8617d943a6e2037823a5b432af8aea5112c72d56c1d191a48e09b96195295875

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d4b6d16208d717ed1106b458bd6f9f8_JaffaCakes118.html
Size

25KB
MD5

6d4b6d16208d717ed1106b458bd6f9f8
SHA1

32f63cc1b86be45ce108fc641d27b72ccbaf912a
SHA256

8617d943a6e2037823a5b432af8aea5112c72d56c1d191a48e09b96195295875
SHA512

ce44012cdca8ed9556a6b906a1c46ce57d82230b39b4afded38948206bbfc54fe6a1bf0ebc446c3656079b8a6e4749ea3e24bdd97810faf23dd492fedd9cba32
SSDEEP

768:JXWFzef6C9N1IkJBiE2Yl0Cr/xWOOfn029jGRO/i2sA:JmFzef6C9vByE26WOEn04K2sA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600b144890adda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000042f96e82eeb69a31c91bd0b6ef09d79bc2fa1d04af7cddb81b5c4c6dca8e6a1000000000e800000000200002000000022d2c0a4b12fea1e48116dee1eaddab29590f33fa20a3d07c459de177c670b5190000000ce1b6cbe9a0d766217f3aaf901a955050dfb020be332f42078c4ec3ee50cdf3e758b82d5b8ba39feef36f2ec8943f76fb70b89852884a2a9afd031a423c40701f94603fb1239c609b46af71e5dc162f4588cab0214da012df1832897a334555e166b59b6fc5d06b5b9e800cdf7148426e77cfc271d63a9f8dc5ab4697d1c644fb6f05e680ed0e5edcf832593d7b9f7d340000000248c4c600cc6f14d09e8f4125da8ded07156dcb9ae4f7c23a4e69d5630c61281d35cd40721ca925442bb955c932437459c848b0b20195ee33e6eff9c6ac27de3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ee35c07a8c35a422ed79b581d2de249cb56630733e01272c09612769e2c459bd000000000e80000000020000200000003550d322cc3b9583839333d07a961b05380a9ad9cb78245e26c304e06209530520000000fc44e8b817e21ee4b29d1b1d25f0e360cb3d000d2fa705912d476303a137ddcd400000001cfba3dfd49113e3918d957a60ad1a9b85c5299263b702974bf71627e47ba2aa557bcbd44de6efee71514ddab94b94df55297dbb8981e844b16647b3382831ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{730AE231-1983-11EF-A4C2-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422685651"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2896	1704	iexplore.exe	28
PID 1704 wrote to memory of 2896	1704	iexplore.exe	28
PID 1704 wrote to memory of 2896	1704	iexplore.exe	28
PID 1704 wrote to memory of 2896	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d4b6d16208d717ed1106b458bd6f9f8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac836b441d26e6066056ff7cc2153cef

SHA1
20cb4879a7e35b0ade63d280252b38eb33af88fc

SHA256
6117025a1ce4246e595d6d0cc1b220b7171b720a6ea43455baae971983fa09d7

SHA512
49bcd2978353544dae69d25b2400430dbdb6385f041159933c78a021cf339561736c234342f042aec4a0147f1499eb3a67566bac72102f9e5f8b22bd221d051a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fef5e7c396115962627d83d5e9ee2e8f

SHA1
7ae25401a4bb6360545276fd0c46546c0c83c25f

SHA256
343f31ba8975e8b497a9cc4d9d4d97b1795feec625650434545058b2765f5251

SHA512
d178f56d16a3b82f450d24919f73d74316cb39a93213028dab5ec3cc5321b86d29ac4057acd6273cc30459cc5ffcc87ce4e062c408e0284b53aaefef1fce7532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da97fb7a946d6975a649ec36ce85fade

SHA1
9e0aaf46e6b852ee4ef2fe9e5dd5426e3a4846ac

SHA256
c3ac0cffb7a09931bac10d300be868efd21c40cca5addf3d7c9c3e67823eda27

SHA512
a4e33432672d84630ff423ce6566a647b084039bac88a9435b4f7c43653d60f7f3483e62e6d0293cbca3e1a092c41d24c745188105552f852a25dd9cb13b51d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4806590b752f8230197006092d183f8

SHA1
0d6489ae2682fbc79984199df73419b8f697525c

SHA256
90ad26c577330f72795f73b6f4cb9c121a16651a5515285395b714e5277d2adc

SHA512
360a0fe3b6abdd55cd9a8a11fd616791f4a86b431ef9da3f0c161b425a529484b81c42fa32a94f3d969786cba9c86984d3646a3cf660376b1ceaa51b51c996c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d889a761950aeb9fae97c509671cb53

SHA1
c8ba7a59acd57c109d5a411c2e9a33eb70afd070

SHA256
c5e0e5a3cde922cc566c77c858f0635333dcccd844c174e5f5189673a271ddc4

SHA512
3d8e1c3769cb3a70e7511c815e1c7083966fbe9201550983ad3929f4547df10c27c8435bb0586157cbd1443dbcd779239f5d6cbd29ee07ce5090a133721f20fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26ff602c88006a996a8b58a819a5e7d1

SHA1
daf3f664729e0f39ad19ec7b35996a0a62d15e24

SHA256
4679b67db48b36c2cf14a2b771cba74d5e57c4c6d6561dc793d99e444f00dbf2

SHA512
7f8f01551c1b148e3a94fcb7656021c6dd86bc5e5a6554a4f163d928a12c20e6eaeccd5544fd0b9f2ee1f5f45dc4fc57fc9f229d098a1f0a5328b50a2ac1cf43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4049b6c9179b3d7665200c572faebd89

SHA1
2a2b802c8d56aea87fcff3cf5358f02cedb4c41d

SHA256
9bd15870faa71a4028a03abb967340d2890b181ed3923ed562e9bcac76074d3a

SHA512
9e3d46c3a99c02e033c96cf83eb7c08818edac35dd62f87eface0a5f96d242bf2ca6579fb22cb43fe7dd5192b353176ea841948ac85bfbdbddb5c9ec02e7d950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0900b828c19467eefdcf7cf5e642a864

SHA1
6ed167216507ef4278fc139a3e41ca55b8650331

SHA256
5b910fcf8cd8aa1a7b9e63f9c80ef5c96db024be3f14e5115d11aa3ecc84d4c4

SHA512
9d31a1ed7db5ad5512030a01258b315015d0a40f0ddf3a0a6136952ab43e711bdd34389bce9bcee590c71597e43e59514d792211b105c76867b361e02ba52c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e187a1e9d1503f48138809ff6539d1e3

SHA1
85ce7230378742c2a199154ab98eb5e545afe2ef

SHA256
3e56d2c3940eb3799bd4151f69a6ab736863cfcd29fa3b43d85269b6a775a814

SHA512
5c5dd1f389bec17168abf8bba85c35193d40b1a8e7b9128f0bcc579bdbec8a590416146ae2c381db9dbfceeb06f0fea54bfded796f1b0c9e00e850cf5df48b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e09166a274c39612b2100964d264ab29

SHA1
0e8dca2dcf8aff7aa204b6c32984e5fcb0a68fb0

SHA256
15457af242ad46bc56358b578c4df4d6a4e56f681f0724c41e5f24df3b3ac3c3

SHA512
71ed9a23e399aa6d255506ad7db67685b8032b5cf20bb1069f02397da5046f34d640576dee58687aa71e2adcc242f85f563e3ba2ff5446e05b915c3f064a218b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae8bf7c7de58ae10f47fd66013d0159

SHA1
32587420b1fae358919cedf91bb8a77067b9b382

SHA256
80734ba2de8e32f9243094828900384076a26d88a305a3fe8d56877c48c1677c

SHA512
7298defe41827abb0246e969fed2ceb4881648224dd019f84989da116e54e12b24b326a1e6c7d333a5ad2f26d1eeedb1d1b132dd84638bd9457bb4709aa7197b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e4225f94456225350de63a2732c66e0

SHA1
52f96037e14529b85e9541638e2b23f0119ce096

SHA256
ab4eebdcc87b089066584697b622455abb01dab1a28f16703767d3ceaa23ad55

SHA512
74ca2b21ebb72d97a57003ccfcd9328b277fb3fdccf1648127bf300d24d8e1c32adb99f2cfbad4cc9a5fe276e7a82baf925be921c78afd653c2176aa9898b1cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
182756280302014ba5a795c81a74027c

SHA1
453dff94225717e6ae4fe4d52b89062112c1b8b6

SHA256
22733fecf03bce72c2f2973d49c25ad6ec4137800f3650818128943bfebf0f34

SHA512
6206924ddb180983f5b8db4c5b7361e1ca0258811fe6022182208644a0479317209e215548d22e6d0180e7cfa3efee2940dea9380f3c17b839a15011a83e8a09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3556.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3568.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit