3cb181c6314430a627c2b731e2a51cdde96cf014b646a6ad40b6ef54f4170ba9

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6f4bc5cb4dacfe1792aee7a912217973_JaffaCakes118.html
Size

1.0MB
MD5

6f4bc5cb4dacfe1792aee7a912217973
SHA1

3d3ae3b721ac30b4364ab8a783336b31dfaf2eb2
SHA256

3cb181c6314430a627c2b731e2a51cdde96cf014b646a6ad40b6ef54f4170ba9
SHA512

ff7cda18590a3d6195e3068de725d27d2926fc79c627dc5b00b1bd342a54eca51e5966e905dc96fe181fedd5a10976e24c84024cb1b0599f1dc57164b9114357
SSDEEP

6144:vkclS4UQ6Y/JBDRl3LHhFKB/SKbO6/lsE2HG1qxt+GPaqFZV+rW1bW4:vkclhB66BDRl3LqBZ7xq/1n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4FA00A1-19F3-11EF-B904-5A22F41CCA2C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009396573d6448c1dbe0927d35beffd6dedbfd4701329d9b3d067811bb1c22908c000000000e80000000020000200000004adabfd34fe7119d49a6871cb71d577aa1c734acc88cbfb87c1dd4f230438ad69000000019cb405bb7c2cffeece3306119196711f386434f987fcf4c98fca7a8f09f4e92844728d86e5c849c34dc8befdc94c1e95100857c12091d2f67867b01a59d2a83013118742bdbd89c8480d62a14e74c9c1b5089e99f6560b1437c0e519e2a1657b36a82e0d605706fce53f37da7d5ca6719724c60b75a4e6b27690d446071f8c08aa11daba3520511b78e5275325fdcdd400000007c859191c3668f9fd86ab1626b6deb850742ea4042de5da3c4fa59a890bcee9c266cb81b0caa4c7b245b8455681e66326bb84226f6b4cca8019c9e7bdfa9ddda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707be6ac00aeda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422733919"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000060f078353c883f2bf07826f2d4f96785c4183a29a019bb9732d1fafd2017bf9f000000000e8000000002000020000000501bea125944bfce5dbe12936ff7b9f03b136b828b144bdbdc16e36523a98bd1200000007eabe59fd0f1daf6a85071c28a49ec59774db8a822aebbc6cd84483ddb99857440000000a27cf0bafaaae11bbff4cd6360e66f48c13936788f30c1d47d69f46a50e4d8392438903f1e1dd7c08bbb3db5664b721ea758afd57b3eae9f01a33aca577da9e3	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2628	2236	iexplore.exe	28
PID 2236 wrote to memory of 2628	2236	iexplore.exe	28
PID 2236 wrote to memory of 2628	2236	iexplore.exe	28
PID 2236 wrote to memory of 2628	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f4bc5cb4dacfe1792aee7a912217973_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1492af4bab941e50b7ed72070948c62c

SHA1
33517faee63ef7e67f193533f865c25a6d79042c

SHA256
3f8c9ce9124cd73f1f8957581a5664646d25fc12879135090afbe0f913f2c58f

SHA512
d563db2b0f9c48d1d9b8696a91429301507bed863c55102832c912f4679ecddff7d202b285d6078b665bf14cbb2139acaead931cbd4a9d16fedd40bd027a7ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
139a1a0aa82ce5d07e74e4f4587c01fa

SHA1
8f96cb53e5e477a1152bae3042aeaad1505788e8

SHA256
23f81d660169f453233747c81d36bce389716b248c7aab47f1611559b635b52e

SHA512
819495232154cc2511cdcdd7855793f3d827c6417824d6490852eab70fed6b6e96af83ab375f95a66435d3ea7b1d93d94fab7500f038667214dda87e5c32c182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b7dee5621be7c934a5ccbded18fab1

SHA1
355e275a7e131b3ac6de56b69a7b009deac7a0be

SHA256
2c1fd672370d4abf577d97e20605b778303f3d384aebe639961f88ba4139f521

SHA512
97e4639c1d4f276e645e376adb53096f97913b44979dfed705a51c178a72114f7478d54649a68a296b5a0c7a0d87075d480150aff57b19250b110d7d8c8ec36b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9972c678a1454afbb55360d2ec1bf68c

SHA1
45788a1b30361062b2d51e5382ec23cc7ad86362

SHA256
2f07238f656a94fc722db51441962cb2b484209012342c69aba19b9aab4f4dc9

SHA512
9521359557d101c544a865b9c7d5a865c40bc50c655648a8a5e477c41a040938cceb4cb1215076fbe174bee1bc6cdd80bac3fba3fb891a91825736f14daaa1eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f4cf833fcf593c06d4e9ddbaeddacb8

SHA1
7ee31d9f2090eb2aa2615ae4d42537f4dd83e0f0

SHA256
e3d1ebd4a52a29fa8fecc92e18a61dcd04ccf774c3b336844569f0a874714e78

SHA512
e5cf2f78ebf146059cbfd04b3dd4f3d2bf4a4027142f46de145ab49efdf334ff536702b15de02ee4c576ac5d2a5cf60a145df90d649e0bc3e4c3f3edb6b1d2e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48eb9d0fde0e3457eea0a8273327a451

SHA1
18d4e27f776a8ac443f21b7a9dee7e031b14f31f

SHA256
f67e51c1f32577de26748d7108d74f126eb4a070bbc00df5ba30ca1c4bfa108c

SHA512
ab5d2fe490f7a40b9eac75b49bed4320f340397584339ffcc7f0e50ef600aef08975deebac8426931d65663802bb5e45f6b4c60e49fee27ed468f75aeb1b5977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
707568fe562c60921ed0e93fdb8ceb1e

SHA1
62db662931e3346c0f116aafb09f75c86ead5834

SHA256
092a5ad036227fb51fdbb079236c270494899fd439f54e9d6a13b4ac82ff531b

SHA512
c7b9afd14e404fc1661274b825e73cd714f206a486f1f18800a8a4d2972a9bcdd5921f92dd9243dff5a0ac3cb8cd0675a47a070736b7eceb2f75b0ad59f65a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8383ff84ea185ee1f6954a196e15d81b

SHA1
b02238f71f8ce3126a42491a0433b9de7763a7ba

SHA256
01692372e7c6ef3c23b62ff1249fa96b5787d68afa9185ae799dc68f0b68729c

SHA512
8447db34125f3f5082d4d8c861cb1c7236e38b771e51a86351bc3158a52c3679c33a0b2b35b91c5c2c7a281c2eaf325b5ecce557f753aaf146afa4b97fda8050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4a42895b788c9823b7d1e4496f4faf0

SHA1
e27f634ef1727176e682c8b592202c0df87f1c4e

SHA256
8fd7d546983ffe43bc109897d3029feefb64a5bebd9443712d5906a3fb3fe88e

SHA512
ae5a8cdbd3522afdad66723319d575bfb1594c9fe9d39eb5dfcd7ebae007b08e7cc20afee24250cda62c9c03d49bb7c8ca181772074941658da3c7da0cafc171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d27bf2abf1979eb75d7bc7c10ba36d3

SHA1
0ed12eeb67a9385b8d5dfcbadfaa64d7e070b794

SHA256
69d9ad2bc40d99926e45b80e036db0c44ccf7bbf6e58bcf4f421b970c2e8f261

SHA512
e5ce7c54ed77b3d0e31f460ee399b97ca531333e5837e3f9c4388d77da961bbaf6595e33e207d1d9536143e3d53729b0d6bc571ed1009d240cd5cbd83a1e1d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e75c8790e4d59e8cdd32701cc9e158bd

SHA1
60dcd90b213db5145c25790d8ebf9d757904d5bd

SHA256
5ef73bb912002facdb7defc00c7333ed7e933e19369e3ec2a7a5c681e99e9cb2

SHA512
b0df573c909c12de399934e22d8e947decd8ae89133b27c620a2080879a6b25395c9c9ecd156942e8c39ca6e8b9540f1dba3e947cfdc8c8ed11adff7ac695dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e729ee38040c19bad2bd7e631ecd5a78

SHA1
fb649fada1cd089dd399eeeaa09794a881232451

SHA256
c860a20f8cf6325d14624927bbfe37733e01b7fc5fb5a560f627414c6fa168e2

SHA512
d8936410cffb289b0be64d5947faa3df98d34e447315cc06e6044921d77e5fc5c1607bc4a8237a01c81e359109adb3a09447d5322c645ba47268f3abe6e09ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
4fb178fed9c09880c18ae5cb2f2170e4

SHA1
30fae5cc58ef3f5526473d49c9631a59381ae756

SHA256
1eb9626309508b24e90634f051e5efcdabcc1ba7b66abca2aef71da98557df60

SHA512
0765ef2b16f1d1d71f1a4d63cc139073dc6b6d63ffc56d7cf4c3aba2adae667b24861c342367400b7245bd592650c6b7060c80f62a7b9f39b195e3af6ad28a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
31ccdabf6397ab79406d4e26d95d4e18

SHA1
e1c5e3b84af1ebbadf712f6fae0a2a260624bde7

SHA256
c531875c3d3e4fbeb81e7be9f43e3dba40e9f97d67f5aa3bce42fd9a58734576

SHA512
3961d560e3bbf678ef7741429c085712e5692cecbdb47c96d0f54c2bdbdba895997ee959f93f8569a6c09d9cf9c86763d1144cf887ae5d300c83d4a52a15ec5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DDF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E7E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit