850d8de7fda3b3c49a5c8c688c53c4084a78fbf185cf81dac6695984ff7a7bb5

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6d61e69411efc553fd2fa949160c4ae_JaffaCakes118.html
Size

306B
MD5

b6d61e69411efc553fd2fa949160c4ae
SHA1

cfceb86efde5b2307c45fd5ae2edd1d66e088a64
SHA256

850d8de7fda3b3c49a5c8c688c53c4084a78fbf185cf81dac6695984ff7a7bb5
SHA512

cfa41c88f17fd3385744d8e5b387ab607a8f5f3ec492c3024f3e23774ed51f7c8a6f0fa3c2652b45c1d5c303a8c6d28a69159cf93956d004b9f8c28611553db0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c5b4c4123c125bf1985ca811314d7eddb471c1dab761a8bae0ff7eeacbab3d3b000000000e800000000200002000000025d15183b86a704d6db12280a94c5568ffa8caa91b4dbe7ea7871fa9742eae7c9000000037c328e69c473d32a824b2953529ed9457cb48f4dabf8fdf2a67c85b9d16d09aac6772c1e5504a325cca32cfa84c8002ef899fa7ef2f6173084d56110d6fdd44ffc7c84b474607376f25b1e9853bb94c37c3dd7c4c734c4e68294cc8e5f004807f43cde8f83640fa1c95330c215acb75b5773a08a43387a230b0abe221781632e52d39c32310a6d1c7503d768ac5eabf40000000b73ba2c9ab26a0729d51b4d9b12868137ec98413f993c0febfebce297d9b34c22a59b723a5b4d99f81deab871f6f39068e504fce341b62afdbfc6d93d807042d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000f7ff4db295893f5f016d7cb393c5fac6034f0410153e519b1294c912c45807b1000000000e8000000002000020000000885919bdefe99589529a674a5488ef2271ba5aa16dc7d859849029e6d7c64c9d20000000c5f9180b02fdc6d2f611c5b645d766e3e21e982104a7ad7787ea39880a65631d400000005f36cbe70f0d88a9889c4ac8d87cc1e84513909ba73078e7c1ac6ae9d83bb9eff804eb6785509eb2932c4af999d7fe3fce2d8f29b4b3420e42ead827ee53a064	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424761575"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4EC4B31-2C64-11EF-AF9B-7E1039193522} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103a70aa71c0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2744	2012	iexplore.exe	28
PID 2012 wrote to memory of 2744	2012	iexplore.exe	28
PID 2012 wrote to memory of 2744	2012	iexplore.exe	28
PID 2012 wrote to memory of 2744	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b6d61e69411efc553fd2fa949160c4ae_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
169292ebcf535868808310186539794b

SHA1
2b0f25f7b0c4f02457fadd2b604f81c065db83e5

SHA256
8706528e67c1fa1ef333830d418d3fd7113e3e675aaa75f36f8b9e46853fcbf2

SHA512
ffa3d295d8b2ddccb5cc09f703ecf95a7f1cf8e6f17c729693cd9f820e86c3ec53907553b8b774b68ec0600d7a8a06db6aa4b4979e2f86f75c5c3f2e5cbbcd3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
975095738f811ae9bfc5359e0838a5d7

SHA1
5b8b11bd35a67d4b0e7c5c6ca700b59989257916

SHA256
2727d02d8bf5d9dde4a39f77af97ed86b41794730ef43ffec56d6516c2f39f27

SHA512
d355efd65fa5c0648bdd6c8e90703e1084b35a8e05b1f1224dbecc10c95f40ee1765760fcb641b84415e7d9be23a6b02133295432d429426a64f823ac361165d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8c7ff7e065bf5f4b1884efaa550da87

SHA1
d93a8e13abeb1715043833aad9e5d5d3682bbe51

SHA256
0a88e1f21de77cf88db0b734a13bc4b097bcfc4c4dd472f8abba4bfea656f275

SHA512
7b42421e7595ad404ae4c53da214cb49ced00755dd33c136052d506129bc0fb9e9518b5086d5d0e6b8175133589027190eb6fafa1aa08fe6822120d6caba9471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
965d6eaf93bdd8e6795f5efde0f48b40

SHA1
0e8ef298cf9206875e6795974cecfa7dbc28ec45

SHA256
27f8e703b32a2fd14c0e00691ab9cced9bd4fb79bf521bc19d978dbe205f1b68

SHA512
c18d0c390ed2dad9f1a77f7c1275eb26627e952396835166815e0a07c14b0df17ade10115ac08014deafde3c87948ff6b53102764215ab643d5f5d4d32473e35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d59a382175acd26e51b88a761d65d929

SHA1
83667e2235e807dac84e116770dfc8c0679e9d2f

SHA256
7b5f37a32885b017f8a18d93465a717515fb4dbc374b661eb70f636501fbdaac

SHA512
84722ac53357ae2fb94d010c4a0d2317b14f9c31be02cb9c4af89589c3606a9954f27b8e58f7adbd0edb71075ba83950c94efe8cd4eb325538d67090a7990f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a352f0075846a77982d4c67ea3a8854

SHA1
bd562f47c64252f8ba02bbb7d137510238fbdb45

SHA256
4038bbca0454fddec4fe1183fd3568ad3d5b373f37fcaf6ac7df13b20933565b

SHA512
b3b248a1238c1b3ed0825f8c6ea19ed029f5f106b549aaad21ee763478fff726faecc42367aab64ecdc4ac904a452176d94b45d47558c88ef425c83a3c39b265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6236852e00603fd0d6d3aa2d16876bc7

SHA1
645981c791db6e2fbb8be00ec25700cbec853488

SHA256
aa79d170e9b1fdc302efa7a9e4ab966e43e633cb9fc98915c6e4fc65e4147218

SHA512
e6f7fe8da5951c61d895c4b0873b8596173e8f3fdbba28ad90a298de96ace3c2ad6b92290905c8e6751e472efa0e90c84279600c7c6eb9db78d32885385be592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39dd710f27c302fdef34c1748902d152

SHA1
93cc0987f1b14c29df8eb90b30fe197e71012de5

SHA256
4099df87c020c039fa1ffae30fae5fc1a96cd6a001845ab92cd8072dcb66cead

SHA512
016f3e387bdb2b5c449ba087f4b2e24da3f2ed280f7d7d2521c0e1e33ba61be86802498e04c97ec93814ef2aa1b4a665b8f3c87cb851381c63eefee42372e400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ffcf4966b8ec511588286c571094c4e

SHA1
abbefb5fe27b036660b42d2a64ed4f3a0618a775

SHA256
1efd8e82b3aaf4cf8412a89d1081a0100c6722aa01b1efdd23f2b2715ea0bfcf

SHA512
2c10a3520fdeec88932812ef202711ed35764fdfe9ab457044c6b56750d4b4bd76e96031d7f7edd025398d73053484fccd940d1daaf63e8854ad87d95c50466b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36d4900f2f07d41c6894162ca9a57852

SHA1
7b7661c8196da5cf0bb2c9929f603ed7848745f5

SHA256
a15d3b63eb33f41b219b24556c24d9429180611b4c4c7ec3f628fe912fe8450d

SHA512
55de4876c6425cbfe448f078677651b4dc5b426f5704c4dfcf3a275a37f80130fac8872e6f1d26fd2c7ba4a0495c7c7c7d61973706e16bea73c777c369714785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63235df68b09fef7385a1459e4a17168

SHA1
11be0860b04e935f93bd247083c986eb54174b90

SHA256
a7498456fa47b3d16b9eec280fae6bbdd11c601a16ed373e60fe733e25f9925b

SHA512
d43147779b7a481f67cc55bf6c339072c21de525f4e62a4dc2c2a1866ba3a6b2373f2a0d9228989c443b85782c7da00f9d71b746831fda63db736703153e21ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f7a05664e5740d99c119b0a44deb871

SHA1
3d7cbd3ec4d403282fd65aa5491936cfe1b36408

SHA256
a31879d5c32c0a1df77e77a8a3a0e78fcc169fb8c427872c086a00d0ca0de582

SHA512
03c47702a8bf250503b92962b7ed1ff6be888a949f0ce591089f5703b0803a19770337bba6b1995d9b28734e7e9c9768f6a7bde8f9a6c7a65c76e01319519562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df741da6471a5ba6c94541128ef3e09a

SHA1
9114455e47fdf5a6f10338a58424b8f58242bea7

SHA256
979eeb8675e8815f5c50eb3bbcf42582a63fbd44bc3dbbf78821b34ce5f076fe

SHA512
7d1a3cc7292670a44378443c6279aa1036bdf5337c75c3e131695efd4cc6dd5bb155f79fdd7c9415b1bdf0786bfb5905ecc015c4113f4d75e197fcc15c2c6913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d74f2f38a5803886639556da305a56bf

SHA1
7fd5e5bf3c7c7aaf6ff6044cb2096838e85630d2

SHA256
87a17ff0b4f8931404a030aafe3b61f2a1fcb439cfb030da64e629c953e2b68d

SHA512
92ed0fff0dd9e37351690bfb8425a216d80eaae16fff882f83be08d86b17cb6839335d88c954f63e00bd885e7d94d01483421eb12bc286176fd390c17fc8c84e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f3ece48adcee0fedea00497d0534e8e

SHA1
e1f6dac3f559042d33ff0479634ee8f4216282f7

SHA256
59b6bcce7429d74e1d65c873221525f01ca72ef567c6451c625279b3b141c8ac

SHA512
7948f0485b34f2f83d355aa82b5184106ca77a9bb4d5e61a0032ccdf2fbfd4ade28be00d266644f81c7eef7d7d5d4c988485ba3d06d7c5f6bc5e47a62ba1066f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D45.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6DD6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit