d33bd523b6a362d6fce602535c0831bff6d665f964fad0a7683d363b8e38d66c

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f63da77d74429d484ec5bf072b9ad3c_JaffaCakes118.html
Size

463KB
MD5

6f63da77d74429d484ec5bf072b9ad3c
SHA1

75eea01afb4969e6ddb3ce060fbccbedf13978ac
SHA256

d33bd523b6a362d6fce602535c0831bff6d665f964fad0a7683d363b8e38d66c
SHA512

0cc09d965ff469d76f1f28b63020668486b806e813c7faec55c811904d8ce6504d618e711775834d7a1e7d99e551e72062495a0f7f695dd22904b583031277f7
SSDEEP

6144:SWsMYod+X3oI+YC2QZsMYod+X3oI+YcsMYod+X3oI+YLsMYod+X3oI+YQ:b5d+X3w5d+X345d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60575d4705aeda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422735894"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6ECAF7D1-19F8-11EF-BAEF-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000001c1a704345016ec026766ef424724441c0d93f146c589c316472716329a06e3b000000000e800000000200002000000071607cd291a8704f6e34acc52148f5543da05d28c813ea4c9e746e94e626d5da2000000037efc0da26484744211186152fa7a6122bf7ff44dea2e4b6e1f6117bbda8d13640000000beebbf1a44c3e903dd1f327102af6a98a6fd503fb493ecff3ffaba42b94708f8e170ad1a125701ffe476be3b121a23f128f442151110f719dd09c1e807532684	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b8fa7423ad19e595b232495009df4ce199d2aabffa7378e7531b4241444591e3000000000e8000000002000020000000c1082c8be2f19e2a7dc54a5746a01afcdc7c9a7f83b4888796913e001b16474b90000000e6eedf6cf562f1960a6f5632d7975e00e8130e0c18706e11238c814a2a0354cb1679dacd95762d9220a201baac99754fd232cc3629f8570e6c68fb95454e904aa6817b97cb7d18d2d4e00715d9df80cf3e47a6140e07591415a9c56c0372f5264f787f2f8b662cb1f510f77d11f01ef7a41a57eb7dcb37ce9da597c79a57ab15ebabc762df0ddaa1f1122e2a2e3f5cd840000000fd76105ef59cdf2263a2a7c3a1817828ab6a19b2ec67bf29ece18629fca2ab3b942da312444a1db24c8484f2275476f6d3abd681e5179e8c95c09887a82d6eb4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1988	iexplore.exe
1988	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2580	1988	iexplore.exe	28
PID 1988 wrote to memory of 2580	1988	iexplore.exe	28
PID 1988 wrote to memory of 2580	1988	iexplore.exe	28
PID 1988 wrote to memory of 2580	1988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f63da77d74429d484ec5bf072b9ad3c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832fb55043ae1024c7fdc40cdb8c1183

SHA1
713d18bf1c5fde10dcff37a5a82d92c0cb5ac268

SHA256
324c704b50367195574a4849e55e349639e48615bd33f5926df586be9c982a04

SHA512
3902105b093ba9adbb54b6891472b2e9ed8884ba5469094a876318f91001294cd4196ab9d8bc714e4656dc5159dd2ca6f1dc961993e0b797ccb7f9389eaeb02a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39fb764cbf454121076a480733499e3b

SHA1
5ef6274426af8ed3722f97ccc82bfb691f378003

SHA256
6be07d922427ce7a2b9961dfb94658730201516879a5db66b1c8971703bccdf3

SHA512
503bcb9c8f153d44262749d5fdc47ff04eb71d805165c5bc965ba8f00bb91b6b6d58030e8c59cb2b3ce31b97dc3ca08db4105c3ed32a2037913976da85332a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3cd515462e00148a162974c18b4fc82

SHA1
0c9d72030e33af8f5b923ab960637d6795599ab6

SHA256
193ba39460c221ee1b77a210cc167acf40b224d811b8b18e3230de5f821dd4f1

SHA512
48f9b0148a946c41cd1597a9a022b821b9cb82daf83dca45ace4e4675217142477ddac319dbf530866de6fd97a648e5c9661655842da0cb2d402557627b5bc51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b3c73ce49d526f7b1f3d390e4aea8ef

SHA1
e81de71642ef94e4a954844a8ca3201244100f1a

SHA256
f8db4011b80148e1068e30f72fab9219bea52f663b67611f8a0c4b6a78328581

SHA512
1bbb612e1ff81acbae1a38dd6d0994004033bb26832769a00735ec9bcc9b9fda0356a4e4840454ea863e89703be02791b3f77aced47613977d14dca375063401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5deb11c9dc3b5f719d9dbaf1438bc650

SHA1
64b078dbd0fb556559e8bc401ee4b313e64f4dcb

SHA256
64060e65172365d8687b18f7008b3d60f547d6d17970906843e0543876963b79

SHA512
58098ae2d61e23a4ba1a0b55e3abb6de3540ab7b4e277710b6fb773c16a06ba7ca6403dd48abcb0ed33da193e60b773924f1ff4dfcef8b61536bd2415296ef45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b67791c417f5c192ab7f5a5604e8719

SHA1
0eaff03c291d97c64029699d2fdd67653a186faa

SHA256
4190c4fa0195d008946a87d2359c9f7a7ee19b503b07bb11b09b080d7b6839e4

SHA512
e4117591f893af763b868c108b218b6d3e9a46e685b2715737c51e00321a99a8295c4e0fe9152acdbaec65d97cc7c7e96fca029d6657af3f10182b37c719f3d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04d1fa5ee202b5356300b1fb5c98600b

SHA1
d5d4b0ca776bad863d83e4d7ca4136538f24c6eb

SHA256
7e19a0985b1e2fe9ddafed3ff08153f8c15cb55035ebc64612407993f7f1145e

SHA512
1d61ff311a186da9ef20001d9aa2504887865c8c91f02293ccb92544174c3979f2419573787e90976ef4df40a024f32f33b753792ab05614c9e1184009d38251

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e187037128f248a350a36f191f667b6

SHA1
5af78265c75d0b09de00bcc25764e85ad4e6b4b8

SHA256
4de8af8dd84f1a0540eea97618ef4aa46f5979a02f192e6659e70e0efc3498a5

SHA512
cc3401c901c39b15f626198898307b4c6639a3b610e88143431fa40f26de8f66068152050c2f6f3b3a492742e2bbd9227001e50d500db403d1c0d5c45881aefe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76f9f37aba9bc1ae03a3b08db1778bda

SHA1
98916340b278b04e36945d4aa614b065d2711b2e

SHA256
f21bcbfd9ce19c25d8e1353117b27a62059e9cec09871371386f4a4d06714412

SHA512
0e95464b17a6fde85002018b2fb4eaeba7f4e552dd6176d5ee94a0e930264661047159ab4412ea413af4970cad43f6613667239e5420a5945d61b0ec7e8b869a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
863ad680056aec46a5b5b83cab4b889d

SHA1
3d7cf9196ad4c0574d20aabac9ace9c3ae274f32

SHA256
265402ef6b9aa9ce4ae1cd03d7fa8a53d8a1c3629138210ab9d4af1459406350

SHA512
d243433b6b5cc9523b21012165dadfe0beb9b7ef7d9818ccb959c2fda8d8d622b221a982ca17bd4b152f90a9ffc0ac2de8c16419c59ffe898b51c54a98bbdc7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f10537b7b542f8042a6da6a1881ab54e

SHA1
fe8544e51f252f64832d1848dd9df4299a88038a

SHA256
1bd49092286684f4b0881ab820d8c1362c980158777d68ab06bb64e3bceb0f1d

SHA512
8f08d885b32eb318e25bbb401d49e76071d6fc8a9db2f6659b5fbef12b8359ee2db6b048371ea1fc0781342cf842709c0be33883d0e24a6c1805156de260db55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab48B7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D1D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit