b8efbb623e6c2493cca6c66e32ea4c0a9c59945c257b8cccd45a4518de580e43

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8b6394ae7f8ca1a8a27cfe74ebae1324_JaffaCakes118.html
Size

67KB
MD5

8b6394ae7f8ca1a8a27cfe74ebae1324
SHA1

7eb80b8702588800cefaf48bfaa83950a25ecb5d
SHA256

b8efbb623e6c2493cca6c66e32ea4c0a9c59945c257b8cccd45a4518de580e43
SHA512

0c301c26026f0a44ffdd6517a5141e7ac507306b40e03d391a2cccbe1a26fe3cb1ca696ef512815b205e6a972ff45c605200c92a74224a56bd270684b46cf122
SSDEEP

768:JiVgcMiR3sI2PDDnX0g6s+bWoTyS1wCZkofyMdtbBnfBgN8/lboi2hcpQFVG8s/k:JNuTzNeD0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000f08d1a602871acf4235dc20d2386605d037ad06f753c34aced4f74eb12ad4451000000000e800000000200002000000067023e2abc1e37d9a043ed8139824cb0048ab5c3e42d4efef1c7f4f8b8806fa79000000039ac7b603213e1add421014a6b756c112072cebe98ab82f8e61060a2ab36551ae4745b67cf646b6e325d5b7290f0d771873789422735fc3e0371c49fdbee3b5e9e0578bcce8a0f0836a709a524bac9d9cfa9bb59b68515e7183dba0517b78e481e723654fb10f8fdd79c6eeefa3c8d27051e922fc63b4be04e2b5de98b684d8b3f8ae115a53994f02c6eccdb7c7cc4f9400000006f239fd10f155e187706082733d9e6a46f1c3c61d333ad3fd52a8e899b8a43581267318299e3e1809bc62cd8eab3fd9134efbd12d0e15bbeba9e7af03f82905d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423429081"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008a440b6fa02052829f54f6596eef26b0066015bb872cdebd8af4f015caf75b7e000000000e80000000020000200000003d89344d7178d36794bde27f91af2659b125ba4f8b4dc3ae97f8ad94a86b23ea20000000a7f72b2c54b890d93bded5576ea91f82b48b45d415c1e1d7da1765740e32a0c240000000f06ba31aff879924dbaa831134a5acf1ad4b3a646092face052fbf2f517c347723b9a57354d388b78c52ecaa8087ae9ea1c8eadf2228a7c865747d261b7bbc9c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{627103E1-2046-11EF-99F9-4E559C6B32B6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a6083753b4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1660	iexplore.exe
1660	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b6394ae7f8ca1a8a27cfe74ebae1324_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c17dd4bb17398d6cb92ef86b1d00c9f

SHA1
8a5dee048781bc1466aca6b7be046b518e80c98f

SHA256
3f4a1c23103943e7b413ffefad1ca49fc6359544159d2691c7bd3d6bede9556b

SHA512
3b000f06ddcde6b5967106e1700ba607b4c44f8b6e7a94594513678b066a7ccef5926249d74d3b349606a7e1872f0f2c3d88f08e39928a8ba6d3be49aab77f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40913163c2d16d31fe0c4932055c8158

SHA1
601c276463dd8373926e3491d65546d0a8269bae

SHA256
fb451ce9b6a8b7e55b26c7e289d8380f98ebe69aaf753d1cdf5295c605de230d

SHA512
a46d3d67da114c156825186db661abb07c70a338f061c3328ecf646d5f1f96f6c552c644a99a7bc6173cbe1616c1707220ed2bed4b6666de94494816b75af138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
042fd634a860dfd8c6bb7313e5b02920

SHA1
29581bd590f2286ea46c03dd2d4800a8a5004885

SHA256
a5fbefdca5d76b65fd4860bf27d0fe406ddd12b6a5c011b1d6b46a73db22b44a

SHA512
0d3dec951dc8aceaa91020372c344bf16dfbbbb7befc0b4e6ea095ca06a6876b40f71a7b2b6061bfa82db4687c145a2f3672efa02d61d977c389b432ac97a52e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d868b42f9d93efd009c8621bf209a24

SHA1
b1a5b805c0b7913347a202d5a58c50734f05e2ec

SHA256
6435106d46298c9ffacf0c3cefbb12c0584b7515762a93912611ce2395f03139

SHA512
efeb72e8bab62816838b69b5926f674be5ff7a36502471bf7eab6b85d8d3eb28cb6db213af85950eb0b4de1f058b66f5f4eb33d9c5d49d95824fea7dbcdfecff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
156b4a41d0297c89ba3beede86ad80ae

SHA1
2f85e435e34730828f7be4367435805264ffe788

SHA256
f845529f0ba0b77b1a958fd3626b0dd320e7d53795e9dd663ee4aa03cbc7f5a1

SHA512
7ac4a81183c1c47290739879cb100f00c2ad9aaed50781f75f841a00bac17c73b7e20b5909ea00c16e81d920f83bedddc051348746905bc2843b5d623c1d4cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8c6d74f137c580a8c0e546f9d5f3466

SHA1
a64bc46743a0c133b750958aca867843e57481fa

SHA256
67867ac2857a96ab7623a1add51cff27038e5f988c242b0ab2424c6c3f8dacb0

SHA512
4f36781de94faa81de7ebd62c5382fae9328905f4a341d3e3eb17b1a66077a055a598114c2a21190c70d6f81f03fee481f4cadfe3bfc7bb432d17ac8b54d3291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d75e9ad33d91ed653b4619ebecc59f5

SHA1
79cce7d664a6bcb9548ce7ab5cf9cbfc65f5a5a8

SHA256
907a27051aa556d37e4b4fa039d6a183525946518b310da313e6d7a29155939a

SHA512
a72e122828dc677fbc3bcb120b540966228576a58e9b5d6c47476266d9e7de5eedeb562895ee20528f1a0741c71dec798cbbfd936cb87b7b43656f3ae4313b00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e769612a6baa3f31a20e0fc5451385d

SHA1
be1300d68414c299b67cbffd4c6c42b71f75ec2d

SHA256
2161b262def83d7cfed8f20de0bb4d27b692a00e675b327a4393d8e22c0caf14

SHA512
ee0ba4e3c5a678776b0a3d08937308890b8b71e19906016cb5f5d74e39612deecaf7effdff62e461376d099fb8d2c0fd9eba6dd8de99aafe20bbfd52751dc4c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abb8f3392c1ce9135918218a283c9dbe

SHA1
c0719b4f962a91eb2bd0269c27b5c61643627980

SHA256
46df6a61c5e5bf8d2ab4cb439efa9f2eccccb11b32683f079a8e54a0974fe06a

SHA512
5e80d7898699144f12fd2c270080cba6be4557dc1456428b3e0dff36ff58362f7bc1950dcbf39dbedcc4571fd3c38ec822423f68ebfd50d0af8de9c62856729b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9955dd4728f057c228fe8837bdfa673

SHA1
8044fcab10bf80c3b9829cbb494a01118dabf441

SHA256
dbabd5744a8fb7e7168228fec9b296a3effb33d8b38966a617093fbf967f2a1b

SHA512
642006933259e58226d11327be03172081e23863b19c36c8eb964ac3be23011dc3e3675898c9198e2d12bcaf9dd0e2fd4a88a1f90ac9cc91116a983919244e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
372df701dbff463e5cdc11eab2cb8ecf

SHA1
16033d8f1669eac8fbd7cbae803909cb8a6c8bbd

SHA256
740b758a00e3502efe165f18e466b2e45a82a19bfea9d42714a2bf9ed2cf79a2

SHA512
6168ceb1de8fe8bcfbc885f871904dd64c340b58e9164dee896b2aaf6f3ed3fab9d43a4d928fa914ccc40a14a933ac1da050774ae789b388526f8147751b061a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e104425aa03d97263ee4d2b48c0ee54c

SHA1
cc2359be36424b8565657432e3c789c382d28191

SHA256
dfe1f58a45ac74231b4c7af6d23cd85da701b36ce0e984dba764b3fe114cc08e

SHA512
069d990bfdf21b85948803abacae3fb5f550283bf7f1e62974696dd12a258031076e8f18bea171837fb380354f99926061345cfbd71d2dcf2c8b3bea7f115371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fef0ab2ff290b89771a60973f0b027d

SHA1
f654f9cdb900ea965fe44e0ee6e04afaf0e66cc8

SHA256
25d95ad2414c5258b55e5b0a0af4d1ca591e13b097d8741b9cb14deb13ad3f5d

SHA512
a29e74f1f31a2a3b7f36ae51992b3adc080f217ac442cd5c7a144cfd4349df63c08e9e8108cf615b29d3377b79b8f8aecfa982b7beee6b59dfe6d980a4d0bc2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efca635fbb3df9cd78bbc5198bd4db13

SHA1
5bcbf327f983aa7a0c3ceded4ac8aaa247f5149f

SHA256
d01184a71c7923fc3351d0dd7a3e249e3d9a4bdf61d6d798f4e375dca25cb818

SHA512
36f14d0f77edb8fe9fc85c4fa940c300d67b8b2faef5013be138f0255a0b7a1689662d18f791f86b331521adab1629efd459fc6fb2c4f605f8696c977a0e8b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5da218440fcec8ba3747bc1a7ff0308

SHA1
4367cbfc755368070e6d811aa067c4bae5910e19

SHA256
82196282f886bf371e7497e4ec091e032776039a6db94f96b7ef506e30e56ccb

SHA512
6585940f152ff5465633171f11fa3a9928dde053a5b59225c9e19d84f4eb30e1fe584f3c133873677c827b2cdd99a29fabb261ff5d990e08b1afb6077fe4c432

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2747.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit