d382cfc88ad95a100225d3795bff3fcecb6497a42f90cb797be896045f37c797

Analysis

max time kernel
136s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1374e6e79defe4c6a2aecc11ca5c570_JaffaCakes118.html
Size

349KB
MD5

b1374e6e79defe4c6a2aecc11ca5c570
SHA1

dbf2280b874ba395c56483ab2ebaec4cf9d646d3
SHA256

d382cfc88ad95a100225d3795bff3fcecb6497a42f90cb797be896045f37c797
SHA512

fe547227e537a6ec9788a2b92638f608462df772f6867b6bde9fda684a87c391bc36530433f04e06675a101beb38f9e4588588216ba6530ba7ad8b224b4218e4
SSDEEP

6144:S2sMYod+X3oI+YGsMYod+X3oI+YAsMYod+X3oI+YQ:35d+X3m5d+X3Y5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEE0F471-2B83-11EF-A5CD-D671A15513D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424664927"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000003c946993ae9fec729dbe449132362d864b3b879a934ae177305e3fdccc62952d000000000e8000000002000020000000f6594959d8e6e9fc50c36b6b99fa7dc08a4e4ebb6ff6291f08d348b4757fd30920000000f045ea13bf9fbe54c74159c7fc3d5e2f0934696dc89808b29418fdde76fb6a1c40000000ed7c2796b0fb21ca2253bd04303a826890997f09a57ada3b250cdf62050a005ce9a2b9877a03b45205b487587c2fe6e05cd8514917a2b78fd8b3fc1cc75c95fa	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b3b4e290bfda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000000db1475fa565668557478f8874c41531df07458792f599236670395100eabd0d000000000e800000000200002000000086ae6170b6f4e8d984d385a3c1c174656cf805a050f2c13d28734b42e838db36900000003ff26467cfa1acf534d3b45c42f79b10a22942c1bb1d1068258672422cf36eb079c65b9a57eb3ed6ddc812c99a8272e5e7cd4068f6ad0910ccd9ac6db873be61033ac963c64f7d494f9d0a6c747ed33b7ff846daf619d0be93e9d62f5a8301d0c2374a98ff0aaec727db3af9e7e4aaf8e1f691e4d05d051559da610ee713a160ffc3927cc3e8a20c459ef125d70d3ea640000000e38d63bb23c4133ef1ee63b599b42cfcbd3537cea8bddf295f9894c605183acf171c9ac4bc7f284be67f29ea4132c8b2e9870046010cb4d496015d230a782faf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2464	2032	iexplore.exe	28
PID 2032 wrote to memory of 2464	2032	iexplore.exe	28
PID 2032 wrote to memory of 2464	2032	iexplore.exe	28
PID 2032 wrote to memory of 2464	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b1374e6e79defe4c6a2aecc11ca5c570_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
811e1b088575cca3d253075f44623755

SHA1
fa56bf2ab4d88ce2394ed188d7b58d86f4338d1e

SHA256
40d005dffdfe8a2303342ec2df5cbc0082f492bfb61c179b7d97dd7612c6ebe5

SHA512
6e1bc966fb696e55156ae11d88a23448b55731888a2b5a6a00d42d818069340d6513f8943b8db72c611d57ac6f0abd4789132cbb18c6456c7097358ad6d5c09b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32b693c500a1337f8393089da7437f2a

SHA1
350ff5c4b2bf48af7183c4d643ed6fc54ba1092e

SHA256
5d57af24d87ca2c3225e7828d9ebdae40177a1cf3ea4f06eb1507e9063d44a8a

SHA512
54970dce2b10664cbb4dc1e1185837633299c55b3caf398e2e770da394e7af6b51397c801166558c6d386e43cf976f47917937de40029aa6661b46537d967fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d16e3def7c7709f985c363140dd54301

SHA1
c353f2c086ff4bce1400a680ebfd31ed6997fcc1

SHA256
4d5d7947314c35373c4af4b70625de1281f1f1ef3f1b3384c7cf87b8f778e7db

SHA512
30479f463e507c1971c7486237eab170c7354403202edb9ca2594479c4f8e44e16be012c121676e5250b33cc85f7c23cd64e91915dc0a71ea4e31aa6807aec66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4767b6428272a58567eae240036dd5b

SHA1
8ad4eeaaab1321d5a6c7b71dbf7789c2cc2f669e

SHA256
d8fe79928553c3301b103ff68420a2b08909e2a989c13a0097ddbf7972c067f5

SHA512
b19671e3119b1c1fed9813c961b737b8627cc78ab19efa44cbe54342aa5fdea10183cf80469432d62fe316bd46ec15560e0d635d78a7d329c10d808e5bb7f723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
118a9c22d1a6e0f1bc5381813d78b4ff

SHA1
d68bfd76a29b0db1a685c42beff7c463673f4617

SHA256
5e869ffbccc48176ba32da64376c6eb6ed70fb8b41dfa858c92044fb57a0bea7

SHA512
95780c15389ae705b27b92ec2aaa0539cd8b4dba9b1319cc19301b518bb8bd26e66520f50e2905150b4d801e8e610ad0143caacda93f6dcd473aca60039a363a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a259801aa65c1df87799415123fd160

SHA1
e44d5c5678cb9fc81d97c33d10b6cf98d9c94eb9

SHA256
5984d1a2788e17b5e473351be3a778c36c2d57b46c10e3d9670ab84408a0b3dc

SHA512
f7f82005d1b9587017058f37dbfe9b8a9ae2015dac2cb77696eb724ea035c7cc29fde378839841341db821ce40e9b9a1241338d4d6cc6dbda9e67988f876735a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83a7034438e0d6d2666f1b3c2597a49e

SHA1
825e0f724f11ee1cf709e293e67a4e6ea88f5f30

SHA256
d751559485473249095b392b8e3850ff9401a50736d6e435ac40423f5a9bb923

SHA512
da8289502a853025fadcedd79877359b646d621fe81299fc3a3b65a483906c59bfdc88e1e61d81fa4564fd36ec577cf9ddd104db94165c5970c45631718b18bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
552fc2f907bf8de1ec3b2363a638996b

SHA1
2909d1ebbe834502de737bdd874d254b1ee6ff2c

SHA256
918f3ed457959bed662865f8157ffad09beb80e7e78d59ce8b53df707d27b938

SHA512
c086c32a3f33b8b10a84d86f48c182da1f5731d09ecd7c1861b6797e96e7385ab764c366544e06814b8ed368a503d4a2dbd9efc76750e0557e277fa634121116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc9e9c0f60ac6f91fb1d939a53537c3d

SHA1
e0cfa9a1ffd9e88bd3e2a27c33c51dcca61697ff

SHA256
5d32cb10c1e8e0ef5bba1c9a4be03ef69313a3472d26e4fd8ac152d44ef8959e

SHA512
4ac4b4d59e6b32b42eef72ac9d3b52ad9c554da64c506816159ae2042b807d4a42a0c3ef2759a08611ce7e9ef34ec2a4afce18f894d8a3c9a14f1e6b7ff91a78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97e831f733e94a451c7f13f73ed4614f

SHA1
8c65e978a9bf7488a3c72fcd5f9e88e96589ffba

SHA256
a322338be906217ce4a367167dbfa9d7e0d907e3b0f5a9779ddb175d3ff33709

SHA512
72db4c7bb2f84b64c9c5a4ea5bb01a6a6f3aa62bd6508efd5565df76014c1bb673f5eb4c20bf577291af02e38b360d55305534dabb848b775c89c56be9b56cc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5eed07f8572b82e78184986e051952f

SHA1
e8fd5c0d78c6293c00c23a36d9f3976690aa3260

SHA256
a00271faa5130e7798a4b529969016583bfbb85e0e82658cafbfc3d8432c95fd

SHA512
af0b1f9d3fe63712318d3907c522823ce837290c76293e22d0111dd55ef4cd15ab33952d8def8373ddfd844ec5a4b3a765dbdf4e9d24e39ce3652e1791be1c7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab233C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23DB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit