SHA256
58a7065aa093822bdb45bf07dcd74533cf4ca05ae9e503af03d179e58fbab946

SHA512
500c8ea522bad2b034ee87d0109adca2a86870eb97277562a542b4c80a3c98cf1b76938fa5cca49df270412ae0be83f9db096e704dd6030a7fa0c500bad650d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac059e57a40e2cbbd1814946ba436dd0

SHA1
1b2a29215144491e22f1e5be6c2ea986f85ec966

SHA256
c4a09c54c939e7bc972b28d15ed23ae187347fc92e10d8e8ff3dddcb840efe14

SHA512
ad7e3b4b40f8a7aa52acc7fee4019891e1607444913f784d7610a5706814026cb501f1796f8f63a17df9a6cba8761653fd6c98d55c76a1617b4f0bce8d9a0a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dff6c3412fd4f28b70800a87d1743d1b

SHA1
04cb1a9716c6d987d430ee8fa187694dbbb43f1a

SHA256
1434c409ebc7c605d1676292c18a711700ca0171e289e68be9333eb55cef3bc0

SHA512
5dc7da6f2f3c1791c8448d1a620dc7a83ada594d8fb757b43d89686d56ddc926e906acc87fd57c6ed8293e62dac350ca25e791c86a0817aa549468928657b1b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4d6ccbf6517eb5a941c75aa7ac5fa41

SHA1
6c86e8546ff08af1877d707e241ed14c7698f890

SHA256
3b24907f52af7bae58f61552ef973a448280c5c353317632bb472f395d1c683c

SHA512
45d81a24403c643538544f049c1832ae9b24b591a0fb1c47375f9032c648bdff2121e01d2d786938038b7102fadc78ccdf3608e219ad45d85c23d9cd90519306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df3b9934c48cb98deb89a5dd55c5cd3c

SHA1
9268d704542f8fed07a4f2d958c7884679874598

SHA256
06edc24b252804dfa0be6b4d5d7fb4f8478db3663f7811851d039593c5620078

SHA512
032c0fc2b29af124177ed8c42e793d1c32388cec903653feca318255009531dd2c9cf89d81d0a42bb3f2b9c6ae9d007f7c0fca493de30792f87ffbc6d7fd99f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fa8f940a686b6bd10284e3f5f0dea58

SHA1
909be875e4ba841ae80a82fde94e627c4f1216e3

SHA256
248d0312b83b60950d9f5ca47565cec335a44a61335ce995c43196a33a1ec2c9

SHA512
4e81f4fe794a3816355955784b8b63db6d8523d08cbd52e01ab056fc683d2cb335f79dd45c62dbdc17403eaae09aa4bae056a17d97a8025e107fe6e789924447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e10a5889d4244ae739f0df83570f839

SHA1
09d296643e756bf24344f5175fe9e7d4016aa4b3

SHA256
ca7fd053a909d38efddb4ebbdedc75afc27d8721a1cae73764f7307e87994922

SHA512
3c43c01cf125fe55d5e4aa88bfe7ca1a501dd7732668552ff50d38c50d5fd5df034b4444ef9543480c621d4278a5e56852e2189a7ffea359c13bfb7821881137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2cfe5da1235c78799127222b31309a7

SHA1
3751ee8cacc5dc63e317514b079f31b661fb669b

SHA256
9688510a74c1af7a16903be5098618d98b2841e501d18e1a48f99f19734013e7

SHA512
f08a44554667b5da63e6b99da5a3353915478e16f217419da1c39ccc7f77fbce346aef713deac79d4c738da3c5770042d8e51172a43059573042df41d5101f41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3160.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31C0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit