f6bd83980b54484804b2eb4bc4ee25e659fa06b14af16e6cbf3f7adea82d0b27

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

804e26232d8e127d8f90ab9bc9143acc_JaffaCakes118.html
Size

38KB
MD5

804e26232d8e127d8f90ab9bc9143acc
SHA1

6d592b7f96f8579e6de4b0cbb854238aeac40f6a
SHA256

f6bd83980b54484804b2eb4bc4ee25e659fa06b14af16e6cbf3f7adea82d0b27
SHA512

44fed24508f5708e0964f752fa36cd25a18709630d42d9a3527597874cd53b1b9f78b33101e1d8486929e23b97d8654e0ec986482af5d9a879c56ea89463fd0f
SSDEEP

768:0E0fkigvhigOdCmCPCPC3C3CdCdCAkvSWGe2N+TpsVeQev76plA:0E0fkigvQjaaCCSSIqW72N+TpsVeQevB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a4eaedacb1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1863FE91-1DA0-11EF-9E06-5628A0CAC84B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001e418ed0b2568243970483ffd986a8b30000000002000000000010660000000100002000000057ef8e46b40d95656eb28fb5f65b5a1ce8b6eebf0023ef524f4f01f6e9a91848000000000e8000000002000020000000974523b30eb673ae84370660a87a6188e23b27c7120164f3222f6fd87b2ca069200000009138b3d1a590a0ac9b818159cb764ef3198a80087bfcd6c314ef8627e0131dab40000000c2ebd58e0e007120ddbbed8bd7f28bfd7aeaadf6bcf4a960cdd910b7ac16d997a705e1dd9b5de7a88c6be7d293f744c7b4e9123b29a87bfe69ac085e3660ee7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001e418ed0b2568243970483ffd986a8b300000000020000000000106600000001000020000000695b7d64612b4f3751771788d12708a3b1845873d05bdf9fbbbefbdf443bd988000000000e8000000002000020000000d84b3976e50a585f0b8e6f5b7dea15e0bcda50910ee31a0252dd4441e25222e1900000004822487c9d8c83e6938dcd66d42f7564844feefe42e4eb01a17edefc3b03ca475b797151d9f583d920beb22d7844c44582500ac38b8125288ef046bfaabb287c93656dde06a47053e0c55c651a624bbd807d83bdaaca5e2091a99698378edae3cfb59fa994cfd0bf25f390a87aa24235b2c0540261137e0fef005ec86f27c7025bfbacb0fb415b9c4ceb0beea93d529440000000615be56f4f8dead62cd20d1cb7c9a0529f238b10dc19b3f26b49fcbc1359518fa9cd8e948cbc5e442da8789118b1741fb8ae1e39a720c24475b078ce2bf4184a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423137759"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2212	2364	iexplore.exe	28
PID 2364 wrote to memory of 2212	2364	iexplore.exe	28
PID 2364 wrote to memory of 2212	2364	iexplore.exe	28
PID 2364 wrote to memory of 2212	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\804e26232d8e127d8f90ab9bc9143acc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d3a563cd959b1a64d7d6c43d4a5dfc04

SHA1
d0d470a37f1ad6c61dce1d4edd56e8c2bfddbf38

SHA256
47a4a5ca44b3ca8cf2cc122a03a4533e9f9efe65a37a4aaa3a35b1cea0cb69c9

SHA512
a1fdf86170f9e0fee616b5dd135bb0b82e856e01bc1119e35229c2035c4c384a0bb88f78055b6d4c9f2ab99c02936a7394211be889d7d6a59557a4d017a5203b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b2a8ce85d5b82a708d54a1ff372d094

SHA1
c0e43b8b96d8ab031bca6cc6699d6d5beb2b2c84

SHA256
06936d800894e5a43fa5c0371f20eeb6ccd56777b230796e2896f64d159e66f3

SHA512
7846bbebd794efa54d215c60ce5fd99757ad127c839b2c04a6df76ddd0f7f893b584f7b80a2a1e9794257ac620619a581a18586b7ddb2ef185e8e6181b92a670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60ba3961621b6fcbf6239e210964a623

SHA1
3fb9c244959740c20ceabbf4ba881d7a7fb5270c

SHA256
0417e5b5cfa37dc986e7d8354946a825129dc14c04b954bb192ef6a8a9aefa15

SHA512
19451898f3b994ba14d69a0d178e71a9741ccf74ba4ffebee5737843de04b2a0fd44f3a82fc9ca74a5be8a883c0b158ed0f336eead13803800fc8c58bdb73469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3720678f56604debf8c5df87cbf0f6fc

SHA1
6b078ff66d6b79ecd7cf4a2acac2f6e9a460beee

SHA256
d83daaa84247cc4e11337f912066b54d512904ebdd173f66cda8920e4b1e4029

SHA512
f02066a6ef8a0ffebe86180792d63c8626bdc1ddf6c14e3bef20612138ed15bb60f6ddb3f7cbb488b106cb6068903aafbf36dacbe04050d020ea008251126543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84efbad15ce182b5fd0517d6e9574841

SHA1
d0f5b38e6561566a6bc7802cb74afe18b41cf742

SHA256
6c5f82a0ad7f076a6da61a010643993db9ab4ae7b05a7203269a82c7bbc17284

SHA512
b5a39f57a22b632c4f9d8387a927a7d9fcf49df3c07eeda5e904c2f99a0c3b258ea808394f684b2af214a63854bc7a474b4638bb3fe3e54f77f89847597482d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4ead8a99c27093d364879858ab55c78

SHA1
ca074f402f2e06f8de78f6079da6d213f1326344

SHA256
17a57233e9fb20c98185606f5998992eb96c131927075d02500bbc1d5dd7d6e7

SHA512
1765b64861edad3818fb357165e1791d8f69371c42d3f145847fe8809ea40b464ccc95afec58c03d784faf2a6e1828d053d01e87ba279311a764e5fe2eb3af4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b1d07425ca9e44791b3640d8bfd751c

SHA1
2853ef49cbcafb35744b0953eba6b3fe71fa8f5d

SHA256
c581acad2c4fd7c10de4abc0338f50e07770c911ee8c7a9d2e941e3de068287f

SHA512
71cdc431c4c23d168f1002129f1e793b0b7cb8af7fcd299c4dae4ff2a31dccb5ae3305d216550be5d8846ee601906dc7004610a12b78403072cf0e0f68f04d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
819bfde71b24dfa05837c7645a84bad6

SHA1
ec59c5474f865c5c44115fc0b0540796daf3660b

SHA256
5a6d6dad3a27e7010ed5e42140dd3c81e5ae98e09ec5e2f72dc127152e10a39a

SHA512
29d686d201aafdfe34cb63aa60a0281d757a9866a98b1f1bfd2b4a74225f2867fdbd37df6d78cfb72984d947c9f8f753f9f592a7231af94b4873ddbd0b9d8b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ac815d81505a3733aafe6b85ea7e1c6

SHA1
fae0bb9e5bed7c1261cb84834eb02d336c5d4e3f

SHA256
ef00e04b96b37212e86c68c12bfa447bb1355c6cec08a3aadeaf22c93b341f00

SHA512
bf3dbab12553fbeddee20a1830b734798d44885a5462f04eff8e402bdc83a32e21904b7472db6a66b51be0e38118a5fe18ef6b1f4ad1ca10ee9acb2c02c2f636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6f10d25f37f24131b83f816ad94c3b4

SHA1
4772d60ea7add34a92690da5d86e04e9af481501

SHA256
6197dbc27e2f4f3f9e34e6647f7a82ef5a60bdb47edd0616e8dd7493cc6bf21d

SHA512
767c2812bfcec7de0374bab0047b3f1eaf9711184b6410101ec8a8071adbc6585954aaaa74fa0300140812a831d905c7db5b529b158cf18b02b07a6835760958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e286b723ebeac8da71b72672a0ba3572

SHA1
d766f3ad8d74ccebfdb047e8a05ed43bfd891272

SHA256
da91421441463713e0d6dd250d03121f6db694d2e2dbc8e35b356de6fdd713ce

SHA512
c169fee89fa8c63b2c4189a68ad2766c5b529544d9d05e5c725cc46fda6ead9ab91f16c7ec8bcfb12bb0cf62cd617cd8588d166a1bac94cc24f6db66e5d5f540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit