1bac5147fc0890f019037b8bab011c080d7cf2fcfd0370255f266530d7407831

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f4fafd389988966c56a636e00aa1558_JaffaCakes118.html
Size

213KB
MD5

6f4fafd389988966c56a636e00aa1558
SHA1

cb8a717e2f14f5cb1784224acc64ef2f2199d002
SHA256

1bac5147fc0890f019037b8bab011c080d7cf2fcfd0370255f266530d7407831
SHA512

0d766ea680ad9af230f29bccdbf6e09bc0149fc42fac2b8551a2f8cbcce18b708e4a14230c84d6765c7eabd1bfeeb5ba814f8c82a934a08007a2e88403cd6d08
SSDEEP

3072:SJShIWbrlZTyfkMY+BES09JXAnyrZalI+YQ:SJmb2sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{843D2101-19F4-11EF-8C71-D684AC6A5058} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422734213"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2916	2268	iexplore.exe	28
PID 2268 wrote to memory of 2916	2268	iexplore.exe	28
PID 2268 wrote to memory of 2916	2268	iexplore.exe	28
PID 2268 wrote to memory of 2916	2268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f4fafd389988966c56a636e00aa1558_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73dd3c22d68cb117abbf60410b39cced

SHA1
06d5fdac58856223c015839c2bade4afe9d1b2a9

SHA256
4e61316c6f98ddf73f3d40b96d04f5b125bdfdfd1be2a9ec4fccff33d0941ce9

SHA512
e15d98c245dcefc4840dd364a347b70a6bbee053962542266bf4c91e21a4af966ec678605ebce7d88e8761b5245c3266d5b81cb775b02fef8dec8d7e79d6d46c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
647ad819a04a01ea5d4e48dfdf952a31

SHA1
73590767e5b199dee040ef36f7a21175ed811e39

SHA256
62aee112ea0cf467d77192b4f51b51ceffd68c031d13fcf641fce860a68c92e1

SHA512
8dca2e9371db61bbcb7c3cdeda0fcfd75cb360c19fd098d6c5b32802620745b2aacb2704a9b94cfdeb0de3d494589cbe397be80899b6dbf1f358867c4401db17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24b0063752b7660df3501351216bef05

SHA1
d268e29d493a34890d52e4de41ab4670b644f271

SHA256
cdfd450cbd74307b2ab2097ebcc1c8b75f9f9705b865b518e9bbbede26974ea1

SHA512
9cdddf122bd8baf7e2e624f78fd61344cb3398f165d06988360e8ec28aa261375b00f734c77bcba286684c36a84914d2633bb58462e90208a3b469914251f202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b9843b024a20e3f2a3e181d81a59e02

SHA1
c68ac6b295b34589889e99a2c2a5af5b96baa5b1

SHA256
a71b472fcf35c825f82664dc1f5025d36f306e9ecc44dba5d535cde705bd7113

SHA512
174ccc3fa276375bfbaa947cf47ef9f34bbbbe9dd830f6edd5158d53197708c5c0a216d9592bfb3033ee21d4073d4434b5d5385f90c69649e0313a1b2540df91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dafd2e9db1a90b372b9489b2ed2a7c8e

SHA1
01166a65f200c23d0bb1284877c3a142edae4041

SHA256
3ee8551bd3d455074a5db6843a69352cd62ebba152963fb8e4203f6377b4da83

SHA512
3ce6d73e40a9195084f76bbf8207bde22b453725c17cf7353de519c0ead2fad1fa02e1a26828995371823609444b2d2548f10fb32caba3e5c5265c704a15cf88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
086ddbc1d06ec405aec3ed7b3cdaf05e

SHA1
e605e38da30b47062798d9cf83b1dda13fc0eee6

SHA256
2f321b73f4941489d2cef38360b1a78518cca0aa5449acec30af10f6293d069d

SHA512
c717de4b5c5dfa79895630cdf1ef2dec15709684ec52249b57b5ddb15b10eb8430dbb2a0ed5c90312d4651f61fdb6311cc6176553cdd3d943de481ba6e0e8a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21a41ef9b43cf861d1325ea8ee0ba4ff

SHA1
c2852be704fab0b23f533955bdccd0f7c05bba68

SHA256
75644b743c8d8cee1e2a11d3cf909be7998a613ecf2f4538ca9f46af8d72b1f6

SHA512
3b8ae907007d9736a8372e01e602becd22b9741bb4bc3d618e14bf28071b3c054090e6d7152c1141fa280a0684efcc7a3f47e1a9960d96ab4fef0d07fff10571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b4b954de846c4227dff239d3b632251

SHA1
afd6b3b08850e29abf94fb0099843db43a0ac1a2

SHA256
26f11077dce7e2fcee16ff825f3eb2ceed91f239272763956a864c0f7dde2503

SHA512
057d6a9a2f5a121ac49df22ebcd9a4634fb3fda936f9050bda9ef36da1ae04a5bbb664ae02ef582f89041dc80ee31049945780d99062ae8b9d0297761d219705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9936b5fdb6405881d44fca41529c19

SHA1
cd16c03af4d6f301e2de2bd0a704ad8c9463be09

SHA256
a5f23c275616daf5eb6916dfc78d6b6d6c7e129c788cc9d5495d87c77dc5bab9

SHA512
36c283d582ade3b2ec0a6b339cb1390aa45ca2c69b017a72393ed97d52768b60ebf8dab803a6135b2c7fe3bd12ce6f7220538d70ad99c347368213d132d2b4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1794c35be614bdfd23a33aa1324cf82

SHA1
49f2bb66574173f6cd7d364114a6d5154bfa2a84

SHA256
d7406b166421ff281ea4819b5e04caddc55a36864f727588bf7482eed1d00e20

SHA512
a0f17fa3f60b5c8f0e2d949ca3c20a8352791254e1d32bdbc62746cb022169b419f99a1151b782fe5c5a1b94dde55c831dc04d4402d21964115978eaca281c6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33f18c11d28eb0a710dbcc80ae4bd0bb

SHA1
d1ba764ee8899c97e2787b033bd8b81865b96656

SHA256
ac50f844fac3cef90b3e9e2b27100e089de393ce6f68c7781bb46df74605d934

SHA512
54859a22e019ebd4e5170fb8d5368ede970b3e7604f8a2b57c267a7e83e3ec6bb676838f9e9cbeeb4b70a26b4e2ee326bf0ba7cdcdf92c75123347db2dc2aed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef2c204ec2fce2ac297c0296461dc300

SHA1
aa25ab1ab1c9eafcec9ada026a116293328198f6

SHA256
80cdabc758ccaec334cebf6db1c55c0ad4b62a489d71ed6b29a09989c0449cdb

SHA512
a544335e8dcdb895a0a3866e72992ea3a1f38ef95637e532a0292c1e3d0c06d2f8285878a4f3c72a3930b7587828bc04bce015d11ce372f208f49990103ec392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e01e44da9d90944b5361bc54380ae6f

SHA1
aedeadb925b4687836102b7fa62fc5a9b4c9f339

SHA256
23f735ca99803bcd253aaa4f51f4e1568c84acd1038fa9f0e751675cb4480b64

SHA512
b22ee3fa8f839e1e8463ff96810efe02e0e106a44d072d7ff05b461ea3ae6fd27ab85adfe692363cf64287756f67830e04f2702a71913ea7ed3abad09b980942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c7afe32588903a5c987fe8697b25d5

SHA1
1740b74b0c272a7fd7833518d1a3715bbf70a47d

SHA256
98d20ab681d2183e3644df230f43c3641bbb0940ad4eb0e23151b9422b6f26b0

SHA512
ce80f290e787afeed041efb3b03239331909c130e3d04612739c8b7151694a1e4f7bd2d856ab3cfdf2a559edf28cdc671c72b468eb919da5ef53f937b64e9673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1217faf359ed5091055d20dc5bd1d381

SHA1
e1ff949c640afbf796d787d9a152320009914124

SHA256
cb9d14df2d455e12f3cceb5929cd2b6931f8032ccec82ea001e675b33f2d38c7

SHA512
bb99d59c53d5e41c47977551392e6c2848720b5393c00e791c7374ae75d1005d3d58be6b58e2df056c8291449f41eae92c11475af9177fe59c57f28af3c3bc2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7601e495603aba2c3dca2ce0b11152c7

SHA1
37b2bf8d0d6bc851be06e9152d9d978a7cd1bdd2

SHA256
9a07d374c04c81d8a8cb3762a0875582a89805873290fb88d4f55ed9eb098b9e

SHA512
92a22b2b2f588d8d3766560d783f868530ecd948c09fbcb9733d6fda3c55a90bf2f5898c2bb29207b26db4c1b040f1a3984c130f9aa64df74a8b9c758ace5910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5537a5aa4dc32d7bf5066edc9aaaf47b

SHA1
f81cdc14dd6d5a139afaa51a39afb7d31cfedbea

SHA256
b5956d2ef51f65aa39a43738d40e24aa3c3ba11d85af20499683031665578e91

SHA512
ef93c0d5db3b56733727636a19e9d128e936ab44287d50b53bf01651d86fe8493bfdcf866a6d127e2fe3af5e990fed7e616857531a2c79f3eddd48fe7854e53b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37417228f432c68af8870ba2a8c842a9

SHA1
f6a974baf6f74b2366ba3bc7f92000c4d58b5921

SHA256
ced241a2125d65c61712ae93b08b28f7873395c4182c1e4010c35999aeb95d6b

SHA512
265a74082599c20f16a467409dac54b0c40d66724f1719fb91566f188db51c42b8aa74491f41a92a837e3edc9bc52e6c846cd1c842520c8ace62727d61ffca75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcb17f05432a64713f5e778ad76960bb

SHA1
9699a4346bc1211693f3dbfebe038c7487a5f57a

SHA256
7105c4c6a3cfaf99664fb867bdfd09bd1ad8534617281dac2e92eee83d8c9873

SHA512
73621725c7aba8a4ff0eee545c687855eed7cb0802a1d24384c750905167b290a5a877f57ad030d7ab3f508ea89f8799f8f699faefc311665bfc65870440340c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DDF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E5F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit