6354678e10a6456dff7f6e48e7f680a82fefc88e0ff5075707b5d043f3277978

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2cf1e0b82510cd2ca34f622cab12693_JaffaCakes118.html
Size

59KB
MD5

b2cf1e0b82510cd2ca34f622cab12693
SHA1

1997b44fee7c26f73dc636b9c312cdfc642afba6
SHA256

6354678e10a6456dff7f6e48e7f680a82fefc88e0ff5075707b5d043f3277978
SHA512

bb2b964d2a69672bbeddfe4e940922488a816468679f549e408978a4626ab314560433c676e592314dbdb53fabb0d82cc20d04c2138c37d7fa942065c00bd411
SSDEEP

1536:8IRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZH+5:fH+mFkiZEwAF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C258B51-2BC3-11EF-AC4C-424EC277AA72} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ffaa73d0bfda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000006fe62266972adc3bad39b89b5d19143a2b96f51306641723114b13269ef8d02000000000e8000000002000020000000e40f336689a81f9f21c6f223cdea75b5e705fff5e510dae3a79f17bf05e604429000000001e768101872d3640dd570c56d7b73cc7918cce5271eac22ba65545d7651f51998a2ba83891b411efbfb367b5b2e41ba51fa62687369a9ffdc94d33f869b0da0c324021d6805d19316cf1671b7414fa929a95212594cfcb006277236bde9af773d6379b681de405ac5fa99cc4187108ed9cf433623cf08e6202942ba10f99da5b934c4ccb02349da63bb5d47fdec6d014000000043c51992162b5d5f16874cff38ab7834622bac4a6d980ae5472dff840a97d7d1bfc01d04bb9a6d1f4add3cada9a56c9c68072c91cbe276bc8c7c7abcb0cd876e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000051a75655e12c6ef5abc6457601e4a909b11ec7e5d5c919ac3ebcf41efbc41e70000000000e800000000200002000000022d21518106cded64150f333c92228999d8eb1bc1037a2fc990dbe50f8eed5e9200000009d60ca3854258facc6e70313359e5427e4d762e2cd41ea522451ff5f50a6c55840000000efc3ad1bf29286f6b8787ac7fd10eae81c47d03068042a3e7f98d81492e18ee8cec378ffbbae43ebeab6ae1d0590be9ca62f92efc5e7a071953f93efe004a1ef	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424692330"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3056	2852	iexplore.exe	28
PID 2852 wrote to memory of 3056	2852	iexplore.exe	28
PID 2852 wrote to memory of 3056	2852	iexplore.exe	28
PID 2852 wrote to memory of 3056	2852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2cf1e0b82510cd2ca34f622cab12693_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
017971b78fe9431a14fc77fb35de973d

SHA1
016125be0616230816ee78f6298bc49ae78d5b96

SHA256
249bf5c43d45446a6b736991b0c91c6aed0ab678575caad98e9b3b198b035efb

SHA512
5dda106b78dce46e057eac3f41f751fb58a7c7d890727227c4d59ddd7982a7006eedf2f4900f371d4e22206d7e018480d29b86d41811de456a4985523ab9a1b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0bcf6da2ac0bb18d7cbe94018dd821a

SHA1
f58d18617fb2c69d3c8feff4454880f04ddce909

SHA256
e269644ea998f9173a7454a271f9c0026613a08d43fe0807bb219958d700940c

SHA512
df0219f63119dd0dcd4fef895bbb7670a02e2f7b636b848c46cc4c2f87357d90e877e0ed5480cca86e66efbf6a8c745557d23baed2f0c8b19525a520da732aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dea3037867e99978dc5306f6d1932494

SHA1
ebf2886f1b20603b117c5a1fda228ab0d120b608

SHA256
9c16d5ec547bc7487799f8d0c9f2b26593c1e26a991a752ccddced4a021fef5e

SHA512
d25e6457809f7defc3670e78c08ef49f6e56ef668b41929d9b176ab9f8f36967e3b28903cb145011ad28e9f23c3b8130f79f93317352bdf758eb8034fc199eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efa2738ca238e2983d7248365ea8644b

SHA1
622ec269c09c7a3db1e5550df8e3583c7d285b0b

SHA256
c13d7a8287d8935edd078c643414c0372d005c4aa9f8b7330c9523f88d34387b

SHA512
b7e86af34ba8160186368305854a75dd647d4bc0df70c726130e27dacf009c1960a8fb907a9d3593c629ae5887094dfd8e2558f303ff236c2b56c740f248a86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afb25b7202b2e017b7c22af37631991c

SHA1
649fb76d038ea286e9c552997b319708568d3b04

SHA256
81cfc518e0604bef656e4fadb72f019c4d21b92055eeff07ad3ae06656e94f36

SHA512
82e91b4ea81e26dd8fb3cd9aed1582ab7be068c2df698ff754b1be6e38b2a699dbf24b8d8f5510b1a1869f881ff5d7f0460f52dc14ca096650fc2a16a716600a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f2cabf44f3f4cf55467da2fcc87d9d1

SHA1
4e9de5c29a79769773609418d54091e3a4c6c41b

SHA256
c1ed3a4e1fa5116489e9eb2996e15a8d9965d622adda5f1b39d6fbe98c5b8cf9

SHA512
80aebdc344f69a32fe032c53e9373f775fd47e9d8f1f5ed97200c269255b1fdd5eab04e4fc2baf3483a6b177e416787f085e45355f4ea5770c38ba360ec52c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9daf2b00891a14efb791747b3e11db55

SHA1
756fa9884d58bbb31e61aa61c44b52756e998e1f

SHA256
6fce63827bc3cf3fc7fc83ceb6834e02c35bd5d8ac37edcb29283ecd4c09aa3b

SHA512
dfeed133b18259810f038167a850111a28e02cd21d5c1205985c57e486c9ebf226624c1777e3f65ffd03aaa2c52c1c8cc3259e24ae22027a8d8d593649705e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
366c47f9e630e9d555a9c1f3b7c99e6f

SHA1
25d93b7bbf2ebd5439b66c594faf18ee6afd4445

SHA256
c029965f7216c91dc1ff9b3c2700cab18050bd585f16707a06b435e913c23bdd

SHA512
8a86756ede381b10b9bb38277b2b6d5fae0d6f86b0644b6dad9554e79772563bcaa69af2bba038b3e85c7800c81c82a90404551990f75ffa019d5706862641d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1375c1573cf64b5ff3963a28102619a

SHA1
241515f6de8bd2583952116acaff89158af9b04b

SHA256
db6c8c80eac1cfb6d42472697bd4bb1b6c42596fc900e88d3171141b7f57e06e

SHA512
12789f63b61934fd90d646340bb016eb7492a18b9dfc3b503e0bfb3ab7695edce1a984a13a5a49a51e90aa8b66fb46779cd35e76a527e01f7fb8e9ad42e71dd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66f56a3b627bb30a2dcd17674ab02569

SHA1
b83c41cebe58c3345a7f8bb72183e17d9616ae6d

SHA256
f791919e8f2347c20ef82cdeb5930fea08f504832d6e02c47d63db8c2eaf0ba8

SHA512
17e1ed70df2a159e6ee61d56b271f2785c211ce30afa7bb359ae35d968f5592ae74ac6cde8480591cbff86d93973585827164942c46779602ee7cca18fcb7447

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8373.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar849F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit