74b2e8eb6c5449fcc0441bcfdf80784a58b8d643be2d46f284b15103f8a8d7a4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ed785a3b9dd6136bd3f378c6cade747_JaffaCakes118.html
Size

29KB
MD5

6ed785a3b9dd6136bd3f378c6cade747
SHA1

624f1a6bb85ecf075c0207b54f769e64a7952091
SHA256

74b2e8eb6c5449fcc0441bcfdf80784a58b8d643be2d46f284b15103f8a8d7a4
SHA512

c38a8430beb1b4b7f32b10021180aacbdcc7749bbcf859be6f8ebf67762231e52df419299ef82d738a7d8c29ac2b22dad3dce14c1e87574f6db8cd3d738e633d
SSDEEP

192:uWXqb5n8FZnQjxn5Q/HnQie2NneenQOkEntxhnQTbnlnQyMCIAvBuz0EA3KSmdHH:qQ/0m8Xl290e8CTOC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FFEAB01-19DA-11EF-AC1E-72D103486AAB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422723039"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2228	2268	iexplore.exe	28
PID 2268 wrote to memory of 2228	2268	iexplore.exe	28
PID 2268 wrote to memory of 2228	2268	iexplore.exe	28
PID 2268 wrote to memory of 2228	2268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ed785a3b9dd6136bd3f378c6cade747_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5f356d4e371670ba7ec31979c21dc739

SHA1
dc73d96539fb10299cc7301ff075afdb9a03126a

SHA256
4cd21113a1272285494f2427b3f6a07e844c8e7c57ba8a35b88f6ea181c92e2d

SHA512
c129fcf581a02d0be743e1e3b532805440d8c81e2fd9abd71e82042e44ababa09d069bc67541eebc7adca047435a56336c85f216d5b5a89c4de6099e97a8fb98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37646e6cdb78d7a71d96b25961447fd4

SHA1
1b4e7f81befd8c4baf9ca9d1dbdb9846ce67468e

SHA256
894adf45714eaf681be913e5ff9f7a27ef60f5dc3827ead4f8dd11ddb57ea7b9

SHA512
fa5ca8072c8df74ef0acabf907ae9eaa89a5d4edc9700c016b4953382f3a53c9a36178923578f0b5fe51983a60de179a95b8aec09862c7951f0927416edbf88d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
206b54bc50d4c574a901819a7f097ebe

SHA1
d420c4cd0bb5b6e29c8737fa1a371ee104248a4d

SHA256
adae61992f565f9b752a21378b487c62e3d3cc409a87fa7c9b78986e7806bf0f

SHA512
4ff5f1bfd75c33f2cb7a46d7508cb8aee582f8646b94cb6863e81d68bf70cf04e86b472d5826d4199e625d385910dcb4e3e5470a235c8979f0514d992dc38b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f74aae9cedda3684f48541393d81b242

SHA1
b37c7c420b2147a62c67465b40b1db2c84754352

SHA256
dce617f2c8955b872ce38803a67e98fb93199e904548eb2d91aeb4885218098b

SHA512
cbbc79865fa7788d262d4cf1b8dd57eeec3501e4751790eac11e67ac75a1ce6553fee5001c209729f177d114fbbcf60e6e81b72d2e56a6651f14991917de4580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0719c0a305797655b3675027f4263242

SHA1
bdb06b66790c84dc4ef8365e3c3088f7c28f1009

SHA256
8aa4051686480adc3015c099dceb4b4db8e8656891bab1c3dcb5a62e74c4e5d1

SHA512
d59300e86f000385268f1707e2ca64f1157afbc9f1a278141576b3f84afc1e395ff008594e04308b243e851557bf1f4f8297a5f41a729ef3f0625a711711da5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a20808f4c5ee30bbe30c0908ee0fee96

SHA1
44f55dc447762367dc86b0a3809c486ad827707a

SHA256
b59f8fe770926e5c51fc28a6dc87bd21b3d95f3c3488e39acb1a67594c9b8013

SHA512
9410471b0aab32d9a31b1a72c4c05e2bebdde0da30e8d5c6af09b5c1b1f7d88ebe4d13c0a89af60b9bfa73f4346f258440a0d91cabb7704e0537941112b5f0ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56a0649ee5e3dfdc140d55f34a99ad96

SHA1
0b2efa39d283bc2d53638343085644cb4f6091d6

SHA256
455e708706234df567656d7c7eaf071dbf3758e4c3c71f775d8fbbd20d64b746

SHA512
1b46a977d76171e2aff7062e80778f1993a2b1ce02decc8cbdd51e1f0f387b8ad21d51a9f5d1355df790cc14566fa5860301aeffa3ab8445a246666cb1f08e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44eec5e2317afa090806193140e8a261

SHA1
9747efbfce3500c885162ce521b832b6cf5f851b

SHA256
4e3471d4c79566aece29a61ef78b27a3b21e2eab4eec48f8cff3ec9be7ff7491

SHA512
18e31d2c4d9a000457c1afb6aef3f0549809eda14953ef3f09c60ba9e4e16c88e1b2843adcc95a1a81b1857830a277edfa7d203fcab66f7cfd8811996ff0ae70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e6d43e48edc1f71918b4cc19d87f31c

SHA1
e31fa7f3cf5ff587e99228a34e8794c3d7e8a547

SHA256
36d142faf79b28d876ed6424b51985dc77811b916f3a291f58276fbf873a0e2b

SHA512
4d7c03273641f1a208ec035b8ea1e8564836d15d494533ef47d3f6d63d53940938b5a533ca908b1f8e8ee0fc57fc5b85293f3d6e6bdff8fc4afbef874eb2128a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
685047e72b194bf001021b11ac66da15

SHA1
1cd35ce22fa134bfffda3f4c725f121c02ab7ee1

SHA256
afffcd961c4902661710716642811405b48da4fd10595f92f97d0325f4bc43f5

SHA512
1c96f001792cb35336fe86316772e9c712f4a9de2a58a00910ef41ae44f5b9158264014a2168b3010f42afc4e755a7b84fad41913aa11b4aa3ac9ce70820603f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c047cb1eb8ff3a6fe01d5909aa1db8b6

SHA1
d91f452d08a421a22cd9bf035a2984bc0896dd04

SHA256
533db889dbbc245293b461727fb9de177fdd0f3fb0c97d28d790f8928d2a2813

SHA512
412b73d78ae2597b14ea45d511a1ff8c821b32e30f1c5a91ca9ea97408b5ac5f1ff41bc3e9b5b085d7b523758ad4dacc7da68c204b8d2b22a83f6d1a47a0a754

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFCBB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit