c13e607c01174a2fa7e9d51db79f7d60c92583741274498fba8c6f12ef7dad86

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7ccb6e6978e65ff555b14e309721533_JaffaCakes118.html
Size

142KB
MD5

b7ccb6e6978e65ff555b14e309721533
SHA1

1b49a52d1171299e87a1fd695433971a9db18087
SHA256

c13e607c01174a2fa7e9d51db79f7d60c92583741274498fba8c6f12ef7dad86
SHA512

a6f1eb72d9306f9c49119794e3dd25a83e030feed4eda75b8c6c2f7b2df0a7a7999b75170cc9c1a8f1dc4cbf22b0ac701fe2b9571c4befd93720af2270645778
SSDEEP

3072:SndkuOQDtx7dyfkMY+BES09JXAnyrZalI+YQ:SnauOIx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424777001"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0C22CA1-2C88-11EF-932B-4E2C21FEB07B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3008	2368	iexplore.exe	28
PID 2368 wrote to memory of 3008	2368	iexplore.exe	28
PID 2368 wrote to memory of 3008	2368	iexplore.exe	28
PID 2368 wrote to memory of 3008	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7ccb6e6978e65ff555b14e309721533_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1f9731bc0c47d01601337d3674d9fbdd

SHA1
28f412e83644f91b63642416fb3e8c56f9fd355c

SHA256
7cb179d221290204a954ad658fabef22203995b1360608aa104b7fca1a91ac6d

SHA512
fbd7dd13d6aa23df922a36a139ba8df121926a369e87574ee6f01cb68a33d6d4309cd8fb5cac1605ab30347b8737ad5b991518973825dd29d086b84c23f6f4f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70ae1563ac3a69764aa48245433bac96

SHA1
e9bc5e40284f23a405a967d091b549b25e120100

SHA256
44d13b817b1e96e0ed1f270d18de55a37ce534b8f478ba3ced653948dde342ca

SHA512
98a98e10f084ba225a3bfcf3dbbcc10dde51b85e951884db9c39b9565a6858f118448854b5693fc5c40ba458377b30203abf53e28a7437840d9ee77e7ca799b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62c0bfcdef59fb8435367bf8d49964e7

SHA1
db3a28067b08388ea244a4f5efd41d2657c0d241

SHA256
fbeda1a61acf1d2b75b99cda6e138ecc2f0d46e723d5184698c10d98d7248207

SHA512
6eceb3f48e0e8243a2a3817c783ac11667969ff2812d9658c4958a809ab32caa1f81232d6e57c8588c5d64d510bdcf38030a66dafc9f2b4c4b188c724f4f1ea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3984dadc1c0ac44a7f8ffc0b0a094dc1

SHA1
97bbf7127317b2d74d9d22b5c0303067f232c8ac

SHA256
b20cbaf0961ee4ccb3d920b6fcbe905b31dc085a2626e8ac5766ab630d9434d1

SHA512
f061809fc4ba3ff38ad95d098ed0e6144f4450e70bf9b65f38692573a8cdfdacf51eec458d0db12a5d832af9e2ad131005a50a930175ea757932385d27df1b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b963a9bdfca1a6935a55e39f021b088

SHA1
8122495961bb2991b5ec36bde6d87a94cbddc73d

SHA256
499f3bd2f4837be2bc75a470b2c3e589b94fd0f167c997aca7ad3181093aaa75

SHA512
6cc990401e4d15ed4f57012b6e6d9826d04faf46a18499aca37b63c927dc12cd1c22ca13a2b3f9dd341843dff116af3a15c324d67d88b4548dff8327dce28aa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dab2b1de5e9bc2da0c2fe6b56f6fc05

SHA1
0ca6f94216dc5451b7ce175f0357ba817c6bea83

SHA256
e17a66171242f6538be0a6cc0a7a2077816f5906598c80b053ed4d0476f0397f

SHA512
dca754f677be8c1cbac4146dd8a0ae8efe32d6a35d1b22bff8cef469ac478f868d51638e8032426520056725b43a5dc0002ed69c3309c13f0a499230fe5c2a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
323cb0c593929c84bf01e4057f040ead

SHA1
ff0c4c2a2814dc176b833928744b35f5266a864a

SHA256
3bdbf18c775e13442abb3664b4b85dee2bc083a186e1fda74d3ba399fa11698c

SHA512
d7f32472ee922215b9cd904f835a01f68b9efd5364e1e327bb21cd62084164cfba605f9eefda42b9b901614b531b18ec9e98f6cf17d0fca884d46f19be82b5ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49d100f7c3235e32304837c4cb1e70a7

SHA1
89e454a8af4779d0fef7666ed98c70dad3e12564

SHA256
74f821202c6417026f5b805f691eab84e641cb95ddd2c8be1d12925c0dca1a09

SHA512
45a67c1989a49e23336660b85e05b27396c063fdcb3761974d5be454cb36e34e9c9558f1f2a11b0ecdabc7bb40ce3aa0c933f5c8e6953e7e41bb9119e88dd9aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c564bbbc116997c5ea37bbfdb23cab1

SHA1
3a4b8bddc6347402aee50d983594b8dfa27a232a

SHA256
f46872844f6894a2766001944af5233c60e345fa44239a1a76b6555f1f10aa32

SHA512
56517f5231f9f8118bf053d84055193b78c8ee1f88007f5cc14a8e45a17257e4a2073f16cda6f12960010113132122b2c0ab4c95f0dfff31fbc16734d59474a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae680df3e733391e67dd1594add6e392

SHA1
6e4eb303449ef018aa8c6edb2fd3104c46fabba1

SHA256
7fed5e339520f97a037542d87b362f7c43f25a36abf80c107acfc94fc08d1b8e

SHA512
303fc254d47aab59afc1d4468f7361f02f414c5087b1277f0cedeacdc0dc98dd5c9b0b290f7548de69c59a878ee6a6aaae675e5402993cd0db0ebf3a5d9a6721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
84bcc5d5258b2fd041ed00861cb5b0b8

SHA1
f41aeafa185187a6fb68a2e979b058f81a351839

SHA256
97638e9467c928380bb35e64bb620e49038f293198332d45c30a2dc61bc0ace8

SHA512
d853faa83b1b747c5bc723b8c6738a47ef842d2e8c82beeee844edb9a4642ef4424229cdbdb8d147832a9c0fb36519b3c9254eb0cf7575cac187befa7901de11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar103B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit