b5e52ad28e92c1073c12bfd5c4e0b970f90c340aafd30551854b784edddf68c9

Analysis

max time kernel
137s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b484f3fdf21e9ba700ff065308e29a3e_JaffaCakes118.html
Size

158KB
MD5

b484f3fdf21e9ba700ff065308e29a3e
SHA1

667dae34de8dd52f914a54ddd6432d621d93262b
SHA256

b5e52ad28e92c1073c12bfd5c4e0b970f90c340aafd30551854b784edddf68c9
SHA512

b719af7f47a448b522c3a51de5810bfb7e163522ae6f30a888b7051c25d4e41ba3a2c5f7edfb4b544c8ec46d22a109da4c7b03542740788d715a58e06305c47b
SSDEEP

3072:SDEgz3/MIsyfkMY+BES09JXAnyrZalI+YQ:SD1b/MIRsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a012e5ac19c0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99234D41-2C0C-11EF-A3C1-4A2B752F9250} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424723679"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000001db194765f62ea81c211c573f3a9e284e0fce6e011484eb4067376390df21874000000000e8000000002000020000000d1113b802a6f3f6c7345b23c93fb5c90bd1bf625d170b7cdc96f455265da4e3a200000002fafadd84b41370062aa20f173807e85183d9a0dc275a67fc5e58133530abc6d400000008eca0619aeea20c6210690bc4a27578cef27e5cce4cfb6b481dde2842408bffa7abeb5c06086a5e903447624e3b28ee1b325cb0008b353fe548ec247247d2bed	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b1f187fc745890e9b964f2bcf1a1ee3bca653d67b164aa295d2926d14d83b337000000000e80000000020000200000005536375d9803f800d20778c1709a2e0e75cfcdec50842e9a66833b411f045ecd90000000e7e609768d8d481a4122a1677d58c21135268a2f2691fa9a049f5221df4d5d3a27006f7552633e6ab1be07f7dc9c9e07a4525d4f1e69ec2f1ee44eb68ecf1d80a2581beaf123176fd9d0e03b735674804357e9d42e6720c0a602ace3a2e3baab91be2692a27cb78e6367e21ba5c2f051d2c059369c3ffeb19a3b0168b9f2c49bada31c975819ef64783348a03d915ffd400000007b21e412880d7330306abe87507c1a4a4213952e5f2f8d2e6be6cb6fc9999c3543b5f9c5e5f797c9851c11b397a5b6aa9d1f3ad4d7d1a2d18962e6f9e23ab3c5	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2680	2244	iexplore.exe	28
PID 2244 wrote to memory of 2680	2244	iexplore.exe	28
PID 2244 wrote to memory of 2680	2244	iexplore.exe	28
PID 2244 wrote to memory of 2680	2244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b484f3fdf21e9ba700ff065308e29a3e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
808fa4eb835705adc26bf531bb1442b4

SHA1
6c1f2448444512bd3fc8f13d0409bf2dc449d31c

SHA256
ff80032d2cbedbeea224b57f4b26f257195a266d2868f59209f8394392cb197a

SHA512
6cc2d04ee6862790171828116553c1dba4ffc0701d25d7525c3a12dac2d677b70ded2415acc942868d8ad9b82a3f871501487766da9bc97d1a9681f28317c847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c806947491552ddc35b2feaf53a16df5

SHA1
b92e03f7aec104012848c6e792a82653c847c6b4

SHA256
462bfacc477c752223b1e372c387732bc779e0f7bdd63d83c3822d2a82324e48

SHA512
196768602611e78c01f85b36da88143f8f23c90d80f4af86fd28d443ca9fb0a00065267817719b09b14d51052eff8fca7259753d58ca95c5afeaa18b7d55fddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf7f55efccab3519a60ce6434d29139b

SHA1
7681fa9d12c91cc9867c9d6a4c0cbe3919b07ea9

SHA256
7842a9fc089db805df4765e05162bb903c28f1a069ef964ff7e666bfbe53ecda

SHA512
dabc87830fd3acaf44b5888884ceb6300bd71b79b6ac5df3a6666cd86dadc8e068946deacb2dae8306a20332616b19cc4682908890f0747204b868e70e7a660e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d9eabc80cf758a4e2693c30d5bcb1fb

SHA1
25fe2eafe2e1e1d14588d54a855fd88a672b1b29

SHA256
461198f2d1b465a39753aac083df9997365fe7a2d53e4a284e0f4fcf487bd720

SHA512
26cb6afa8962ef53f05599bab938692d33f54dab71e9799a2b523d535f41f36fe9adb02e28a8f56917b74f4818e22a8be4949e1aedf7640b88f057ce61c09ecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53df786609e745cbf71edab1015fbfab

SHA1
d4085b54d853608e0c6dbbf2640a15443e8adda8

SHA256
b7bcdaa409bb2c72a89e9df803fbbd9d58529e400c24e54e790ebd90ead537e3

SHA512
53e403103cbd2daa3d2defc5fe5894b9cd3f86b9546cf89b86863a57b15a59a3e93e4831277ae829ac3031efc5d62b20589db690b6ca790d87de4643206f04cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
004311fed7cb3022eb0152d025956f11

SHA1
45ad490c3e26f43d34cbfab9f3b01fe964ccb9b9

SHA256
ea2beb50b30cc814802959385cba5bbc76c3c5304e997463efabc8b3ced3080a

SHA512
c874e1a8320e99722fe1a2a38bc6114162e32fe0b924851aa1a452db4e67d0afd49c411440b5c8b7b0ee134528d09ba5e54c322a65ad98b4f1e54dc99a07a3ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f90d29452cc60c42bc63ff43512bb612

SHA1
8a6a210fade553b19af2adc5dd34cf25f2831d76

SHA256
068aa459e49042fa42e50dca8f24cfd92e30f837eedbc0c0c40970400d88c142

SHA512
d491dc41689e982f23ed372e227e7523d6c20e36c0723052d5a471f878714401c1f49954daa6ab38a9b35be6d1a96854d9a143053bbb95c53a6254b3d6108203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8ac678b2e7bdf6b0249d733c30df3d3

SHA1
876789be047f27ef506699d942641a69a7baee55

SHA256
fafccdb40e4f321cd58a7e12e43ded675dedecc7c45ab77ac0cc1cdf8139f8d3

SHA512
458a9c31c6c6b3a73a41f98d68d0d1d2525b7f2cdfd5054544c7978da6e4d23b66203ed4cc2d2038b896b1cf3209c9bc434167237401292bc71f9729d8f755bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d9aba70e2b4b98f8ef392a81d336d32

SHA1
2fd4368d097d87e87c9a6692c2ece2d509b0c7d3

SHA256
c25c38efd615eaa0f9aadaa2fb7e92a43e3d508c772e559eb22fce26c6d1db83

SHA512
9aeb859d17598bda8364547833df9d5067e02f44aecdce070a62e2e5378bc9cc6b3126ca223cbb9bfd6848da0d0f50d7d22cc37ce500996640fca7a62eb1520c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3720b99cba3304bf0fd0206f4e60e523

SHA1
2bb979505320d0fe7c5ff6b068867b558529a9c1

SHA256
d3f8b0aea616f2df7ad88764727d0342b6cdb2116d968a0e9a7b003b5ac32263

SHA512
48caf73f237d55c09e446f451ac214de3cd783ab236631e9ae52c8d5daed8bab8925d4198b0e826822ddfa679c215b732e949d40a8d9e31155af8ce0ad4b41b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0256ae93cb3006a577555a62746c5355

SHA1
2dcf0c53dbb3ba491c98f12257b132623ae0b4a5

SHA256
4432be9b9050eb708b26db496de9106635fcb41e2736d936dd70545379b0f895

SHA512
cc6a1bab476d350699d1563429dee8022f7b27753715c15920b976ae6cef03efc0fcc6c643db7d1747fe6f9cba8531d84ea35499083b604994b93813c343d167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0daee8449e53fed2ed5bc49d4f7aa52b

SHA1
d10090e7641d7b9d141d6d306f431e96454e8e44

SHA256
9442084222adfef23af361f7988f0f3dee17e80edfd48634f5b8093af2e3a5e0

SHA512
e197803e69eed7f7884e624f119ed10658d2e99d90f75cad8aca38c227bb8f8eef8990734bf717132dd18d1da4fec21b571672b2354523acb2761389a49835db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbf6a48d8a7aba0ec40ad1cf829d93b4

SHA1
82b728e0741145cdf5f8fc73459817f91c5a0b8d

SHA256
63103d9a3de2a68b5da844c3819b601db3070634e3d5dbfca5b689815c6aadb3

SHA512
ffa5e1d41e85d81cd0c012dbba1699a423bddf94427df48cea5c56c666c0c52e13737ec02b7c9ec01a9bde72095c29807db2edb857c5f643ceb9bf4e4482b7b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab73CB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73FD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit