654e7953b6480a18580c17fb798d34c7272fac4259bdf98985f4491280e1f3f4

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e83daa06e01edda3ba7af012b85054b_JaffaCakes118.html
Size

2KB
MD5

6e83daa06e01edda3ba7af012b85054b
SHA1

3ef6b605ab89fe54515f036507abaf52e4253b02
SHA256

654e7953b6480a18580c17fb798d34c7272fac4259bdf98985f4491280e1f3f4
SHA512

b7999ed5ae4fe157bd963bd84d5ef26a4bcb4960811422c227e8c77da179184317d5874bf1d48f6e319bc85e6d26658bb6893dae9748e0913cb999869b76ea4a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0480b8cd5adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000058c9f153e26931671c8f04854bda6a3b3609e37d202948980b1aa654d21be461000000000e800000000200002000000059772acad890d8add0e3d96e25cbdfd1e30f08e6ecafe7c9a4960c4d490457ce200000007fa932c9996face7b6e5b41c4e2a33c3d378aa4a20ba46b1a6d9909cf9c77ee2400000008f4aed64448a99ce91a3ace0b137f5f5ac878cd182b13ce3afd5970ed1239255e59bf76f67357aadd60ad3954d803bb8b4d086d2ce9ed74cd0e74ae58bebabc8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000011d336cdf680a8b15c4f8ef2726c9f310e07c391dc08f1ef1c3239c6b359cc46000000000e8000000002000020000000869b765333b847ae25f63b3ed887d08805a2ee0fe06a5eb1b82aa4964353e63f90000000950642516f59b6a6c4a47fe245edf605423ae61acd2f3c58b0bfb7b87547f2b3d40feca7f32b28c18a1da49aaa04ebbfa0febde73d8938772afde6d6294e3447675350a3332a17c4c82e786d3eb1b29cb4e78a6d8638c916d41d2c24cfbe9d7c8a4d126e5bd5fa3104043739a2bd7c3b97fb8fc8a9d7a64903955bb874126e8e41f33a12079f4cf0446c24f8e2e049a44000000028fa86e3208171de67701447673a4580457024d49d52f8a67ff47b6c43bf8499e3b9ec98d5bbf367fdc2c10b161fda813c3463cb5d6f9927fad82d352bae90b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422715410"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B76DCA11-19C8-11EF-818F-FAB46556C0ED} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1768	iexplore.exe
1768	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2172	1768	iexplore.exe	28
PID 1768 wrote to memory of 2172	1768	iexplore.exe	28
PID 1768 wrote to memory of 2172	1768	iexplore.exe	28
PID 1768 wrote to memory of 2172	1768	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e83daa06e01edda3ba7af012b85054b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf5983630a6d3a7f5e1524b7d08d57f9

SHA1
3dabdf50f6281bd8fea7df6c58899cee7038c9af

SHA256
f3e41110d154d904603e3a8c45184170b806ba299e42a39dcd9363bfa37cbff1

SHA512
a5478c160bad29add6003d338b35e4087e59ac42cf311fe22429b0196eaa586abd77908da7bb8ce7422ebaf9874acbe5526b20d57a15d3938a7a142d341fb719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0f052f21fa00a56ce6eab808de2b247

SHA1
d561247457e98373267b3da3fad4c7361da25cee

SHA256
1d09e11e962aeb64d7e85025f925c37ee72a1da9e2a302192fe8b8fc59ac13cb

SHA512
af98112c376375c4808bca28ad35016487e44d44d7334fb071f06da45fc0dc619fcf66b5379d73961e309660f1a086e6e54d0008511fcc9a3cbd7b6dc4e3cb0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4bbc4c4eec6067f334aced2d92b0880

SHA1
608ce88efffbe61d7a5727852714cebc6376bed8

SHA256
d1dccad76a1f6a2eec5864e2efd72f0bc12db48efd621293e730e8bbeb20831d

SHA512
99201ce839147f5a4e5f25b4b8e7a7f29ae449975b39bfd714dfbdefd9566134bf2ce3ee735175ec9cc223d0eb0a8a27823bace9ac4a7dc50a38bdc4db486c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4be8efff4b2f48c4b08ea9c9cbe0f5bd

SHA1
eacf84e99dbb9fcd73c8154c6f7dd747acf10a02

SHA256
a9af08e379f67d1330ce486f271e3f68669622768ecf2a08b2f96619994c2e45

SHA512
861376d4fbcf4c215b18ce98184252aa2a24f272bfffc797686c36a8c726f5ace1265b96c4c0c1b6e24ba7662859e412586335f9cc485e516fc45e955aa203cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e9250eacb944d0a8b5199fd8cdaf06

SHA1
7dd22d6740a3924289311d9c0bbe2e882b50f6b7

SHA256
7e1e1bd76987f470064b331e03091cd2db5e7de894c8cc6351d4e44f49aaa2b2

SHA512
abe2dbb46b699f26790f28eb17c703662882df14d4dec73144e920227a02f002d71c1eb85069a6e70b56f469b3f7b5db49403f353c0e888447809fcba78fdf0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6ba02a1892792b72b007c3ee406bec9

SHA1
790bbdb46b44a80ce9120bedc22ecdd98880b53f

SHA256
e31858d36727324d73102151bfde402b44f2fc8ae17552fd6e5e9e44889cdf69

SHA512
831aa7c113fb21b8c41505151efefcb4131048bb15eb9ea76c6d657cba47e97531772ced887293c2d9d8e10e417b36a57a62fb0d91a1449d21578d1fefd8cae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ec3cbf1fde179c7f25b6ee65733a5e6

SHA1
f132f912c6926bf76aa4acfddf69d39774434af8

SHA256
4613f8694476669c8aaadffbc3a404b1fff0cf58cb5276bdd144bcc7e0ce9719

SHA512
99629f38996aca561d5896770454759044245b37bac30a7cc0dda2168f5ccaa9203c16a42531af8277c09d8c232a04d0cf700cb0fd3a7871ac90a6b19b60044c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44a7ec3ba51acf15c5669fcfa0c16d95

SHA1
ab0628bdf1b2ff68cae85dea359c6c615e67c5e6

SHA256
736948c26b55daea73ce6dcc54d32debb484e2780326a2277675eef7c2c2f188

SHA512
5295d908f24d97a9659ef87c4b35fab38be4979e607409203a1bfb73ab906740948cc0310b051d137d122626ed5c6e1ce66bf73e09e13d6692d269eaa1fe3605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dd6c6fa7c78909d7436e761194dc40d

SHA1
e042a5b32e6266c2bbaa91dd8067521c61759e9b

SHA256
3ace7a90d502001d7e8fbbe720c55dfa53604c6fc1857cb28c680c7aeaeff9f2

SHA512
c795fc056fc5f59a426f955070fd1424cd62110f70ce0827c516b0bc9ace3dc464d68fef5e463a70bfd602fdb833a27272cba7296347b04a640bce44f3a4fa20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
333bb50e6c802bebf3027ee9c521c461

SHA1
d6b97436fede157bbb00579b44df66b22ac14528

SHA256
4ad4379b97f7e79a887747ded983c4a61c07dabc8b53fb93e56fee16426d9f66

SHA512
315194310209ee04a0c93ed0cbb1b0bef9731d7ab927dd6dde8ac26281cc9b912b7487b3abc451ace59b1afbe8cbde04f6bb426b717df3fbaa4a987031abc14f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
588d20d6c817fd5c66653c03266feaae

SHA1
523aec5f42771c7a16680707786176ac205e1c69

SHA256
67ff4e6d919bc0a569bc7d1a20354123b01bd1c8a35883f1a8df255f5394bcbd

SHA512
c1a1e4a28afb71d68fc78662ae5d56b2a7fa30437f85f589f3b05a456da60526bc15d336e42f9a3bcc060f999dceb6563e0377df2c9b12aa16cea2fc9dc2f9ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be251edf0a91b21e67bb3fbde09af946

SHA1
0930eda5a8b5f4113e1fd6f675a11117124ddc18

SHA256
7f60b071c7cb110683125a347acb974278d74aec5ba84f4b0d824392cd757c50

SHA512
512e922cb408d70a77656b3a3ff1664ba41562bc738146e4fda3816eb25d0c467816aded76a5782bf21e4a188fec4cd0aff9c395e922ea2c8b63d3345eb3060b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d250818a228247cd4616e3538743d98e

SHA1
2ccb1e855b2c2200ca3b241cc893602ee466d96b

SHA256
5f543223f17dcc46a774712d00f6234293ee540c2105fc3529ad3d74bf9ddbb7

SHA512
fec11a55b2ccd695500a4e6b60d622db049094a18f7ded71c201c3c50bde9a4df190460cf36128fa3783313421552d4b231aec0df6d89c9eaa24f54b60ec3fe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24da1b128847709696cb7bfce1878961

SHA1
3dfd26a8bd05689e829bb2bb838319129af75615

SHA256
f0e75772b1d92f5e377dfe688dd5b979c84bb44e42dd6acd38fbd486aeb647e6

SHA512
6c64993790e2f54346c16d932c9e1e1edeafc86020d5602bb060b61803da7d6fec4d0d4d818d21899d1bf18f6e01512f1ec28bb8f3052c1e40c447c2677ecd7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6762e47f80bf427ea9815fe15e8f3e46

SHA1
77cfb354f35ed04a2b10842bccc16a834328106f

SHA256
d67a2f2944516986e299cdd33c37996fd6ef641a7cf22438f254d35c17dcfd91

SHA512
d650fae9da86e0d45acc8b6355ec3e17d595b6f82599b7aa9cdcda19abf36203520bc68a057a830b260659ae394d17852dd98236ea68c52604164b7ddda6c2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F3E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F8F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit