e3bd3dd5d2070fe8f8de70b0db03ca79899dfa622a1b63157966b8b44eb22de2

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b649517a37fa06f7eb5848d03cb8cb87_JaffaCakes118.html
Size

67KB
MD5

b649517a37fa06f7eb5848d03cb8cb87
SHA1

2617142d04fded729fa74b3f37f32921706553ff
SHA256

e3bd3dd5d2070fe8f8de70b0db03ca79899dfa622a1b63157966b8b44eb22de2
SHA512

4c2eb81701650717a488aa7ebb9962ecf28fc58ea116a039f66b2a853b322d0b839657e20b1ea72b4a53fbce5070f994d92a081f5e78d03a3cc80180ffc74336
SSDEEP

768:Ji6WgcMiR3sI2PDDnX0g6sv6KRoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8X:J/JITzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424751398"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a90e2f6f55cf7b43b1b0e6c004d2208b000000000200000000001066000000010000200000004abb72164f607a476337a6ec6581db999e4405962285d16c4403b1c6f1b8e352000000000e8000000002000020000000b0a2ee171a9babe8160b380c7de56d2efb84f2b552fd8a2df6f2cd38550af1a1900000009deb1cf328dfc5c116a61371ef5b0c5dc3ecb7a2ec71c97637d0958bb2c1ec0c3431d525dc1750631f7708827fe4eb485056e92b838dfe4ac695f5bf51694920b54b2896795a3fc5c6433a50391b0e1a858bb5594c9be54807bd616728e8dae26d103359ef40bd18f7c35919624284d158751e52a877ede97ed1e33461cb4c3ffef4f4e9ace06aa8c60352a659b507de40000000d6de239d3bb1d8243ad424c72c7dc5ba608917df0550e37e32d7c731c21f38751d142036a656418e1ac232bfe2cb3b9a78b05f0b974344d3c7fd6055a0e15753	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2304DD41-2C4D-11EF-A5A1-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05fb1f759c0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a90e2f6f55cf7b43b1b0e6c004d2208b000000000200000000001066000000010000200000004d758f03bae056af718184189bfe6bf9620b5ad74c78f64ecb21d33023c19b0e000000000e80000000020000200000008e4348d0801322a475692bb0622e7f3d4b077c19b2bfed49c920e328542c83202000000098c3c7697e12545510c251e0e34639667c2d0999587ee6a8f4b30c287d2b3b584000000006578aa3589447e3f8291f692663b66e74d91ccd2932166c40965a1cca5f2a4d69c5c2c55715b92d072ffe76fcf3060387d14fa29f880f737d1057324ed25060	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2748	2112	iexplore.exe	28
PID 2112 wrote to memory of 2748	2112	iexplore.exe	28
PID 2112 wrote to memory of 2748	2112	iexplore.exe	28
PID 2112 wrote to memory of 2748	2112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b649517a37fa06f7eb5848d03cb8cb87_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82c333dd3d033722c9b3991f54174842

SHA1
c5a0b5b85c94a97e60cf7566f942c03774e86f45

SHA256
b2681acd575b510c55b554eb62157f5a85dc2e32de728fbadd28f4dff3bf27b3

SHA512
49a7ae4908640dc2ab046490b110236a7c6a85bdda689ffe89a88a3616c29d4f2d3c3dd9ea7b43ba9964d73242b613573f7983a5248cb8f52c9349abf42e5514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96c44722db0c56cbc529e6f24a9d8fee

SHA1
b50177122470e213999c0c928354f8bcf2496f8c

SHA256
37b29e1c6681b1adbd5de733b4ee671a379585f70499a9178070cd01eb6a379a

SHA512
66fdf08c1a7cb4e372e3b741d1441f0f112706cb4ce0f0a64ad36e4d0c26cf6c160076493d43cf5b5153ae1564bc912f7ec50a0b042ebe57e4bccdd6e2699570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed1cbbb03c0755a4cd71b85de02bd210

SHA1
b09b3dcfe156a0ca6c656e88422b783cd9ba9e14

SHA256
7a88abfdab0cf8ee45ba7332ee168ecc21b30eb9a100e9ee7637d7c3ace40f57

SHA512
86291825c1a25e099963abf544b9a454f35482b6972f2bd2ab45c7003884241d095cf0cebcc5d9b1af9953ce730f459674c46fc0e7f526078b135cec3c84b653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa2f09ede34e11b64442cc49a09ddd4e

SHA1
23751b7a8d3cb16f314546744d74731a63cb6a02

SHA256
f3ea66d542adde543f5f34b48db038152ddd7f66c744394ef58d2880e09e866b

SHA512
23849237163ba902205de7780390454d41a0d7eb88c78c8a25bd0582e961dac2b07ec71ce90f2766c85ece834978d6df286801bdcab53d44cfd4bf3633dbd608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec6b67a7a33e7e4dc5e947548b9e1d6a

SHA1
6760ebf522b9e46d383be4f18753d0cd5bb38065

SHA256
4ae99b2506d8f3348c3aed3a869f137078eaf73bc6834f09d38d5f0fc7fb9759

SHA512
3b18e6369616dcbc6c112ce3b66ef87dae300d8749c5996bffdd3a9d97a84731251f67332943dd2024600254c89862fe3ed6883c4b89a1b192229de932a0bb03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
638196d95b2e4be37622470bd90f854a

SHA1
5c7f22b69e38ebd97b7bc64fde9f5e3cd44674e8

SHA256
9eafaa7e0596d851f444150b5d7f7f340e3352fb76745774bad85bcd3fb12f4c

SHA512
d1235931158e9200dca82e500fe777ec3632756dfbea5f42072640847374887e1c5afa0eb241e0c2eab1e0b872f8803c6a76153ddbe744c44746de5f8d507bea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00409133f251e59ce11bf32edb390829

SHA1
56b07bc6f9dd481dbfde6c4e6c461890a6e8b0b7

SHA256
299b964a914dbd87cc9416549fa3f2cc3f08844a15222f75fee8eba9736ef740

SHA512
098cb2100e8c857e9c8e4291ce4a5295c18c36d6eb2cb45ecc23020623abc52aaf0c085d28dc17f335ac9a542efd9a31a09b06d20bf111cbeba089adc154dbca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f827f7f0458e1d8142156d6d248df9ce

SHA1
9bda393c05eef25993cc73fc77def71b7774e459

SHA256
3f21e9f0a52849e9a0b64713afefd7cb3156d019508af92cc42517ecf17aa62f

SHA512
339afea495ae3047efaaac2448eaf0caacd69b1857b68c1856fc751d30dc79150f63576c8a4ebb94ce86e7b159bf1b549faefa7afe08e801e12f07ff1238809c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c34d861e3b36c497db39be4e01bc609

SHA1
85364a4e96bff005b628532fa1eda13d6405af9f

SHA256
ceb47bb99888aa3e1986f58d759d0aabb81874ce4375a92da0b6b7c7f24e11f0

SHA512
e73cb1e3373144f93305ecfb11b2e563679f1b96830aa3d7498e95345ff174d79dba20ee7c5ce08c379eea3549b1b0dffc0cd510f426c06990e8fd4c65024855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17efb53cd9e2cc2456268c7911be5c02

SHA1
9021dd9e7ff0440987cc6a861f82e2576158b6d4

SHA256
3b032de991a6eac717ea734dd774eba356f1d7e35d85b08a6ef68a169b290308

SHA512
6cd2409a340c0ea0974d624fa76bb15144b13dc7c738d9612fb00963f48df004a58398bf7847902fb2374282d4972853268b7fe69526092a6788ae5a9e38e1d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04134ef396f7485b4ffbb3affad83848

SHA1
fc1080f24ef7e88d92da710416479ade93af1e84

SHA256
f48fbd9828ed679cee36f970cc233889db7369600fe2ad2ef4ef0e9bca0adbc7

SHA512
226821937f1f21a3096351057b1fbf1c7681129849ff4dc7b00366938f8453b4d4bc59cf1aef0275e1a4adeb6873982f2ffe56bc86dcf86fff4721438a841473

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2697.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2797.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit