774700dea2b31dc31730217570eff9d0a21e82af09c0db6f119a080712351c01

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6f6fbd3eb115242dee934ae611881de8_JaffaCakes118.html
Size

2KB
MD5

6f6fbd3eb115242dee934ae611881de8
SHA1

a08c98f066172e8c06d53074c99e73595d44c05d
SHA256

774700dea2b31dc31730217570eff9d0a21e82af09c0db6f119a080712351c01
SHA512

890ecbfc0f91590a2838868f34ab4dd265c8da5821b066f0dd14338f0e8432d3062e374741868540872f6e41ca744b0ffbf44a63c63ef0fa170846a82bbd045d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422736995"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c00c2dd307aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000942d2d6db0e1a007cc210fd0751494069894d8e910ca4856878a96953d0ad2fb000000000e8000000002000020000000a1498b4b1f07d7dd9f6e7aa3c792473de8312921b07a8fd5ec66d14d41b7320790000000b7fe334194515c4a0f46f6848d2c52363b847ed159a2460fd1f4bf1fe4fd65d60105f2245465bccd264769b4fa8df3138308283b81391c565a6f75dd233f759dcc7b51f5d79c10cefaf813f452ae7dcf91abe48dcaebad1bac75de54d1b00e40c140f749297a784bc701f8ec34034f16e6de082ed85dcb75ec35ea70e5a58544112629f6d58afc49f68e816f0365216d400000006a5a16ca84def642569e0f93c0f852b6d8ad7097bbb1f15bcc79f9dc98265638ae3891c07601db0fc635bd363a62ef4c4d2f5f1822bc18e8a2a9d52f44f8e097	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a518faaf2c89b5c74b24ae5614ba6703a3332b2f8dc1b365a6dc246eaa76b6e1000000000e80000000020000200000008045e09f48a52d7fe6e04dd1bc211febd8b8542d85de466bcd9d1b36ad2bc4d320000000873f94cbe7c485e3bc98c1f3c72aad6c847da59b2352b065c5c33bef83e22ff3400000003ba66eca8edd072b2f6e7259c3a9cda7db1d5cb242f698866a84040bf73aef58080607c99f48a7a552ab1cfc64bbdf51fb42706a3af7f08df72b17ab58ccf796	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE784CF1-19FA-11EF-88D8-5E50367223A7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2396	iexplore.exe
2396	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2320	2396	iexplore.exe	28
PID 2396 wrote to memory of 2320	2396	iexplore.exe	28
PID 2396 wrote to memory of 2320	2396	iexplore.exe	28
PID 2396 wrote to memory of 2320	2396	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f6fbd3eb115242dee934ae611881de8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
859b8d08fd21acf367d0e800e5b0b572

SHA1
cc88f2a4685631bb9f1aa2487d11ad8139e01a20

SHA256
d926f3292c32ed82809b04618ae030e387aa6cce41f8ad1ee4fba56224bd40c5

SHA512
59272da2bb3514a7e8a6175b94bd4b4c042f59c57ee47ade0945f14f8008db278bb4cdf94210dc3cc6868781ad3a45f9ace9a153f0aff11c3c7349f85884552f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7de3d27cc5aaf03b1c2916c77df0c63a

SHA1
54c555b735c7202fc04bf748f298cbb6633c4e44

SHA256
bc32d90fdb6c3fccf15a3529267604500af5021c52b67fe39f13a372d854446b

SHA512
2a6215a2ccf5296c4106062d33d3fc8a9d0b1663dc1808385f95c36bd5f61de155f6e6d43dd236df6a878fef3972e691f604dbebecbc67e7dcabdd54b4069cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08ae264f79717d80b06c62a770cdd170

SHA1
022a6d229e06f3da7d7070f04049b4a417d0903c

SHA256
f3c6dc6f533b6ccfb8b5429f7f1f30d86f7e8913a6f8917a0d1f9ac427f99732

SHA512
66211f8373c6a558b483298866affc983c70b57123c249a7e474309628bd2886a72bbe0cbd889f631d0cefdc970aec3765da695303de415f6ff18652871a1556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a6d8816fc1a60830db4ecf81eb5c9ac

SHA1
d78abf892137b1516368398274793671ea638870

SHA256
e0aed992bfa2c58f3e94f00d3831a00d7ea70cb0af97cfc93cca003ac80e7309

SHA512
a51384e53b20fdf6fe2eb9db5f8c54efac70605587ed8285c2ed971f3839698852b5abfb70d155ed9ce25e7e908eeba154f225e8de1600af78ecd141d8a11099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
052213d5226d61ce830e5f56a99a1360

SHA1
b555b254622b42d193498fa8c1803b4555d0332b

SHA256
cea2e0e8682f926a967dff882bebdaa55edcbf8e48e6abf3dc6f1a72a3a77e38

SHA512
d41cf2f2269be65ae86cd8a1575940dec3211660b7554b9fb03939493328de473dd1999abac7787ca2fe9696b8108d3e520737577b16d85b73e8d7d319850a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
991357ea1edd5cc54883272f04d393b6

SHA1
b81ece05388d9d14118ed1fb8c05cc7099f78485

SHA256
7b77c832d9d37ee4bb6808e720c671fac8aceec2c20f33305cdaf4cbc3277910

SHA512
f5864b10da508dc61be491f488c56b37f65786c144d9061ca9ced06e7068cb911ddfa24d2ea6290c22ca1c81f3a246cc7cc6c3b57309e408a9a42d98e1b604ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2047d0039fea6f170aa80518811ae6a2

SHA1
c937e0c710a4dc2945bc2f1187cf2638344e113b

SHA256
b2652a229cd71af2f769f2ebd76a3ed8dccc4d834b3217e093ccd7acee009e0b

SHA512
a8b18f05c97416430fb0c4fd295190ef76d0f37be65b16f907af18f0a876d7011c399f24a70dc1b1b139a254427b942f8201f27e37f9f580167ba736d7cff507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d41020ad7aa1ad0b8904434c1148c5d7

SHA1
fa183cfc1c0c35b2093ea42b5ab271374abafb90

SHA256
7a686b1c5e49d04424b049d2a66bdbf53d8b94953a3805ce8800d098a176f6d9

SHA512
dc84d0a11fe3e0f9f6254d0878b9d9e60d2ba25386746fd371f56324c9462b42ef511d0b3959af578159333f9f8e5625439b83aa4b10ac6db9b3ec11e4c0763b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c69d48cab9490b40bc0ae319d241d8a6

SHA1
d4739da687cdc2d8971e3ec924e2d1d9b775a819

SHA256
72f79b1fbf78b956c4ecdc62340f2a4a24a1ec7cbcf5de3d1ba990c1ad786376

SHA512
d54cd6f3643a239933247bba303b57f3db29d444701ad47a5e7df9706bc910e8cf8229b0cd0dbfd2b760b9d1d0d31f3a55feaa351c45eee4adedd6e46e0d3d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7d0d3944d9027c300b62da1b8f646b

SHA1
fa008908307f44cd1a55dde44ca1caec09998fc4

SHA256
5d497c922796964dd6986b0d30c1436c1d0c9665701a3a2a149a06f1b490a89d

SHA512
42d016b44eab774f694701a55e94c3566b44485bb0d26576f71f20f1d0fbd55a03c5c5f81f004c3fe1b922d52816717ce772de512456de1a1333de450427b76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d134b279eb0e6bdd61243da77d0e8636

SHA1
7f4e383a2fa2583ce9a8a9bab1d470d465777d0e

SHA256
425db727f41ef034205a73633f24357a05d81f9bb0f5116f23d6fdab1a4e497a

SHA512
18e1edff63684f49c9e5e4efc67452e9c05713a3b523fff93fda33c13c5b93e75fc29dbc638545777652dff17b33de153c8d471c07d5f86fbeaac865b0fa1a0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dbe48c73fc36ca407f3d1fb549bfa4d

SHA1
b2edd742bf59d5a4846fc0b056d540fdb69c762e

SHA256
d5bde0ca866738e8695937c4e8bb7679d762784c84bb1f91a2f3233545a43857

SHA512
48726735889fd4a44bd186dc60c9ee0b6a8d7c8010b073f602ca4a0ee3c0d21a58bf1acd444049c1f4663f37769cf1c3ed32bcdabefdbfafe17861e75896490f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25b0cef379faa06ce7e08e0c0338e4f1

SHA1
c023efbe14f296b907afd64469bcaaa44116c1c9

SHA256
d106c7116fa77f13f741c050315ef48ede946ee1c92b883575c0f3b3f97a4bc2

SHA512
b7d0e702efe6843b70c762c596de6690719de8ca030f6eaa9a4a89434b2e0ffed42b727d33635e106359809ed67992f3979b086d206f23b0e650ae9058a8258b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0503969516e64954333add20535cbabf

SHA1
2aa89a6f71dd98463c19426249443a05ad7247e0

SHA256
ee569cfcdb2740149de93f3827898313400c32787c8420fe2a262f5ad12805b0

SHA512
0b90d8eb852eebcdcfe232e9a309dff7a53d09baddcda65ff5609d0cef8eb55c4e2c2db9d1ce8ed65b4710486db25690749f700e7d6c90a052f1c0f966b84e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85cd11ff806014390e308759e65aafb8

SHA1
c605cc4176f5b5c81ee91b6712aeb28fb8123246

SHA256
ad04fec79b8b0e93793e5850e0d4b8f43d370ed0f905a7700db729e76a7e8823

SHA512
591898e1d145573aa1b7b7762f4806327c03038e672b2e61af8f1fc88bb373846449dfe4733c24b027392d9145229467cf72494f3312a9956a9761f75f320b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96157edb2f04c7d24e36622d978e59ed

SHA1
41bd01cfa0c7ec3e74297365049afff838aec8b2

SHA256
7000bf8e0f3bf8d0d0720e7c96f20fb18d89dd21c633dd6a0efccd08feb2e2b6

SHA512
21c5405d6e5aa29121365e428f0cc3edc65996673d7c591e04aabf03ad36c7b27c1fafbd9a22f8141c5e4f74437637f2255a29ceda6699728f67881fd12d1978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e1ad2469701df879b4552874e5871e5

SHA1
3f183cdd989f283826e37866107356f64548fb6a

SHA256
fbe7680f2e0db89e65395a713c52aabf40eb5ae865a1bcefc77642492f19160f

SHA512
de128857e51c720f37177e4d7fad59f19eb10c9d0a6571d29dd1116e1252df6992be1185c99aee12b025c8bb305dc9282eed294d105476de70047dbea450052c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23C9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2449.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit