9446b6b093835418434104bd133e8978fa390bd9ea4a70bcf957a82aafceb228

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d85e17bee7eec7b28c9c2a262cce0be_JaffaCakes118.html
Size

254B
MD5

6d85e17bee7eec7b28c9c2a262cce0be
SHA1

f00cd99e859e25ddbfd4988c1132ad6ba6e606c5
SHA256

9446b6b093835418434104bd133e8978fa390bd9ea4a70bcf957a82aafceb228
SHA512

241c1e460f515a130e4cef866907eec19659c6ac684dda1af1fc371a73fca385a9f898af1c38091acc1e8c62307b47e8960174d7405d99adac0e91efed932831

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422691994"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b8c3fcffdafc12582efb46de18155e890a5b90e40f81c45157eba8a924178c34000000000e8000000002000020000000386c3408099d434b86726b515a667ea82141a8d4e8c60bd3e60c23012f634cd490000000f0e3d436cec364366c886da8d147bbde0c1fc56cfb08743347f9ec2aa3c6cbf47bebb1771059989df60302ee578467040505e0fbaf9bfdfd7598b084f9a18b70240f3fcc1efef6b546b32d553da06aa885d61bb98e9b1d598d6668ddc30d8b50561a5a11a212a49b78289fd0cb5dcce6c747c77dcd1e1689f2d51d43d381a3b818cf0b035c858ed2835e5825a4c4ca9940000000b0292ebf32bf437035f9245a8d981ad264a2ce365762c1c44a33bcd07f30fa9adf91d9eae3934fa33580a39761c895e997370f96c45a07153f1b248df320f782	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005e806c3dc97cab65e2b6bfd88e29a6d23fcf878fc98ec63190d718d78abe51a7000000000e80000000020000200000002546bf4a7d3bc68d8aada891f05dd94eb9efdfeee06320536a852007cfc08d8a20000000a6cef2c0552a3b9b87d4637b40bc1787b66a73a478db279a44d0033b89204d3540000000e17807f5d8a09c16eaf35c22d5d8641106733094b2e2466b0a1ccebb59018e8d9bb88823b5182fad70861df60cf20bdf8b3db4efb387f4828863c5c29a1e0dbb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9009d60c9fadda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3858F3C1-1992-11EF-A48B-4635F953E0C8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3016	2884	iexplore.exe	28
PID 2884 wrote to memory of 3016	2884	iexplore.exe	28
PID 2884 wrote to memory of 3016	2884	iexplore.exe	28
PID 2884 wrote to memory of 3016	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d85e17bee7eec7b28c9c2a262cce0be_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6ee80440d1f72b8b7e96605008914cd

SHA1
e8da001c6443cbf63c1a0b97d0c058469ba588ad

SHA256
12a234e01c530a6322b5b853c70e7a8fc705139a46599e2739b5dfd4b55e5c84

SHA512
df0d119eefe0ab33542d139133c653c8130cb0258af328deed9b1de22862645169e15973a15ad81b3d42586ad835c016fcc995b68b2ee3a42ce7a926a68c5217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
003db809ae9ebca6ba31cbd3eac5b6b6

SHA1
699b8771376478a7653b545bd856897d3bf62472

SHA256
7747aa0106d8590b0fe1f43c101076e017a7fabfaf2445849185ac576e0743ff

SHA512
dcf3f16a0cb8e740d1586ad30909f2b74e58a7878e1e5c7b8eb9fe5857edf6a5fee1f00dd4d4bd966aa09cc7ef1e1f893d7d87933b66f4ed96fbb7219b5c1701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0049d734d06a3f461c35fb6667ff41b7

SHA1
de7b786c38716507165d33417a75d4291223a617

SHA256
26fcdbc0e55d8ab7d52755b88bbb7fb1510f0355f6d3cf8df4c4cb8a9838c037

SHA512
9a86bb6c17d2f2a8019bf2f62c21c2ead75ec5852e941703b906df57cdf944facc616178672db5ea1fb2b8ae20789e0fddc5e55d2e8479a4fefe512eb288b201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dcbebb38ce38f0908f9094486616078

SHA1
7ac7d44ed2d407fb9612f041f0bedc829dce59a3

SHA256
15a64811986f7b4802ff5bfa82cf2ae7922e5bb247cdb7e8dafe00b6e1f03316

SHA512
c04d4de6a1345737ca7994227b3c10ad580c7238de6bced82aa9e3f9cb54a6536bd9ef42959516aff32f7b68ca6adc9f08b0889ed65c1ac6d84b6c404df8e4cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70f8d54605250fd0bea3254f658c5b9a

SHA1
7d688e07c44a813a816b420d19bf426ab0aee54a

SHA256
0aa720cb589922f6476175f6090d7252e54274197a5383a5577c0d122b8dd23a

SHA512
de293870e46a8af3f182aa5dc225a9c404ac875f0b1d7b81d29d8a3ff29bc73760a04285c3f543dea17d39060e06cc384d6386c4dccffd49b3e1be477c2778a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1019b839f9c0aaf5decd52bde1cd711

SHA1
3a665c08b07c2a6d48ffd0752dbd55ec593b334b

SHA256
e0c6f2b731bd8936fac686cbc3621e8a28b657688c91a59bbc0853bac270e529

SHA512
193deb971878bca66f8aa338ee94136b5083f3b4b0c2c997d0516651f00e615525cf055a2de2662f7e0d5236931a13d9b50cb860624e41466fbac2464015f7f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46fd7caff51726111e0880d960f0ba8f

SHA1
026990a6a6068375f61310ad0405a1733c8031cd

SHA256
b0468def032346d60fa5e8e8be320f70e405c6d96dfd77415ad0176a0ae25c7e

SHA512
0fc1901dd1e5e33c1612b42ba8b9928d6698fe591af3c377ed5d21151aa68077c6c7187c45fae41e8611f095bd8916647f2f229994fdce6d915cc4a2b90d2658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07d4fbd0eb561603a91a2ed07b665c51

SHA1
7aa66109513fc208743bf2b7081107aedebeb69d

SHA256
38b634e991b3798c960c19f54b064272c0f09cfe530d55cc5a04ed6cc1b84f2b

SHA512
d8ce4599c7e45da1dab267b4720b752f950808a0972b84badc325497298fce56e414d40992f71862bece736d84b2bdecaeb1c41c3a4152793846ac23f5536549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7d5360315a79acbe278ffd0419438be

SHA1
fa00129334cb33874655da9b0feab124c0ed011c

SHA256
808758fac6c705dbdceec3e83977612f92526d8630d2aacdb7b96326c44101fa

SHA512
205526d4f93ee28349fcac9dce814880e827d024d2b430d4012eaa4b08b9b93ed5768dd4f145d0caa21b8f85b6448feabab1415e61ffc35ac564876438e26a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
638be6ff7a2ad609c17e55e7fa6d2d8b

SHA1
d568bab647179df1c8d127685817b5094e69d244

SHA256
6ad415f8fdb519896657bc37de766758c15ad03fc107f4a4b357e44e18c8c7bb

SHA512
c4e89947a7c9b65f43ee066a532453f223fd836cffc1f362f8fdd4e791fc4bfa4e0c0d7507eb36120de125eb08818178091ae03b5bceac8a7a78e0b48c16be63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9665bfff5f09e19466da89496aa1da44

SHA1
e7b83743bb657e6e2b91ef6c11c286ec44f223ec

SHA256
dd903a6e3c478943a7c856aa4b52f093e8f4c9a1ddd193ee9dcb340fedf3a603

SHA512
21b686c6006beb00fa85baae5bda30ac34cbee8f91600ea9e1c5ecc1905da69ecae322e7c537731c6c9773e254a6703e690873bb2514be9212aa475569baa17b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d6b999cbe4e729f0aa66436437bfa7a

SHA1
e9892569fff344ed4d4d793b5bfe9b20116e2e44

SHA256
30e1d5b3765152aee4fa690f3576075ccd39d4c526722bca2ac5783af8759299

SHA512
0627a75a49ae2999ae1479830b3c30933d5ff975aac59f81ea5a7c0c45e1a21fc85f0fd67b2d8b00ea2dddfb0abc1fdb5320c22bb385208a6d4686a37a319a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aecf6f6b9b32937056b801e3f70ed9e

SHA1
ad0085722ebb2ef5b02b5c151627ecb1e28646d5

SHA256
9d3d5211e69dd663f87e67880b91ac5c9e341766844e1f0df489855d83946bd9

SHA512
508d70e15437346db331ad4f3f4e50580fba7fcd039f38757955ad1e235ee8440a7e394a50bb0fbfb3e8543909b048a5d1cc9bb54398d262c0cb6996654ce4f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c419c690b3a4829ec03e0e5c119aa0ee

SHA1
39159cf32572aaef8f0440c466b9f8e818bf2c8f

SHA256
346a0d9c343813ca291e9a23eabcf73c0a381f29bc298d5d254c77a41cc2511b

SHA512
c859070c9a967b885d78a6381405ba5d3aa8f8245b66b9b7da5a774e52033f1e53e74a2b93cf206e09d0daab7fa9d408a63427f64868339f508b982f05323831

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1046207cfb437498e46ac20356dd30e

SHA1
1dbcdb135b2004606704dbfa7fbc3b083ebfdaf9

SHA256
c122836f2027eaca9a5940b6f95a25c6d017e178a383890e1611631a278fa702

SHA512
06d7390e5cfd55d75783318f922af2e98da0b966dbc1e4a974fab1e39872b0276399cf17c5508573eb2e9709dfb45f9e73fd95cd1d9994740fd93a5268d28017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
660e8891faf99c8dcb873fe6a9ff444f

SHA1
22c360e18caa740c038fb9898d936883a4387fc9

SHA256
214e1663d2b9f7d76cb58963485334f0dfba51ab65fdbdafaf41c2bf0d78bf1b

SHA512
e4dbaf3fc9b3525a4d97d6befe96d41ce70abe31cfb22592bbbe15a0c88264e188d4884f5b3c4f804e24d519b14dd0ad0036695464893fdccb53941abefa23e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25E9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar264C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit