0abeb1ac104a4b23fb51b910c8074dc809b0178cce0389a2811b49e322c9e247

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html
Size

213KB
MD5

6f6116f4f7dcdee173ea97a897983cbb
SHA1

274111fdf1b2b166067d016ef8bd4d861825fb79
SHA256

0abeb1ac104a4b23fb51b910c8074dc809b0178cce0389a2811b49e322c9e247
SHA512

d7ba9b7122e60e9271c68ac78140561d1883849f5f1a1ad1de5fe09d437768d590085599903deeb6efdf9c472355d751627bd9f0d24488aed99f7541df727234
SSDEEP

3072:SI6V7V61X3J+yfkMY+BES09JXAnyrZalI+YQ:SIgAbsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D62F66F1-19F7-11EF-A4F7-5A451966104F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422735638"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2600	iexplore.exe
2600	iexplore.exe
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1968	2600	iexplore.exe	28
PID 2600 wrote to memory of 1968	2600	iexplore.exe	28
PID 2600 wrote to memory of 1968	2600	iexplore.exe	28
PID 2600 wrote to memory of 1968	2600	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e08ae8bb428c8d2af995028f1495c0b

SHA1
14d7d9f9865e503d6805a2877e6e777c8d655cb2

SHA256
7374ba5b48c48fb1de09d343894117a808cd1d4595de344e1ae2688cabbd4953

SHA512
cd5d365934f0a9aa0166baf8063ff7e9e2794a62f3e5048396657fc296b18ba8c8e6faeef711e30ee283df2d42887e6a6575e5d55d41f6d9e735d52456af8a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7c367677aa928816a2c3567189e8e22

SHA1
70976633aca6ca74ae7023ede5fed03dd9da9db8

SHA256
a5ef7155a143e790a2cda0ea747feead4b08f14f597d381645a535a9dcdbd8c1

SHA512
4c133ac3d817a8bf593f540b418269d04f4fbfeb4cc1eb399d1f2e167b4791a026a6ac8ec6a8dc87f73b34d15228a9d30e8a3aaf2e66cc0c585d8760712c0f97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a16b7b532ae8910fb55a4951d19401f3

SHA1
c67085d3b48034b20d3c94e3376204efa4ffbf22

SHA256
d77a908870fe12d831d0e607d2ae3f0e58195b74eb0d6e54adc8644b6bbe405e

SHA512
59150650d38a80d6ce8f41f4a46f3210d6f1e816acc67a6888a5f2f6001bdeee52642b5dad96dd5f561a2579692237b00af6cf32cc8a063633e92767561718d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd60311642fce544a444a78a532b1bed

SHA1
3167fc190feab72906f4b5f6fc443a1de47d8303

SHA256
6b327e628d7eca2918761325c5c335d6bc3afd47c1868044daf054e7baf4d893

SHA512
0ac6fc02bd7806a35be02b54e9f47d444d398068273ec5afd7f6895a61f60c6215777787379fc560e1bd0d817562feba0d170003a98a51045de5a73a60475ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d390f76e5e2b9633756ff0858f22613f

SHA1
a146606c7316e7f6844557964470ca49260d55c3

SHA256
645938b9ea01d25a2c1a73dba8c03a572627fad696f1c75e58a680d8c69ec45e

SHA512
66cb3498a0ba0323e3344738b9327848ecd05878acbeda1103705b47d1ab0ed3e4e3979d5b43e6edd3c681be96ebf68f2ce42cb44bb0a4a98b86f1f39347fdcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f16858f86d133526a604263a05f121dd

SHA1
15b9719ce68db1641096e62f4dbd725969923f16

SHA256
854ae0c6399a272821d88a80f6cb48c5e964a8f7878b206dfa0fcb879ed4ea8f

SHA512
5238e01b748e4bd65103c8fde8fef73a0fc4fa01cb3268f97e13f4b9454311d8d80c8cb9659c7640ea2f9967bc38d6af26288ce5128977e2e6172e677ec21953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72a0f8c023e598857a8cb059e10f066d

SHA1
6a362896631bfc7d0991bb0cc14996f8b02c04c4

SHA256
1de0326729e536de94ad6f2aa553546556eb5e04b912724f81a8312b378392f5

SHA512
03d6e21cdbee2a7bb68aa3f3c072e1f0529b1fbbbe4d82c15a1f06aa6113e1f683f07171de0c4a2a3b0421ee0f9817929bad90e1a66294b72e959eec2755248f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ce5a9820add885981ee92d27262d997

SHA1
ae905abeb3c41b6be3a0189df623109e93475bc7

SHA256
b713fafbba8dd7e05a391cc41b4c1fa72bfc88447d1fe5b9d9563688716521e6

SHA512
877b91ccafa7fc1b90829a7da7cab558d6df458969eea5e0be4f8a6e6c16fffe9e3de1b17bc0a6d69daa6d16d5cec4de391ace5a60987db336f7b48771b24e48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ce204583ba479a8ea4ec223f451abc8

SHA1
6b5bae8c48fd296d526afbf4544d36ea1d837a67

SHA256
27e544b4caa71650c9b94f1138848d95b8ba3fb98165a51f75469c81396d9274

SHA512
1b52ac3823a9b682ed4f640c0e363caaa596c60e60cbb16f80aee7b29dd15015008f3094cb3cc0527b7ab38ed1462b35b6d16b5bb0a72ba2b71e6d9c7b003dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b5e25d394a11f790667d6ffc2d91272

SHA1
7c60769d6b9850464a03351c3834b24b2feecdc3

SHA256
4d9854f231165075d47eb65d6efa7579eb19b03e383ce9dd0c6725f0b504d2fd

SHA512
ae72f246e5ef03aadca24627e3fa49191e88420758467ae95028a55a75f57b02fa57194a9e8cbe86f66bf3d44906e15bfb9b7613f6374064b1f725efcf766c98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18800b29a64ea19b228eea866fe8172a

SHA1
2c14809be1ba44a06f9363367fd0af2bf13edbae

SHA256
cbd54262ab9c80c4aa14671e8ec66d4c3edb02eded3724ea3cddca630bb027ff

SHA512
ff8f5f07a023b0667714df3fcbf7031ba8e360c1d3dca4be8a5ab3f454e65b358d366333da6fced64bb9037ee8b933bc7e1d33169ccc52361cd98f3bc09de248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
defe119021ddf343d84835aa1d6b5d53

SHA1
ec14a19731aef250340ca08803900538b99ba330

SHA256
5042b7aeca859452450d2c4da5023dbaf59d3264b1987ced26894fc80bf9ce30

SHA512
5e0517ecebd2f486234ba05815dd0749e7bd7fa2940e800a7e2706499703827eab79146947b580d9e4185195c34c31a7048981354fe6ab25af9415a70086c0e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9120ae258be5904b8d256666971e2dbf

SHA1
5298e30cad1254a86ea33e7f4546abde9e3d2906

SHA256
623c7ce2bdaa7f3568584d68a15567ab2c791a96766887e84151d5ec7bcd30be

SHA512
c499792c099ee69b87f558ab6a3e9aa1ae3e60eed09b2990ceab99d4dc385a31b638bc40ec4ce73f742481121772bbbb21fd394d8807b953ba2b595626c88c98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76566b29dee639beecdac8dd06ef9a40

SHA1
1efe9293287282c418bd68ed1e5fa405f3070eb1

SHA256
a4593b620881d265d8b6657ae196f5764ce8a77b49a7aa9600a43c2c3ace3045

SHA512
439f86e78dc514c8daf3fcf0b62b4ff4515b99fb7c483f582347c25ec575d7862248d84dccb5837c17d80c7af3bf1d43e2b192fe4b4c1d9747e94afad151426c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff48df9798dbdc8fbe0655fbf097a220

SHA1
75385f771ff3bc981e4a8356c76727dae3136e93

SHA256
9d99653df0ed317162012dc13a81bfd0bfd4219d93cf669977df15282b14bafa

SHA512
b8e7012624bc30df66a5b7123c8a7c442fe0a8896809d052e0a4d48d03c4254bab010ed925f0b0fe29a37ef6da75b273cd913b6402097c09d76310e9459d3faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78e54991f49d0ea748058fcddd22cd0d

SHA1
f040ae93c45818f4bec35dfcede87159497b4dc2

SHA256
ec8321199d57f20502902dc554fdbcbc103015991519f50fb94bb1a574ba6079

SHA512
097f9057cc539897a7ee90d34e60c6d26628848d75ed9e1e9f03298452dbd1ec073cdfa804f02ac8ef734d5e169aa609c6f2b8471affa789a4d8dc54ed96466c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
073207f736c73ef05d120f6517e3d01e

SHA1
a009149a371de5b7c8e8d0abe3bce35b3a01ef7a

SHA256
31dd05935165ec4e49dcb9742dbb55003a4686a6179e9030d20328218fc946b1

SHA512
e87c554611914b246aaa1356214439a80acbe28f56fa843cc358807a1e439f139c739b8aa7f39bd46e047ab0afb7f258f126e0e7a54ae065cb9f29e85f9c7bae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
146d39f837027971617c56ec47356f0c

SHA1
585513d4dcaae2c61621e73311c63052f1f7507a

SHA256
5b7dbefd05e5ab0659ee66f065a4a353ec893598cc3e95dba5e3eadeda3fe40f

SHA512
d8d8199d2538a7d4152961b2bcf5e1176fe6b28df90c3d087a28eddf3ef62890b71012ea173d66a55eeffa21222ea18ed37c47502b6837370f562debf1f58873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14867b21397fcba84034cbeaf0954a96

SHA1
42bfa6d390e95d127adda51c159f8f90924eb1b8

SHA256
34c938ac7c4a4cbaaab5f3d8d10c743ff51e435dc5f086918c0f64ba25167ba0

SHA512
581fbbfd3e9f374de11cb71dbad61eb3aa1ade1c9528c90e98099d1ddfcb7d49ee5e8999e246139b9fb9a910110a64ec6f2a77cd06fd804a3a6a8905275d906c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CF5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D55.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit