66b1c38873afd44f3b09bf555f37a4917e1a495e6227e67264a520561c8b7a2a

Analysis

max time kernel
137s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b3e2fe93e7bc836acf24b4c7dd1392f8_JaffaCakes118.html
Size

214KB
MD5

b3e2fe93e7bc836acf24b4c7dd1392f8
SHA1

55319231f967c2020af4477f5b10a60884c6bd68
SHA256

66b1c38873afd44f3b09bf555f37a4917e1a495e6227e67264a520561c8b7a2a
SHA512

c98626bec567a6b142e0d20ab2c4426df4beb04a6716f37a7f1cd2dcfc7515861be438de6a63c5ff5e4523e8d95be1203d14655e47abe7ec4c48b2597f9de8e1
SSDEEP

3072:mrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJC:+z9VxLY7iAVLTBQJlC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000002cb038ba721c0226af3acab27b5cee352a395db9486b43811b09d50311ed5693000000000e80000000020000200000004539d268ec79811b4c4686e49809f14228ca535d6d61b4ecb2ecc9ec4f011d539000000021385689b0c216ea343e0305bde6ed82d9d0c73e6191e66a24332b4d5f81ea0ebb78bade168138901706d34e750f97053c3ffbcb76bc121ad1bf4b163ddc8d70fd871c2afdece022b70748d6a91c7705202c8ba3ef038c4cc075f7922da783e293df567d9afd62e37fbce6b81397b3ea47aa2f463a763112b70ab399a2b424ce155f3d84dcbb9355af3e323e305856db400000009864a1ee31163ddeb9034698c10465baaaafea3a6ce88dec5a46bcbe092aa3786bf2d68558d05b3f7e8c25fea4e05d688e907faa0dd1bf0df456549b171f5de9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424708489"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000037e5115cbaaeaed55a5112e320ae230159818a646c9452a26f983ee6b6624591000000000e80000000020000200000000b0357a483858987b05edac7018ea074beef76aafb16db5a6ed626c24af1b85b200000003bf47ce48da818416a244badb0021064368ded77a11346b8383cd0727fc18f7a400000001c45d88cc97eb72f4bb1a3d75dc1e3a855d9fddf1698d66d280579fc40c6a35a498dacaba0351cab33b3f0c04fb351681c48ed9cf3cac0db3b181c4d32d9f928	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36678131-2BE9-11EF-B489-E681C831DA43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70fa7b4af6bfda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3048	2268	iexplore.exe	28
PID 2268 wrote to memory of 3048	2268	iexplore.exe	28
PID 2268 wrote to memory of 3048	2268	iexplore.exe	28
PID 2268 wrote to memory of 3048	2268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b3e2fe93e7bc836acf24b4c7dd1392f8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00bc8bb7cfbb09037b3f8c69ff8a78d5

SHA1
ee5bdd1b5df38874f483da65c3605117714067d4

SHA256
6a5e39bdf606a8a3284ef7ef821b2745e8adb03520f91782ae2f494d6725f6db

SHA512
185560dde89b2469f2f237be490b65cc2aad68b70dfc7c2e4ff680c109204a7d3623a3668c49b84440c9b36af4c9cf4bddb64cec254a2ffdf4f8df7fece7ebc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91f7268544c5baf014a6ae3426cbec28

SHA1
323b6128f58691f859764d2cb8bcc0f46d8f9ef2

SHA256
01439a4683ba61913d1bc31269a35984fd4a88764cc61ce304fbdeb9cda4678b

SHA512
cdc693158685022125a269d411b89d31b6828df64f24c1d7175265b1ccbe119bd37dc986c7436482ddddda44d315782b3f32a535a29bc39e3d91e6f1a02a8f1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ba091119bd72698f580d6c67b2a4f2f

SHA1
9988a656a5d447c5a9f11607c7573e565c54d2d7

SHA256
37c1743b071a969623c612ce2a49f28aed6c444a9877ec84f5a129f61eec19cf

SHA512
478eae3f185e455b9060299b1fdf35bf5468afc0d120093e3be9326c5d71537b19ca974f0a7a1a12360d509133778e4443e1ec8ca43509389d8c793dbdb5945f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e9eeeda701b36d3cb68e29fa3484dc6

SHA1
63bdd825826b448a7ecd0a12b0dfc5649240e525

SHA256
75e7ebfde92ce429f26ade42c5a21af860c4a70f3ba91e3b440bc7bba9a178ef

SHA512
ee14875725270d3792707c07ff0f1a0e8d40810218958a06966068a064448764bce41389419a2408aafec87fe9c82249226e11249368ead2565f12abd34b84d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e822b340a0310ed8f92547dbeb16321

SHA1
096b16fc4b5f6a00f101a6cb847872f5607826c5

SHA256
bdd6303383f4b5089b6f90b82259d76dff765cacd6370b517cfb781cfe8bb68f

SHA512
28c7af85cea2b55b4b666196537282607e7942f13629a4509c274bf482a3a87847044ed41c625cf62e3974dd271ead94320da7ba4eae734181f7b25d558037da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3232582c9a3fa6dc761802756291fe6d

SHA1
38dbc602b38f7ab0bc108b01cd6ca4ff75b17d4c

SHA256
6b7d250bf8c7db8686fe6d5d9c6344aeaec4e8d88b87076b8e4d210aa8d4692c

SHA512
6051cc46bcebbbe117a1ad0db58aae168f2afecccd3b001fc759928c00201b54dd86ffd399fdc4cd6592a4ce31263e7b864a1e607c1822a67149280bfd09cb55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
734c86784b83d4f1ae4127e344b11964

SHA1
d3427486504ea96dbddfb88489b95589cc7f3569

SHA256
42982ed29b34fc0484457eb56853654a079d5a4a481445e0b9beaf1431c7ce8c

SHA512
0f19975f9658d1933b17651fdaa75957bc7006d7650edbdbac8023af84bfb68b834106cce12915fda80c171446d4b335e39bac8128d1dfde7d109f5709fe8ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c36e158166d14226b4110d71a0e8b46c

SHA1
cae66ce45f6e7e8e3decf608e71bc7c219969bd5

SHA256
19d9222ae3cb844572f7a8ac227d07c74107b7efc737247e8715aaa36172cc82

SHA512
3ec577d417ee4bf7d3cbcf416d468f53764e6e2627cdcc152bd54159d429a8b85d559fbe6494cecdfc622088c48d03dd9a4571dff8f98af07edc56478414bf5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b14c88bba9874cfec8c8c37945bdb88e

SHA1
72ced57631d929d773e842cb0e5035859d38a4b9

SHA256
69e4af507a311e29d96a040cb63f47d18189dc381d61f4ea2bc3181a46606149

SHA512
8841c0ff4928eb6b9fd7d5ee05c17596d72cb61c65e041c3cf421d8b64f5599509607232a2126aa032599de143481ca842b32570f1fc338385c4f0442a4c3eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97780b922a26b08a2d7ce037ea269845

SHA1
c91c8fa9bdfed439db31604b798689099164339e

SHA256
dc5c73437f9bf436afecbf5c3e28970ba7d11441321e16775d5a9e4b30127574

SHA512
3baaafb4d611d0da49244cc93cb9c1790b3ee2108fce51ff403f46fde50e80423407c08c5946995fcf2d98c77166f8ddcf203f6983293cb3d5c6a48927afa244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abff7bbb1cc56b7aec1e509e3cab37eb

SHA1
b2e38c576d0d52cd3552aa964fee869fd82c91db

SHA256
23010711c8f1531dc62a0ef15ae27c5947146711a0cfbbb2dde56a47240e8a28

SHA512
96e728f4baa6c280059441970722362e198ea0d08597901bb17b1d38dc4b893353426b43935e46f7089b2bb6a4ff820c2cba851142e75880634d2954cabb801e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
359a60727d8e55563b9194f489e4fe70

SHA1
a6eb30183db4cc45c4ec3323d331b34df4d16782

SHA256
2ed18364e3002e8e15dbf7a9d51ac9e4f45e39ce08425d1a42e8d179fbdfdc0e

SHA512
05c66b756dfb248d8a08ef768fabb579dc891fc9ef8f515b8ace508a4111811e3eccbafe03b805cbc28785764f97b5d271d7d7d1b4342afd348e07a3f692736f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0639b47d3c6dee27bde75cfd3c90bbc

SHA1
48844fe9a4ccada35d0f9601a2bb0c17e5b42a3a

SHA256
c0c78b8c561b1744407c54bc94dbc96b56a399ee94a95c61ee540f64dd0d113a

SHA512
d69e6928ea791613b25a0e608dfc5340e03439d24f124ad3415a00b6284417b0259c32ef5899a5006708da32207a2b73e57ae54890e4411818fec458e952945b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0413c481f86973b26133bb16288cfbe

SHA1
c7ae3f2617a35366d941ec95c0997f8fccfd4824

SHA256
35ab74592d6be579cd3d1bc47aaac4ce2ab8532795a45057fc15ccd45c0211d2

SHA512
d33311757778bcb06e4ff0d4a36127a59a36af50013bfed1f9b952725b6ef49576dac21a0c5233f3300c480229de7c2a8db5ed0f12c9d1750502b28cc4c53d1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7ED3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7F81.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit