a4e014a80e1ed57ff6bc8965c2ea33096bba04989c9ad47658572205acf58f65

Analysis

max time kernel
122s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a6f8630f1dd0410fc8bcd69270d189c6_JaffaCakes118.html
Size

32KB
MD5

a6f8630f1dd0410fc8bcd69270d189c6
SHA1

abfa8b4296c923b2125f12891909684acba678b2
SHA256

a4e014a80e1ed57ff6bc8965c2ea33096bba04989c9ad47658572205acf58f65
SHA512

19f4995e47510cff0de4876c82339d49bebf5877aed2946a47d9eadada8f21af61dcef7a5b7ad47adf0f37d3ef555176c5b06e5bb4d8158862d9c8b9805ad4f1
SSDEEP

768:Wv3fLaPm4LjILaMdD1gIgCgMqOvRgyD8zLb9725b6watjKR+:Wv3fLaPm4LjILjD1gIgCgMqOvRg28zL1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000bc93f1c6ef72947a2b31074342694c300000000020000000000106600000001000020000000c7c2b8a56a4b9664882de90cd61af77faf13ab4efcbbb78a4435576e15d9b37f000000000e80000000020000200000003e1724effcc9a85e2bf23384947871d5c9069ee2698946ff4f5ea885c19c756690000000815961f02cf2b0b308b7b3307b37bb0026448a8fd4c55992258b10abcb4e3393a0cfaa5d056d7a6071db49c589e10428634b0c3d0924984b89b30259f7aedc2989441c9f8316363746ab341cc965b3522dfb4b7a604af92673fdb2b61e7922bb072d366b2411f8c4be86f9a6fd69c1643e3294437b11d04f269b5b20476504724651088ee32f8e719d8141a7f8c6abd440000000db04011a77cfe5816b1d45e18b4e631d9d6b8278450556733f6a05fc261f03878c6dd135b593c9d19a135acd786c35dfb3b60d5a1c51eee38868226055555940	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B66C101-29D7-11EF-8221-D669B05BD432} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a39913e4bdda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424480878"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000bc93f1c6ef72947a2b31074342694c300000000020000000000106600000001000020000000360e57c6cf8d7cde97eccf7a015b2fa0c8a4dc2b1c5d82e12912c18e87a2f621000000000e8000000002000020000000ceec24e54effec77a892921c7f6a5036c20b889e4d2581f4a67a6554024b799c2000000088ecf7b60d72b1d3118c9f5e12e216e623f8ddd08665fa672b7b4b626bee9f97400000004dc23cd03419aa2eb2569e750fd56a9e3c7bbbaedaed54ba2b284da2de06df9dd1760b57e33d00cf6c9f441e3c0d67b64ac1fd866b45f94b71366742515e5eab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1196	2004	iexplore.exe	28
PID 2004 wrote to memory of 1196	2004	iexplore.exe	28
PID 2004 wrote to memory of 1196	2004	iexplore.exe	28
PID 2004 wrote to memory of 1196	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6f8630f1dd0410fc8bcd69270d189c6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
893832db27d0089a66da3e6329fcdcde

SHA1
b87b328f33706d5b472cc81fd65a9fddc3d0343d

SHA256
090aeb92c3b3114ca1f06fe0e3502c35cb3df8c35d011084d0645e70a44d944a

SHA512
26c22dc6cf2fc94a4373d76ca6acdd8de4f8acabb7e32bfcc79b8fb8c7a6717e9fe13254f14705e43a86a83c7efe4a7d247b4198caa2eb6e8edef1c3e0736204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecb4380a9bacb0ac5705639714d01c72

SHA1
a42ee6c59738d606e229c8157e34811fddf263c4

SHA256
09f4584296f9f7b1746dae1e9582faae67ceed96a6a8939fc3ca02a7567a314a

SHA512
edefd1ea37cc4c747882790e6e897fc8db002815f6abaad6d89cd609b5673158f83906b088cbfd9a80cd30e35c033e0fbd2a859624e99fb58ed18b29c07dd635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6451efcf7c8475015b06e156c123fd5d

SHA1
7bde3835b9390176c8b5c9852de6a7493bc7fd84

SHA256
ecb756f7b860c2944a1b61bcf7e42d0f420d820d22587e53953533b63ca3cd02

SHA512
79022509251565a2988900fafbae400d203e4400020d6e2542b3521d3bbca41b9b130076ab633df9ff3d2dfc306033d066a39dad848488d8d700895cf7fcf11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ab43a8e974d1993e62cb1f4e6f213bd

SHA1
614481aa7facefa224f1f80a752532fb47b4a895

SHA256
561f01c22552bffc25b15e52e4190d0cfa37a4db338aa458d1792e17ad0c98b7

SHA512
e2db8c9df2532af3cfe95a8adda029d774794d61920dea0e94ebf4830dc082b03c41fb1c8386874c2b3cdba273e64894fec0cc30ae4aaaa9b3a0d590cd380aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6b0d799d6690dba6495bdc1c997967b

SHA1
7838bda0ea512edfbac4597fb258308c07ff21f0

SHA256
133c5ba3de133c1f12ab5af6ba0535946e8c017d568cb24609bff79dc6d6a22a

SHA512
bacf80a5517dd649cf0700e9deb4c98705aad36980ae0d112695f0d03130a9e328c42f1d44280cb3fb87ddf534202a02ea1b8050197bb5e21c57d78928836101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3292210019e85aff07432267aeb5ccb

SHA1
83210e993b6bb216bfde2fa043e3e9f541224804

SHA256
a040146d96d2f6996f0d4ed5e2ca1a56d6df2c7349b54716ff647bccdf99e688

SHA512
de0539a0f149976ddbc8d3924d836f762e60ec32ed0d8d86a8b79c0c908f9f5690fee3a6ac4fc3de629d2db9a36a79abb0a2893dfb86d4a4ff849d6908c13056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
836f5a9ddf9a4bfd6de68dcc4abde267

SHA1
e8fa58e7f9344889055515b1680fbed584488a3b

SHA256
77e1f2cdc14f816e87483bb43ca925d106d2bceb19984cdfdd8a555eda24088f

SHA512
ca067ac5b00feb206e62b1f307d4c2391c783b63ce73e9ffe3e4d2295f8373c652cf1c177dbef2fa7bbd8b003c02bfa38378e47c1173bfeb9e5ff579f909e583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33fd685924b84789492f2a34dc2d6578

SHA1
7b6b70f41ce31aa64b90478af4b54717cebea2b1

SHA256
f7eb1426b1a0458b5add1826e74c0f70aab75c380cb336f94e1ddd98ea816392

SHA512
5a493cc26ecf6b073fdfc81433187f0154628f6d5abec9309360af06ce991b911cfd5fc87f18eae84e82a30497958315b2f26007daa33f42d3db960bad4d00ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de462c267875ce7a03d591c1ac670a33

SHA1
670ec55b1c50d0692def24ed61d36d765ebb6f96

SHA256
4bb629beb6df12734ada127839aad43bcd6099c7cf9a734261aa87ecbce772e5

SHA512
6c7f343acd5c4439d04dafd595fc6888cc97b0ac58f55742518240bd80d011e4fa8f4dc2656a627257580fe7587c283cfea1b5260d4a61ace37f92e40313682e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62e315721b171c24ef7b9ed61bb6ee12

SHA1
0155451aad719cc5e2265f99bce13f57ff53ab1f

SHA256
9fbf83a039b7a017a853f10470fad30f70beaab004b7436b02a8a93f86942bb4

SHA512
6f7b84d71a21d318ec69051eb0efe647967eb00b644a70fb1ba3a31a96c39fd7e9643cfc41fcfff314a47b2361b385ce00386b51f85761d9c1004487c29bcb26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
453562dfd99edccf328c7d719a0906d5

SHA1
a44f18d16d08db28b4abdc04f49e86198b5a77e1

SHA256
47a82f7cccd0c514eec8c29fabbda3688fe5bc35afa7e8aa76e29e4969ccf5c9

SHA512
e0edc52c789639cf6dcd065b5b43696ae65069011b936a3fde6dd60362bf0d46a75af6b212cdd99b389bc82ffea0372eb002cde85edade8d2100103b0f098c7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d9221228f4abc53061eae7b7321dcb3e

SHA1
c3f0ce45dc08608447bfec113aacfb09df394f46

SHA256
32fe9ff2eb11618668a52d07a85a1a7248124582b707b6cde7cf3bd9a7e0f6e3

SHA512
cf89019e46f0b574542818380798cc79c177bf41c46cf83696516bad7572f1c3c66529a5af019521492e857d19cddbf424872e06ab0db23baca619222cac0707

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EEB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit