b13b893a22aadf070116f55a5c925dbf78b385e130f16332a45de10c45bcdf22

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6edbb62de176b6905772edd7e28a8f9a_JaffaCakes118.html
Size

254B
MD5

6edbb62de176b6905772edd7e28a8f9a
SHA1

497ed1421430f734a7817d7ab1aa7a11c0c97996
SHA256

b13b893a22aadf070116f55a5c925dbf78b385e130f16332a45de10c45bcdf22
SHA512

e000627cb1a87cf97bc26a9d6d0ec2cb609024f6ab46af9536f3ae6ceda93f7d372858c23fe36831a25b3ed85558a9d757e351ef89465f44a3915cdb7a453b28

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422723389"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000063b345178bdfc243aa252a429b9819330000000002000000000010660000000100002000000026c81c6f4daa6cf508d62a3e9a92a9de49866ac47551fece67a5b86a66cc82bd000000000e8000000002000020000000dedec9dbf34d6fa0ff749c3019f144ad58ef3a36e0d6013384b03a6bbed2d03c90000000881e1874d7d4dd42da4626699cd1bfade1839627a7df294c43e8d0bf5033f8b2a8ee57df81ae29dcc16831aab0f617165b9fd5aa18aa0890d991ababc14b6e7f8a78bd77327f57c98aab5e4973bec2cee4dee88d0ff42e44c93cd8e9d997f58158ae10bc6da2b8ff4bd145176bc834a3547ffd7d21b09a781ea67eeb346d1bd89dc22d40aceb70c44a7392a569fcd70a400000003266a9ec30f318657a2ef34e8e93e292c0ccf594f86b4617f663c8050af2404d04708ae3974bdd8232fc77b4e0ce270acf9176d33c01cf457159f17d450cec43	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F3ADA61-19DB-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ff2724e8adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000063b345178bdfc243aa252a429b98193300000000020000000000106600000001000020000000e9b55f01bacefa108801492308702d182cd2f5bf6a8967dc032bd8a8a51b27dc000000000e8000000002000020000000f37f555d4cd00a3d7937799097a5cec1a95bdb34ef2bbeca07cb15085f979e3420000000a61d7cf3daf60553a041f2c7ed2fde7d1d221c66a310341ec46d5669f630dbe8400000009ed6b4a3884ed517bea3dfcf65580a125172543f3784bc49edbe52d9cc65a7b731ebce29b775c217785d784221bc551f2f70e2c8258a63fed6c70ddbea3921e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2904	2504	iexplore.exe	28
PID 2504 wrote to memory of 2904	2504	iexplore.exe	28
PID 2504 wrote to memory of 2904	2504	iexplore.exe	28
PID 2504 wrote to memory of 2904	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6edbb62de176b6905772edd7e28a8f9a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a9ff418d7f978b9eb198918fbe9543a8

SHA1
7f3741ced6efff825f9dab6e35fd245e74bd6181

SHA256
9cd8fbac46487850753ec0b0e11fab675ec3a65dfed3142907acf345330e1532

SHA512
d38306339ab0b04cdec63377aefa1ca6eae7b9d3b2be699d7dd68d9a5ef9a46fd7f2767cb26cf5c697bea2a2558c0dd935b98fe8cf85b35c9b27d14b371fda2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6d0a83a30006881817300f09923bf5c7

SHA1
2a6c85fd23c050181cf1bb70d17c8f3605d248f1

SHA256
d4b3f836804fdf41012c6c0a8113cbf1616898864365d93845a70f0e68afe344

SHA512
68e5229fe382baafac17d11303294214df1584fca74b57a94a1aa5cae5d0c8529a90a2facf882c772d95243b59f12c4edf216ccf009313bd5495260ebbd54bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
888d5fd8bd3b3b99adff988d6bc84964

SHA1
6506d73af36370f55dd38cdbed3baa2707bb7b0b

SHA256
69443339192690e40ee8cd31312c46e603860634be01aef1f8d66fbcb40f27bf

SHA512
2a203bcc4be430e2c97661c4269b9956ce557fd20c6c3eb871e9e8b770641904c4fa2329851f44ebaa44dc0fe571e3c8cf686c54181b8e6896c60f572398a50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0f4c70c706c1d23088141acd2a7e0c1b

SHA1
b6538d87e4806e580b8cbbf838c8a2bdd9d710ae

SHA256
d67bde851b574456cacf77e37a9a8ae24013a360748756a88f10fb52548aecf2

SHA512
6a12bf76f705856a6dcd3b5df130fdac4e7c76dd42139729cc9180266d8b8d90097b2631a69a0277da2ee537cb3a8355055d9ced644a5bfdad457ab9a505da18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f2eecf901772b65ed96370c63bb79284

SHA1
dac3f73b9b79a0dafe94053e344647d5e0ad8ecd

SHA256
8ca6a28e92aa7adc3ffd980d4c519bbc0229430c43418f2d9b2adbf02ddfd36d

SHA512
3e0a0767866177745f03af7d6457e12f9ee28749d1b394c25a223e7b6ab1c3e153b5a86c6f2eba0fdcab70abd57b7492ccbb3142b6dc7a5393ad9cb72839952a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0d2adee9eb2e792b73c38a577a2d2681

SHA1
93d2e5d248e0b6fa627e303045d89ce391c6890a

SHA256
5f107f90de984b9952a776f6f7d66f373937ed92299ea46c02c497bf1b49918e

SHA512
81d37e9a354a73dd3764017273bc1b83436dc89aa595fc8c8b38c47295cefb0a54d0af1ca5917f4b663e44d4479c3aa85be8b1e51acfbea33d9b2f4c5030042a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
751b708751e2933c5af1864d632aab7b

SHA1
c9dc7cbf278d57f21e3e9baed15c115423af2b4f

SHA256
4fff97e64e8993dc1c5e888b457503a68514d5d642ee3c551d12cfc930c14d67

SHA512
fceaae340db3bf5b97e0c167e3adaed6ac968f9e6ae439dfb2502544bfb0abefbf43ba0a9c1a61881b5643c410018520dce1b0ef753fc1858c8bf9b738088207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
10399137170fb5c8f4f01bb86ac81454

SHA1
bbd997bf730236e52c291296c232b7656a6a2b99

SHA256
c6669ba9363908b67238633cd27041328a7840409c9661810b0e4943446c6bf7

SHA512
9878573cc62c2c252be38b9084782ebb2a46bad7bc7063435b8d27ad0385f41dcec036e0414a4a5bf93aa33bc5dbbc6eb728bb3f1088cdee7c29079448927a93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
79bfb6bed05e2fc6058042df8a5ae022

SHA1
53b8f5c189e477d88783db716a04d905d5efccef

SHA256
08ef1308e47ab11000f8214c852fd08f8148f9b250c8bfb97ae0ebd761a4d5e5

SHA512
f6c4379490bd3a89ad32a0b5bafc0d104400048fc96daa9aa313bee61b2ff7ea2d1d6fdd77911671ef911279a43cc251921507e3fb651d8e19fb1d573be4696b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
56e4e9597ce04019bbbbbc6789740441

SHA1
fe9fddec041955bbe8d05b2df1a7089a41c65e73

SHA256
bf98b9896289db59a165c7f6b49c0833fb0fb7857541f61482066a95aa076ffe

SHA512
eff71a9dbb0f8c1c94bafe7f4b8bcb4c0afc98f0cab815031d2f38fe3d665745b9b70257ca6358a5a56009b67181ffbe1e2fd98a5f678a8ff162da31ba40ec98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
63362dc20c86fe3ec82f27a300455dc3

SHA1
b4dc705fe051881962ac4671c64e48762b6ad5dd

SHA256
5ad97cb6989f1bcabf9733155dfe1a367da14be6932e7c1af79f4a48502630b7

SHA512
8a542b6f35cc0e4fab8fe35c18490831c545e758bb4b721642bc6dd5ae62aa9af2febec5dd59f12a3c93212c76c984691650aceecd0cde61bdb48c35defacfa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4181cc33d45cc6ec79b5517f668f5992

SHA1
611febbb2c8f2d333b04bd01afe7a4542117d464

SHA256
f19ddeea882ee840d6efe11628a13f25a144221b5021b689cd6797c152ee347c

SHA512
6cc7e82c6a19ecb6d70bc9b45c4973280ab04ba09154ad905619c0997fb1c832cb53d0a22fc443c24e969249e1e2d8680cd702c0feb7ed0d3336c8188c1e3a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6665f52d5dba5751049192f7c8e686ab

SHA1
b814c2bbfcc5a60a13f6500d63d52ac5099d5393

SHA256
4610080c8f2f360440704de073447dbd5d2c5a3b1563fa4d9c53a67ef99e52b3

SHA512
065a6a8316b5d01ee3ea2912e22d65712611f6783f37b059dc70dc18db7df3f51eed9c4cdadcd4660a0e53e43a81b29ebb2fa3856bf6329990d8d4a8128ec36e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
87b0cfcbd407b540f771088423b0662a

SHA1
abb98ef8a77f8120cf1474aa0feca6342e2a31b8

SHA256
8d6dd389e3a10850e564867124fb9ea0b424d69fe1304ac0579beffc2a5f70a3

SHA512
d34916147806b548a8534f83de9d67bba3bc1e2f11557aac72b975ede93f8effdda5eae4821be0febceb9d19309866d9a1d15a1686fa6a061bf46a1ab09d2f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e3b0eee92c7eb671a9eeed2a7d2264ec

SHA1
36bc69820b1530e4bf36b040c21f06b982f27f06

SHA256
e3bad8466a9a149b1e41d0ebbb1b53fb05e4464afddaa33e8115e3978aa1d081

SHA512
37cf00410ea4602d614d7c4bb29945b7fa7636de6c2bfef3d3b3292e13e9e1608f7034805dadf8f4c15eaff750bf8a01f4a01a04e09483c8f23702202dfec6d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6d8d7ec8c38fb1c2a6461aeb37864747

SHA1
f85ee964eb2d55b3da073779915f1bb14f1afe1a

SHA256
dacb65edb37b9d6a2913dc241ee899c35c06fd915a7e4f3f654f44b01984f72b

SHA512
e6e097232e20b2056725381e3ea4b278f194ba5a9cee6f37ed2f23319e7fa02d0d1731d35f5de99aa803abe94b91af05d1ffe9a98699024f8e0c6bc0fdc12f55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
93a8487c69826a7e723a714ae102e8e1

SHA1
faf6ca41d5fff4d919dc01c9b36c7f2a71381311

SHA256
22438e8a1019082adafb250f3d5d912066bf4ecc854da8cd366b37c33cc7db13

SHA512
badcb8ca0cd04adbe26f74e7d540926bb0e19e5525b868df3e6770f5c0fc153d1ac51ff90ae1b90de205755dfe88a71a947fe8d2a0bda944e4f2aed64e31ed2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1C4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB2D5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit