bc6107018da13e3cc12ac0570697017a308d966ee81afbb246307af7e4eab509

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b424d48944523f08212747e13fa70dfa_JaffaCakes118.html
Size

207KB
MD5

b424d48944523f08212747e13fa70dfa
SHA1

886053fdc2a5eca61d898f9113c8942e0032b0f8
SHA256

bc6107018da13e3cc12ac0570697017a308d966ee81afbb246307af7e4eab509
SHA512

ce5204f5b4cc8cf020aa2ee52ea8dfd929275df63349c225b4a70b50e241bb569f94b9e75e98627715757d79a0e4915dd3604b351c28382e70f884f6d6e704d0
SSDEEP

6144:i530DH6NEQwjcHXxQRVufJc/09s1k/b5i:iuDHQmjcxQRVufJc/ci

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0424718ffbfda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424712332"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000006a1c667ddb8c7cc5fbb4c6b8d9f7ba409f8aabe92eef0624a016bc2f2be60652000000000e80000000020000200000006717a89bdf667309c3a6449c184dc561921cee09d7e9271730ffbc5359595e6520000000ce9de0693e2fc582f8f73d003db474d8c2030f6383af13c34aa7d247d3170dee400000006aa1837eee8e4194d4f0087b79c7918876e3d3d6a9fa4c6a1050b2a7963210e5bc0906fe9d8c89011e856d0ece199f3e76b81b5ffc3660200dd3be283500f52f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25E1B661-2BF2-11EF-BE23-DE271FC37611} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000004f1e98c87159330c8bce8c92792cdc2900d44af562228586ab464b8f95524e4d000000000e8000000002000020000000f726acb31e14f33a5b663fe7d00beb4f2828f78c0d9469428823a0592359b3a790000000cdd774e1552116611f20e0bff8af2ec8be440a97f1a10c24e4413d97e6b24e7d46730785e03b699c7c3ef1ed816022e487aa56b36a42d08609e1733e2fedcc53a31d6a848c81d284d87a2d5fbc1470b7580b681cfacb2ddeb833c4c879286a36c85ea0d56a011e727ad8e0ffd831c9382169a752df23fb35c6becc90564fc6988b93795cdffa3eecd03bc89c7a2087e440000000c494de7e320f07ffd0d83d07a1e2a60cf6d86d44b4dc116ea859456ef714d64450fcc92248f355bb702f98e6432e04493b7935e7666d9989d4618d10b1ef2445	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2324	2536	iexplore.exe	28
PID 2536 wrote to memory of 2324	2536	iexplore.exe	28
PID 2536 wrote to memory of 2324	2536	iexplore.exe	28
PID 2536 wrote to memory of 2324	2536	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b424d48944523f08212747e13fa70dfa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
2KB

MD5
9d78db4eb83bcd5709775d37c2bf3092

SHA1
83530e5558dade6c638772626d370027ab63fa06

SHA256
0a43386bf146e6c45e4d74c2a1cd013fec890b90479339caba634d939000a003

SHA512
8cb9030aac712add2e958cd24033d63f58f9dec40997808ce5ffc33596be3bd713f71409023f97eb0fc4989e9f7d2bce64ff0c545809b6f3cf3846d1e6ead4e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
04f51567ad6897724c2715e28e920c8d

SHA1
242f1dc46be1ded2b3937698203095c9b169ff0c

SHA256
207ab8a54752e9b774aa7e0dcd7287907324093bfa853868374b9ed0a3c1da18

SHA512
fbcd07801e93099f476fefdceccae35012ee15580aae2963d82522bd233575d833197cafbdf885d29770f109c9c5bf94e393709f5ab7a38e0b2393e775f99634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ea2fcddb34f2b0d38ccb81b782a083b

SHA1
b97532d40fa987c411fbca58e86f6dd98c1eda0b

SHA256
1d461a543f195e1613be458ac166fd255f8a4ab351a354437db502ec07a56e5e

SHA512
9dcc362ad63daf6c0082a1c1ba105dd9be48d3e23fc64aff3d292727aabcf2ff27b204d7f413ecfd1bc4d0e87bc4cb343d3944c39f9ff3dc653296408ebaed7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12a21e299a8b4ddc9254e0636e1e1246

SHA1
8663756a84f9c6dbbaafaaf91d0b85e0b76e289d

SHA256
7e393e01a2a94749b6be0f5da53828010ae65aa5f5416bd3a8d6afb07ab936fd

SHA512
5b35d22ef6ba698f0b6fdd2535e350352b0090e8171269493a188966a32c0cfa5ae77998289e07c461e8176c95c54a67f9e2b835b0650384be4b40d47f46bd15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40711e1b7d3481064d865d410d95d9b2

SHA1
558b6c385e464a15f7ba51f0a621860d10cfe70b

SHA256
16ad4eebeeec64740ea5d76f88c57c0b6fa9f3ba636a0d1d7c58cbdb9ab5783e

SHA512
4d774680da134ddd79e743046ee6d97444c5384aa5b21103ad79bf8a6c91b9b6ef6f1df7af8f02243793a41a6ca2376be34b8447e2545740df1a153593fc19d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfbce84bdb7f6f7ade00f14e9d467721

SHA1
88943937313382a74eb6c2860f6ff5bcef6e5cb2

SHA256
57193f727a1c8acd75a4e940947cc84bd5560b6d1c9d0d23792689c72e2e40c7

SHA512
3fee430063b076463439347b5a8c1a91015325f92d3de533b9a4496c76d853d64e995a9853b9cf5df92ff7b95771191ef67660f9582e01152894f56d7005298c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10c246447faf1c16ccc2abebe207151d

SHA1
7dcb32cf7875e488357bf09952708dae5599c468

SHA256
3300cdd83c323a9755cc3f766fa488083e1ce2395b49b9931a070af2f3580566

SHA512
ff8fe3d00495fddb163ca6b38aab659184b55d307f9c9f93ead477c620743602ca523c585ca02ba760312be3d9ebc0b34db66e0e37300781aa6fbf96b375f3af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02ce41db50472e9f3dd17b591869cb74

SHA1
d6ffc3d2db50c541f679a7bd4ee214a0fd7d0059

SHA256
027457da95c4e4f20e7b93d627c21ae052472c8c77506d7330f3f3e992d81137

SHA512
a581eba33ced0791a2d34578103a296ed04ae32d5aa26f06306a3b63c7b2b0f55c1f41ac236762f948812c1bcfac52a4659f79864496475183fa74fe4269b284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65458ab83f29aed0bd99541e2e7b161a

SHA1
2239e1fd9b7ffe064e2dfeb6f0c381f8e920c4b0

SHA256
c5651e90777772e396a12593dcbf60ad7bbebf5188b49f1dfdd0c5042f2682d7

SHA512
b7875ec579cc2dc40df9e9f7bfe00cde1cebb5563d9758d2d6eaed26f85b58a6e8e9a4b302a2135a257aa67e3da92f522bff94dbc5c2dad4782f5b83fda94559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5309bf02f37ad5cc6191bcfe61e612f6

SHA1
3f4d0b51c404b4f0ef32bee24fdde438475269f7

SHA256
6e98c1e5c4351e22edd5f892b0759f84b71b895f920663fdd0f202aacd9fd05a

SHA512
678aee71a1bac3f9cd0d816569ff00dd1dda895dc02a6b86433696e38b3acfa699d9ed863a71895574b0b61a4d408adfdab0e061aeb979d743dd416735b1341a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa25f72fd7c7d802f4d75d8e6f9c29f6

SHA1
e224dc7903fd4ec7060b17b788dc935bd12d3ca3

SHA256
243635209e2cf8e5a57f75c590db6dfb4650add3d454b9c9a312219af5933765

SHA512
7faddd596637230f9c4c4132b948dbe5a4a7b2405e11cc09f339068df4f9a89d23c0e2761c699d1ba810ffa213e007d381c0460fc10248c458245427ed10cb3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
968e375d4dfd820d8e09bbe4fc77cc38

SHA1
7909e1430a29965e2878ea4690411539912395b2

SHA256
5221199954e3884abf01f42b9a837f8e23acd95cdb2225cb025a24c6c82149c4

SHA512
84cf9174640d2876ad77cffa67da6b4c5e241668f1fac48b03e217e3ebb610d3da33a759a10402bd100fc2597d3f0465d670e5b3a05bd07d2e1ff2dc64e95f33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c4bc321faf1ee338682e020aadd4bf9

SHA1
198f06bc89379f2c397e6bfca7847ec15c36b95c

SHA256
9026e81354e5d34cc8bfed13f066f0b9153e200c42f11f8e459e59836a0fbd93

SHA512
e41b19c191c7d86c48f04e4ddda841c35ed42c309fdd689bbe21730a57bf5fd11213d5586e0ce521509fd8dae25235303dac6f11165685f7420ed922e4f3a498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfeaf43c59a67d9d5a76aa9996b5d1f2

SHA1
a6566d1548f56bf25842aa007991f153baec2197

SHA256
f0e998e65bf5fdb69a383146be91d8bee4817069a45a2c342e1f96eda3cf11d1

SHA512
37e1b75162b29f042bf35532bfa40a8ea086ba3e160dd9bd9c8ceadf54a7cbfc90606bf34c4b272e96f451d1a17d7823bd577a94ef4d6941a64ed58aaa5a2ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HWTP8BNA\js[3].js

Filesize
225KB

MD5
fb3feb217aecde24958ff3d9f67d28f8

SHA1
20516686a4e9afdce4977e6ade080511642acbc7

SHA256
6b8a9290377fb26d2ae0f6f59c8814aa65bb6d995323b972999f2dc0c3ffb8f3

SHA512
8103e6d78aafc171c7d20b91276c6fe5b108ebc9a75c54d724980cbb107fca8cc56fa135392a52b325e2bae1d53574ed58d61f413e33b245987fdb3bf43e1b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R3JK00ZJ\style.min[1].htm

Filesize
134B

MD5
4aa7a432bb447f094408f1bd6229c605

SHA1
1965c4952cc8c082a6307ed67061a57aab6632fa

SHA256
34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

SHA512
497ba6d8ec6bf2267fe6133a432f0e9ab12b982c06bb23e3de6e5a94d036509d2556ba822e3989d8cd7e240d9bae8096fc5be8a948e3e29fe29cab1fea1fe31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8393.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8616.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit