70d659f77c67bcd08959cab845eee5cd4d8ac2b0b24fc51008cb080b3e385f80

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ec5baa3e247cc1bb8f6b69d7a520774_JaffaCakes118.html
Size

5KB
MD5

6ec5baa3e247cc1bb8f6b69d7a520774
SHA1

c83c330958ff49e5416c0d41e4cc1b4be3268ffa
SHA256

70d659f77c67bcd08959cab845eee5cd4d8ac2b0b24fc51008cb080b3e385f80
SHA512

56210819b704399f586eed7bc85a0572096e072ddd2bd22e3c758f61345423a1bb3d647de858fa68514e5b11444801ab69d0a919ed71810040fce22d288d3e6b
SSDEEP

96:iqfDcx0PGgngje92fwoGhb/ordlhb/GURNhb/TJnhb/7GMskhb/Ojqdhb/t3Phbg:iqbcx0PGgngje9mhGhTordlhTNRNhTTQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFD82521-19D6-11EF-85B1-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000929e554975d4cb4e8a1357f0bbc19f910000000002000000000010660000000100002000000057bb915f13a87d2bdea3143cba6c493c2ecd21f31116c415261cda3698a0577f000000000e8000000002000020000000437a7397d1be39cfdd676d91bf171799d4d1be3497e9ab7a06caa3f6ff5191da2000000085761ba03e36ba919e69d8b24b97a511a3a1df723948c0c3b38788031fa0dbb74000000039557468065b047e06c98a30737fe22aea4f8b429675e3700ab3e9cd540e9b9608107891fd08fe1f3f570d01614e0f8679775f56b298f2610445d8eab54633c6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005c5694e3adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000929e554975d4cb4e8a1357f0bbc19f9100000000020000000000106600000001000020000000a6bac48ea084d273696905b2cc4c944e64502b4651b7590625b6e9f507cb8a55000000000e800000000200002000000092c86c64bfb80a1f047f38d1e898e706ba5699b03391046e64d5f9b4b0ac756290000000b919d3be22cb10f70c21018a3e8de5430c8cfdbe7ed330d7b55fc9c07f1ef8a90044b59ecc6e64b835549d744573242797bbf12708024020bec01fdab9329eb8d3763309393264e46287de95bb095cc6e0d3cbeccfeca801e006a13a21fe49089643d0e74283ee7d56f74b16af453d38d00e3b69abb8b2bc878539c2f4a7257091b9f5e4295f997ade8bad790500bea4400000007b0f000d292de1ab0c5d90832b8ba6a97a911ceb01177ccc5485fa40ab4c76829f7958fdd668f17d20b5ef77c2091b6ae97e631cab7b435bab531782654aad82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422721428"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2504	2044	iexplore.exe	28
PID 2044 wrote to memory of 2504	2044	iexplore.exe	28
PID 2044 wrote to memory of 2504	2044	iexplore.exe	28
PID 2044 wrote to memory of 2504	2044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ec5baa3e247cc1bb8f6b69d7a520774_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e9ce27166df9556d1755019098c7d78

SHA1
c5adaa9708faf855ad5e886c1cc0dbdb56cf7524

SHA256
2ae9d64c52ed343d1dea20701042e4b0043817d3aad7ebb5da1db0d92a6750f0

SHA512
1b2f1eed34f4d66ac00ada061a9eb7ef6fd71303f3b53a7decc9bb0a1a78c999467a64ef10acf39e5e53bb73cfcf9b963a0ea962dcb654946df66b6379b1af9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4503f9b2ea8d9455515a65d03e35f49a

SHA1
5d6362082543370f2b01202d3cc79191efddcc93

SHA256
bc317c132dc9f3fd2a3c5b86064b28612b5f2a884d996a8a61c0cc81a2cedbaf

SHA512
5c2b48c968a671985adefb89e1849ac66a76682a0476874cee1e958c6d8e1c2b9e88f50b8df2c4fcaab0a43ef91b79d17b2166f83e3032fe472b4031ef2d69ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96f1a994f6b742445e3b033fa35019e0

SHA1
e7279f4f9552fa3fc7f0418c54965e3677d5ee26

SHA256
edc65b3b6f01196039b9ef455444b0075999e5425e4cf1d4e5099e8f68d5651e

SHA512
02e38797e253826babc5be22b2398736127b16140e175374706ee8d53f9a96af50719246da50536d5553ca30d3f23459b5fc65e385fea34f08b56344a827bd14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83dc7d5189d4049a5d6fd2618a2dc2dc

SHA1
fac36a998b586dcf59f37576f87f1b2f9428c599

SHA256
8a6120e6d9d9895cc9038ac9ac59e6dbe3b7e7d272f41c85c1fb3c4b5adaba09

SHA512
b4b2a5b663bda93f9edaf977a3741be28c0c0eb8d832b900839b8f5d1af7934ce07da51725b95a483d52dead6f2c999acba5fc88569f4da9fbe47462b2801a8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a9b149c87f4dbc18031905a1622003f

SHA1
953c12f0df4b686ffd771231031e0707d2ec436f

SHA256
74145c16fd2cf1a28391823d34c88fc0c519523ce278a48692d0973022ebbafb

SHA512
c183b333db567c58788abc75e1705d312cd5e14d8ad267d0d25941ff76a79639e046221ec6a964a1d9cbf313d394dabe82835cf982936f28dce0f3890ccbfa1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3b91dcb6a15445c6bbcc12ea8db5efc

SHA1
8da55e6c2d52bb42b5203342f378b7d68d0d4e23

SHA256
63246f66906f4df94246cc8165b813bb280fa8de37331ea6c380acb0d156c62f

SHA512
040e785e197f6411fe2e34f74addf1f0d714082fa3d875da17a81a1f89579f5088b799e8145a5bb1f7247681e1b6a9e6bbae837e73ec3f77d66055cf7020be05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e86459fb3bca59d5191f7c81871ae304

SHA1
c1ed6ab1de32fb4a927d79d5a52c6eb2b9733a3a

SHA256
4c83e62699fe3589f148f1a8287b49565f0c0d6ee50b159fe5978fd25806ea72

SHA512
4e3c3a8c191a249fc83e4b83a18e18e1214dca7072bf5f8b80b89d69b65fd8e772d0ec214ef623ad5db802185a5c20d772d3407eac8522aef01b326a6756f434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca8f80b22e3c936c8cef3c067f16e815

SHA1
c2faf9ee3d0f72dd99dc36a9be8ecfd2eeec9056

SHA256
cfb7f0c2b6ce305c2a4b5c339c859de8b3afd267db9c1bc905da90f578bdb4ef

SHA512
7f5c829fc567c1d7cdaeed6f8780d5c51d23d38c603a7569d7176931a4256b42e62aa946b1d61d000660f2c83c73f6e7cb9d0c3d74e635768c251f24c0389d9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5906bd90f714a04f4e2da7186f8f73f7

SHA1
26ddb035a81cb9cc55e784897835679f17846ead

SHA256
32a0467c5fc0e150b4795f576f59f28867ce3da390817442b88630099b757578

SHA512
f65ca9630f10bfc5d62c6db39d600d05872a64040810c8446e446a089410f27b6c7f845f57788439993b1d97322b81c8a45144d3b6a940d84eedddc6a089a8cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b901f0ddf9efc443f8922ddcdff6ad35

SHA1
1e5f544ba507874f83c5b4b56d3dbb1b540d50aa

SHA256
9a4a9d9215b95b20d95a877f75d8c338afb36b69a8be0b1765cceed265e47f47

SHA512
da47ba243e96643767b7f7f56ff2ef65709e6fab8814d329533b0c1087f47af9d0b8b982691c902bb6d0a7dea70e6817b2a3dff10a5b830a5cb7ebc1e08c54e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab48D4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F62.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit