c6bdde1ac01bf5d697f89dbb5da637c7aaad06531a962e2a8cb3a34ea4a5c024

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9559d1e616554c6ab523a77a796d9665_JaffaCakes118.html
Size

461KB
MD5

9559d1e616554c6ab523a77a796d9665
SHA1

4d9d030e1f8592847967ad368af26c6f4fbf12a0
SHA256

c6bdde1ac01bf5d697f89dbb5da637c7aaad06531a962e2a8cb3a34ea4a5c024
SHA512

fdbb495faee33ce90b2cd3ac012d31effbbf8073094e9711a567b43dd3d0747c6abe4af83104c01069861830dc911acfd143919f35af67f74b5810f54b8f4340
SSDEEP

6144:SvsMYod+X3oI+Y3sMYod+X3oI+Yu+sMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3R5d+X3l5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec489e43473a244b9ee1c1a82d0118100000000002000000000010660000000100002000000042cca524e7aa23764e47ffdcc3d9510b9a91a6fc546d017436aabbe93aa538bf000000000e8000000002000020000000923f5b17c71a5ff2bc033b788c09631777c310b007511c09317767813a5dd00020000000a3993a02cf84771e4d9b682460b68aaab776bed5a4162d3ad22ff79d5147dc2740000000f20c7394da5ea31a7e6f8e3e0218cb079340bcda393132e211b10395cae6379b85b7f7ace7a8c3ff9e49e9c3fc608dc178a9724e555b91638eeb60b08c510b4c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8071d38793b6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423676603"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF416FB1-2286-11EF-83FC-5267BFD3BAD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec489e43473a244b9ee1c1a82d0118100000000002000000000010660000000100002000000094eda8b3f4c1edefd7a280f1721e7e0fff7269f1b680d78538c2330c32cfcc2e000000000e8000000002000020000000f2e5f13482dc2f962287e555afab5793d6c7047484ebc4143d3fd061caf8238590000000c4ec6ff625bb4fe0c0151fb220ce54e87c971b414b711da89a6526ca717fa53fe0324a6d358bcf3b11848f8beae17d219a5df741804c3cb794a95669b38fc3fa3a69cc9744cce8b7bff600b9985f71a4a7270b3906eae77d903d8f173d7c31a9f0be03c50dc89a27f6932ad6cc29241982504001360e10253c98e94cd1b327eef09c1f324a2ada04c1eb91d866b0ff7c400000007d6e57189a4a79118bf394b12df06ce6b5c5558682f709738c23faa02d63aeef9a1483c0a269351a85698d9bee53905c956a21116bf7c543928befa2c6af737d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2216	3028	iexplore.exe	28
PID 3028 wrote to memory of 2216	3028	iexplore.exe	28
PID 3028 wrote to memory of 2216	3028	iexplore.exe	28
PID 3028 wrote to memory of 2216	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9559d1e616554c6ab523a77a796d9665_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3471b229138ee6a6357d72fb4abec4a7

SHA1
26a50a48ada43adf8115763c535cb1fc385d0871

SHA256
ab7194d37ad721c66d605f837e84d8e7f5699f10f79e9f9bfa226c96711bf31f

SHA512
56fc01335ba95fd95693cbf8f33697190acd8d7743bd8a90ce24575389cb3eb735eed1d1df1a3a172a86524920184040ee2ddaaf5bcbf5fcc468b4845418080b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
903d68226e126a4e3280402bfba924d7

SHA1
83ba81ae4fc13796bf797212054cc81e47bccb37

SHA256
9b71dff2dbdbabef3b78b20c001030702ee4e43c13cdfb69a1d7ecc4436386c3

SHA512
90292dbaacdd933646d7de2d71d7c1af5385ef5477928590be81f950ebf2a99fa62e0725f207431a467e10733295da0c8b4f4467abfc357d9404835d1295a3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36446190775042b62e1f4b44bfc435fc

SHA1
a65ad6b990e6575a52bbdde719759f3866d24b97

SHA256
7a3d7a4b5a5cb73240a7bcbf23dde2b4c3b2f014f2b7b441a1f4fe69263e10dd

SHA512
b64b3d06806b6f492b92a1f2e2e95fdb804b535c396bf8557a7cc83eacf949edb49235b2be5bba9c68c83a5daea8ec36b29183f5cca73d98490e6c9db161b0a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78073185b4cde5064b7accb6b79162de

SHA1
8e878c8e7def96254353b9d6193a24210a766659

SHA256
049715c4455e96ff88ba1acf736b9fc3488ddf63f4dbf38ec4eb692f107aa9ba

SHA512
be1503f3cd49081650977cf2d7a5a2edc2bfdd40e73795eb499da468c04057920e3087fdb22bf5d289ba67b1c5c86c4861f072f8f7655e85d530ecfe959e8eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dccf657d93dc12ec778c391971a139c8

SHA1
21170810b4c548c80915f8a73b8120ed0190f682

SHA256
ecca807b56ce39f0867b40b3a52d1157c47f58218fba4b096737454fc5abfda8

SHA512
2bd58adee9515aafeab06de1a33c5cdeb9da65f95e4c179970c4deb796dfe576a02cc23aaf6a3e79c10f1d8ac7204c5e8d439efe90ccee2009097ff4f67c1f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71ef434d1cb38310f95afcacf5c1f031

SHA1
f6156d323c7830a09939d801efe554037e627a4e

SHA256
b0fd305029d13b17af68736ab07e94bc711a14c73967e6bf1afab96e7e13f4cb

SHA512
b05ebfbe27d25294fabe927fbb14b4636940b7d8e8755b7430da628c8ca1b7e65b949cdc2c9abc9a3a8782788f0b8a4ef37dc3c3b4a41b9591d2ee5a9e164ab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0eddf41014598a5664c7ff2b96b58f42

SHA1
79091676c118ba39c056a1e4994a410b6c8a2922

SHA256
bf1aefba29c7b10c972f7a435574a442fa7e0190d3dfe79cff9cf26a0bb26540

SHA512
5ad145866ac2319824e1f8c2973b358c330f6ef35750b2ee197df47268502dd14b6ad784e82bc6519f9be5ed825d5f6397bf6c923d7b9bb60dc37b3ae8d06da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aac87364aadc7342e5a3b7b5f08e1119

SHA1
d342982d8ca62656b582ac71ce57dcd1502eb12d

SHA256
d1832a91795a618807554d65d855e5fbe870047e13185929f60a5b13d18f7ae8

SHA512
fb66bd14b52449ca50f985ee4a568b5a522eea174c2d7777b6a1a96ba9bf179a23adfa2804e8480dd59ec5324f7f577f38e6dedbfc8a3e9dca2bbcb81f19a578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91e1888fa4416242310784f76bdbf67f

SHA1
af87494bdcda21833cf7f28ed7a81e2c9bacb07f

SHA256
e4323e56e486b9349c504c6667801a744e14371e8e6a8e5d34f5671b749f6a7f

SHA512
88788e8d232f9b157ccd4a955822d6b32dbd4dcc5bebb78e4f08c55700a0db9dfc369c98d3fe9b8012df871433f945341a49b65beb57f16264c22b39f2d41e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5f653101f7d77df2c81272f2238f044

SHA1
11b52d5f900d6fb7a56dafd5a58bef9579e8eaa8

SHA256
e09ab2b64965738725b9f932950c0c35bc55f658726fe441cd1cde320554829e

SHA512
31cb13586e4f1ff8183dff1cf11f16950185eeeefac6b0328a96513450e82374875b9bf7e4e88c195cd1573ceb4de21fe02abc60f88e5314b311a571d5e2029e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d70c4b49ac7c624bfc3f5684f198270

SHA1
ca4d934d8079719489e5d43eeeec0728a241e820

SHA256
c374ff2f5c07cea4c86e7114bcf56b7b13bfd107f27deb025d6c73a438120a3c

SHA512
5dcf78576e640812c1fe1e43ce180c409eaa461aee8405094824e0148427484c1fafe14bc6b11197a6d6ec80b316589c999767c9fd726abd84b8e824d160ff10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87c9beecafbc9f5bbfb6c5924f89e974

SHA1
d105a86c9ff2501a88d2b7c7368807f1de140317

SHA256
101c554000a7ec0b7e40ed8e6fb71459093f416d48e4a729daf723676288f588

SHA512
774cb448e1149fae3ab8833b6553399884c9b73de852ab99dcce7b6311bb7e8a9f7eaf3b2905d89765654b2157a55975c4755af1b5c4cba7e31dcb444e4c2af6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88d8ef8e83b06f2c8167f35ed85e6e5e

SHA1
0b8f96c407516c73074cafad962cda9d16cf8c35

SHA256
616f0f64e1620a247e3ac382cf37b5bd21e3bf827c76acf39cd96791bf01debd

SHA512
97900d5478eec880594954d092a28cd501c1ab13974cc2cf12c1841e45eb98ae32733a4e665125d9f38a5f909e4a6ab40e0eb6fd2d5ec50b952dbecc48f34526

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49B0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4AC0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit