fc8464c9382ed2f18bb9537c0e023fa79ecf7e1b5155c276b41ff13eb7d6a9ee

Analysis

max time kernel
150s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4ff15d03a0b70f7c881c5673567f7be_JaffaCakes118.html
Size

15KB
MD5

b4ff15d03a0b70f7c881c5673567f7be
SHA1

b3a250b9d5728ab50aff21c68f1f27313cda0530
SHA256

fc8464c9382ed2f18bb9537c0e023fa79ecf7e1b5155c276b41ff13eb7d6a9ee
SHA512

1c84f86956917b5d66837b69814a717667aeeb5547ef55a977e3354d8ec4fb1786a538c0c06c21d88a5dbbf392c0b7c37def090ba035b33b92216f76cf6bb7d6
SSDEEP

384:SILdAVqB+KltVKwOae/EaErpESYf1PX7vW7:SwAqB+kTBjheSYva

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1964F841-2C1D-11EF-A490-4A2B752F9250} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000000b68ab46a192593243a09e91c9b00510288704fa45bb70e5374b1a528149eeb2000000000e8000000002000020000000a264a091185c8db6845b4abe831d47e06580babde016d4743f7c47ce596cc594900000007cf1887fb0d5321553c0219d75de81f590236aae930039803dbdae003649361fe960d345e4d3421e4ebe8ad3965b7734bfcbfdcaad49f4887961b7a5dc2cb6be907589d1957ed29ae5aa0253ddd0655a463fcaf540de23e57cd0952eb47ab1dde82183e7c8b73d7dd7b232087e9556cc161798db6de10691d4ce634fc050b4d9fa1c374e9f6e575e012069803fcbc63c40000000b1d6d85797a875eac5e6107ccb269ad66d768fca057ff7b7c44807999163af4370e03e1e00d88f734f042e001b46acb4b2315b0ff4235c4cd56914760aeaad2e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424730765"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000fcad0fbae4731ee99bfaa37fa31bc7cebf028285953c42fa4de8351546c828ec000000000e800000000200002000000085d017877144e41dcbf256ec2b28404e9936c26ebea0278b87ced2f2a88ebc2a2000000052275f8b28d16796845b08984c2443421479233db0afa52a3e639c5bc52f0936400000007b135ff6fb1efab394cf715281f4e821662231c0f42e3eebd5c29d2d172cc0162a18883177cd6099466aa2e39e4bde328c4a767f013a1a9048cb860c3e329618	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709c8cf029c0da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2236	2460	iexplore.exe	28
PID 2460 wrote to memory of 2236	2460	iexplore.exe	28
PID 2460 wrote to memory of 2236	2460	iexplore.exe	28
PID 2460 wrote to memory of 2236	2460	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4ff15d03a0b70f7c881c5673567f7be_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26df4d880bbe26bb71389b033ee244b2

SHA1
f895c4d2ca26a66c8fbec5795cfb3f6a71950a7e

SHA256
65e9d53344fe61215122d6436201ac7df3b215266e7178731f7a6d2140a6db26

SHA512
135322f8b203f18e5d3f1363d3bd61e2108f44961ad508023344263e15404a982181fa2cdde75907e6c028410e3f0d7d7c8e0ee895d55ec5cabf3b92ca3e7ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf1008fc28f4c6b19133f923f12bb3d7

SHA1
be0fd54679e770f6dd5d1aff6916c1022896de34

SHA256
8bbfb6b280cf44e174bbb971b6fd73cda529128849ac2371711d32fe831af892

SHA512
7f3bd0328ee380204c2d01668dd8bab414a268237495a2edf5aa899850d4fb5747ad190254fc21055d206a995038af154171344b5673eba09b54ce4dd66f3255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de0c2d01fe211ed1afdb5cadc3125730

SHA1
6a691ef5d10488db5cad48225ed37b180dfc85d6

SHA256
5743885a02e18939a965ad0be8a9785bf8b2bda94a26afaf8a3dcd0d4bd0d4c6

SHA512
83f93484f7082eb3fceec2dc896d90968c2fb1477e8bc009c354f928164ec4e0eb8a498bdf36d90b509eb4c61cf143a609d7a1bfcd144bc76e2ff0155dc809b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc8ea026f6f5791805bac4ed9a006a7f

SHA1
6a261128d064d1a9181a42b3f9706daeacd1fe89

SHA256
04ad0fcf06d883ae299d180edaf9e73f888d6c4e6dc3fefdadba24329b4b9a55

SHA512
9fecc26174aafb7240d494b3143e53dfb245de3c855a46a802a0c0bf1847a1f6e432cbe147d9719954571ffa16c13feb9c1b05d2d430ef9fbf0cbc7ced39b546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7dac8d2867b81abf2e6419f899c3e89

SHA1
51eb0169b3102ba1c0fb5e1c01c1335924a1028a

SHA256
18dd0253b5ab54ae0e4b7dd7a8443410cf883655faa2753a483612dcd6fb3391

SHA512
d2307858f05ae2fd72a9a0c77ee131d1387197984a03c64f0387ffe46e30c153a5a7f0dd982806e20791a4bab3524de2a21dfa4495b84841f4cb82c774abf505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b52334e5dbfd575ed6736f7578b144a5

SHA1
fbbc4a2dafffebeb6828ffe2a3a92c202c7694fe

SHA256
2598c4f91b4cfec5ef85d87228f3cc7f12d7ea5d90d3b906850a1b47297a6a51

SHA512
4b2cf243e24fea6ba93fc3a51a83df70f0d0ba1f466cbb8f01469f47de2afd001d609f1b9d79475798e3acf0507a30dc803c04c699b61d48e46a506927acea41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f344bba1e5e17d6bb831e5ae9d0916a6

SHA1
9c433bc64954274652096bfcb8e224bca12090fb

SHA256
407c14fb9a73ae6b57d4728402e1be2d8cb968a982bd6ec7bd777c63d15adb39

SHA512
27f7ff4c53acf49efd9faf085f385a4781f8b7497e619808c9a0ab8a3326af6a8e54ca7f43368c0379ec1861a5ffbd3997b016b0d29216df1a889e8d8d63ef81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd4e93e1390bd1711418ee30a9947e14

SHA1
0dd4a6ea87a84353be86b9bba826ae01eea4e8dd

SHA256
4bca04c9a5ba3d6651f976acc09190962096f6cb4d1bdf53ac56a863f1144f50

SHA512
35a23da8242366ba06445c88b6d40cfb822cfe8a0ab67ac9872239ecd4655ff8792190f9e3b8a2aeb8ffe0b2831595647c66314753b141d6be150cf14498c582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cf665c33d343a2cd5bea4c7e024f22a

SHA1
f9f105e461d086914fb455c2427415ae335fefd7

SHA256
18f514b36c9c72e25b571a2275c7541fa232df8de7106cb4d9cbb3888671ab0e

SHA512
7a4372159614385caae5752241990f9b3f10c43a83719f09a36f115beddfdc7f4e589a4dd0f1162016b7854d6ed1e584122bc7305208fd2232e5b5fbefbef70c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11dc71ae67b0284db274b8522272bd84

SHA1
521fa62834cfc58b997ee22b5ef79a1c36381d8b

SHA256
8ede43d3479708bc416e2952edfd7321553d3354a2638d523aba00612f0bedd0

SHA512
4de3597a1bfd521136a3e95511ad6d2eeebe426a9dbb329d2e9d881c647cb07ddc908e9995a6d8d75cda0ad4ac7d2c4000ab486c2807e3a59a4b141500453495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
061e532f7aa7493f1b5d189a15e57168

SHA1
8824ec01707ef301fa514377f3f592c707b148e6

SHA256
227c5677ec6957de732d98f7658c282f4f000549f9bfe59e23d37d523627273f

SHA512
b1fdadbc7a3fb295f0ae96e6e78b4945978a0c52bbb26eb7d894a90452f5d964e134628f66f81e5e3646589cbdead87b7fb0b2e9de9ea312644e74a49cd21160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8787fcc3dcdce429e1ff476853d70f4

SHA1
7a21139805c9f1d2d98935aadc1c0634245a651d

SHA256
346cb7871f29945929d9641e4a1af84f04459c6d7523b45010431e0358d11769

SHA512
62db0d9d41509b1e64ba125c98d78fafd556b3e46c5f96a9a4478974cda5fae01f59e58bb713929a852972d859514aacea33f9372df3f52593536f7dbea8afe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d4d0cc6dd5c460c523d13ba5dfb2f2d

SHA1
e57bcae21bd6703135cf49ea6d19d6fcef092bb0

SHA256
62abb097d41958646f093177c1e14272d6ddfe9311cb6afa09376f2664011e03

SHA512
930a5d71c5f16de63f838ae0acaba94b55f40e6f117f10b79b590e65beb8c08e86c22d37ecd468cbacec5720d306f43b212af5ff5d2c6bc3dbe17183319845a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab147C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar151B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit