6fe9d28af12029d9da088f0529f503441664538aa5ed19e5b3c1e159aa35b7e7

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b41b70684204f48d85ea1d2d01393917_JaffaCakes118.html
Size

131KB
MD5

b41b70684204f48d85ea1d2d01393917
SHA1

9fb103dd76283fa0f783aa97eae0833988252d49
SHA256

6fe9d28af12029d9da088f0529f503441664538aa5ed19e5b3c1e159aa35b7e7
SHA512

12e418bac345fe2c5117996344db7d0c740cb9e1152eec064856a8edb96c2baecea22de8fb14c7a560282b06c0554f3e592b0161105208d86eefc1a189829fda
SSDEEP

1536:JzzvOQZLe8Vhd4Y/QAuIwJAqVd0qHtFvEjVKPtq7/R+UQoFG6RoKrEptsG54tYgj:JzzvmGb0ktUcey2bx7Y2O24n3vdN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBF4CE31-2BF0-11EF-8CD1-FA3492730900} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424711780"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095b9e6c2ebefb246af16ec203af1265000000000020000000000106600000001000020000000c628cc7de9edc0222d2ac2e786dccff211e29ec9d8da100c856958e530ef85ba000000000e8000000002000020000000fc6f47341f79f05472d27d7e933fe2c16380b65ba5e9e2436faf4da5848bf0ab200000004f55f3db7a8f8a88aeb3396f3e7fa77b6f7c0669cad23093bbfa661d7121c2f1400000001a9744342bb8c7570d92e21b28d9f30381b96c0a5d7ea7a671569f1243ccdac796ab329b9b6a34937197d23c0c4e6da5d49676eb88b11cc1252fc3b430e5834a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0faafb9fdbfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095b9e6c2ebefb246af16ec203af12650000000000200000000001066000000010000200000009779ab110c132a44a64f1377bb9ee82abf41aeb2560e23b0a1964e652a639a2b000000000e80000000020000200000001834308013dfa85d417ad8c9261dec26756fcd9e1171ab52fa18cab35cd750959000000022313f0cd1ec66ab6f5c4cf25f84d38687b1d25f0968dd7e612f077abd734ee2ec11d6a862f7cbc8db2675eb111bffc965e6b6582e44824c6ad4abe127080751e4d08dbd836bbd90b98750a609701fe8355b6642e6a4a0557254b6384c7e21c7c79be5534ee8d44a01740f6d7e45246f3e2c28ac4fa3c1baacc00738e007dc066c001d23dbcf4a72ecf20d58f44a2514400000008de0b22b7e1afa6b61a0a6e220b376b2f5ddacf305efab54af238874f3f501404122fd97d3d9fb8768ff3e5544b8eb7026e13cb891b8fb49de1ff6f681c40b05	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1680	2192	iexplore.exe	28
PID 2192 wrote to memory of 1680	2192	iexplore.exe	28
PID 2192 wrote to memory of 1680	2192	iexplore.exe	28
PID 2192 wrote to memory of 1680	2192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b41b70684204f48d85ea1d2d01393917_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
409bc02841531d630db0dc9d288ec7b2

SHA1
dcebfa261b19e7a5c2f96b25cb1d16645c738561

SHA256
ec341a1502e942cced149a47970fb7f385b7a57d20c17cd51cb43b3a9e47fb12

SHA512
1815ca4f0c540c5c60bd03cb96c3b0aed9a24f806b921b6ecf04fd2b6e5d07f8427e8d90028dd4b2ac9816d90360aee48c36c604e33623b855feed4d522ae7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7897d75a9267ae37fd042c431466ccdb

SHA1
b17db04a40ce0ebdd7e43fc0f0fb0b31f6dc1067

SHA256
53f14a0b030b9f89e09f0819dfe3ec91664e152b84c9ed7533578bc1c73bc23c

SHA512
b44d5d5dba6bd6a6c952beef88bd5dede1bceb9063da05dbc9892b5930eb87e07b5f8e9b0252aeef305a7f1535837db01615830fa37a940b5390a3d6a61e1024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30d2b6581ef4a606a5bca319cd130a46

SHA1
a4c6535523679578f1828a4b3597609aa3a129b9

SHA256
5f5a2e2c69afd3aa832a79964fcc594947127ecd32d9cc722bfb250f6e27f043

SHA512
b67c78d83be53d13b1987953145ad507bb5fafa07216b8ffea5ae0a1d36210183f0c762230a3fa5b4b6299a97b05fb24ce39c875d649328773726856b64cffb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00eb916b6b79ea784cd15fa61fa1ac76

SHA1
8b2858846fc12c5c8ef376bb7039d7305519999b

SHA256
aeed9bf62b9299b9fd195b86c8eb960473b404a64b8bd38b4b0f0eb7dbaff039

SHA512
e54960bb6ca3364500568833e224462a22813368547f3c915e4bd55743b80d8c83b17d1a7845397a7f6589a1c9d390849fd61c8d6fdde623f6884bb20373168d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28d2cd8ddcd666e99adaacce82debd02

SHA1
79cbe797006644c96a5fdd8f4caf3add268e2971

SHA256
9ef0d9e50b3fb9567ef19fab9aac1dc64dd47bcbc32736733255c50d5b8803e5

SHA512
96b7acd05ddc6911faaf90a729fa8b5ebcdfec4d0ce718bc23ae646bd84f0936d58e4f9e0bb6e887d9f03c32179f5eb149c1f1603224aeab56b0ffdba922ef97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1995f120a86582e7810a48ab26360ebc

SHA1
4bbd8fda672c16770574d88d00eaefbe72b940b0

SHA256
109eb104266a0101a35a0a2f9e340c55272e8278409dc1c1697d556741d6de77

SHA512
a83057578e70e3ec7e5a4970cb64041e0c64034dc26c079561d72dd727ce3cdcf1054df3a2d22f9eeab033531f317a474ecd43292d797348175552510da56c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9df232b9c12d42de1fa71470ca4e2f4a

SHA1
e3d07776db0e08ffd1abf32a7b4daf059736ceb9

SHA256
18b62f75ea7c497af9d4ed6008292a952453bd222861baf9c805eea2a264b2a1

SHA512
08041cbdca775697ae4296d72e436433c7b95814b18fbafa4bf4573728c1284431096ee62899c46fff4ca437a1d3bf1d98dec49c5db8d8b8ce9091b58ea2f0b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b219d1bb3c8c59d129deccfb8fafa006

SHA1
b92105a892279b4a56b6cc5f454753b5a0988463

SHA256
8b1298c69d173e8f8eeb6547eafd54893f60835462cce8cccd0dd2cbfa66b4bb

SHA512
4548572b9d83a623186b8424ca5a0b3bdf0035bd202677a6d3daadb5afb16e78d75a25c7814e281e6782fce8eea2f6f19f087c97ee23a424d827a2b7644085f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b12c2c1c89e8dc278d0be9a75798e72e

SHA1
c96c2afb978bc63846718cdb18514390de8b4297

SHA256
4428ccc31d9f01124c6fa818127f73c8b660f6dcc1d43e91bd6bee49e33e9bc9

SHA512
4afc3cb51b6bca3008bdb6b56f04cc26082e982ea88f41af1b3f7292f178b6d7ebdcc8b0a3955562d104685d7b7a810c55d0515a298b0dfd5b12cc7abfe64981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21b1806885a7efc710667cbd434fb636

SHA1
06a190dd5cc2ff8ca1b441e3b1ccea5ed5b6cd1a

SHA256
a95fd7f9a38d1196e8947a50ba760b4db5890f993a031d4ffad7a28272eb3471

SHA512
6b96f1fc3303df826bdd9e2f1a4c72d26deaf6648754e8d0d480ffe02e8774abe94c81479928f775071c8bdb3da402120c3a15668a16b943644274d1f535f0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfe85717a01ae5d499058df88c6bba52

SHA1
9e8c869022b73949b3b8f37a153c1e842b8c2521

SHA256
958b7dec1c80dc0dca4b8dcf2040b982c7a94e47ff5e6d38ec4cb58dd4dea979

SHA512
043523034765f362f8565dc8ae8f29559f7db3d56ab2237f5aa15d71883d166400d8ace578ee9292e875c5c7b655403d7d06aec1fe6b7dfc68ec6a90742afc5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d37258aa2c2e9fc1300b52efb86f771e

SHA1
37ab7b7756306021590f10681b56d4f283c8d135

SHA256
8770bf734012e3fe759c3b85aacc71e0e91543d9e20d833cd8736be81d962c65

SHA512
3355bf3110a7f5e07eb2fa684096954eccd023fa3e96bc04a23cf18cedfc4de174e168a02fcd8e6ff1ca9faa789f9706e7d8cdb156216e12a2129c35f2c7d3f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\all[1].js

Filesize
3KB

MD5
b9dcfebc869f4449c6a2cf47751c9ef2

SHA1
d20fc1466f50ab67ce53bf94fcc47673893dcad3

SHA256
222f8885b4f005364fc6d66916306a02d90150d7306a279afb5f3d957fc18f41

SHA512
acbb1944343bfe1e49ad5c6f35a10cc7931b4e4b098b86c756bd4fed085aa9ccb85b4d79b6b6a7270c6f6be1826c124f275067e30dd16d0e8c3494d864488d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\widgets[1].js

Filesize
90KB

MD5
824beb891744db98ccbd3a456e59e0f7

SHA1
57082a005d743ec4a7f928a928bd7bd561078c7c

SHA256
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

SHA512
6c19e304af16ae43504a44eb60c542526d0d8f635e4f57ab557e93999ad608be99c25354898ef4826defe63f8ba72e4d09c5eac445efbde4587534ca202958e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D29.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit