3bee1dd5644868d5bc7b17471082e04ee99d0f7bd000253de3eabbbc14ac3859

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6644bee9a48175e2f5ea488a2a6e6322_JaffaCakes118.html
Size

1KB
MD5

6644bee9a48175e2f5ea488a2a6e6322
SHA1

e5a722bea186c62540d7117dd1c5557e6d7ea2da
SHA256

3bee1dd5644868d5bc7b17471082e04ee99d0f7bd000253de3eabbbc14ac3859
SHA512

5f0f247b9da4b6a66f90b8fc47bdf037681264d241f236bf2416452fa96871d671c99d6f9f5295001838246bb3cce81dd7ae99131a0dc3540f332740bd79c972

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000ec2a000dabd1a68d3d464c36e2e25b8ab26bc545f3c73a6f1da7c892a2ef9b05000000000e8000000002000020000000c3e3a8a921b29b9a3582c907e800c53b32c71938e2c9e6135db16a7d05f4a9be20000000345d93aaa1c1f727b9b58ed8c9b458b4117e80184edaf3af062aa08be0d149d34000000046c7bad1e1e697e043fce097f8dec0467314e75bc95a67915509dab406d2d8d63292c53a91a0b59e3ca6e8acc3f6f0103ca1e604c2b9d91eba1713d60cf053bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000218c369f108eebb80e645735487ee37355521d893c05c9bec723c9fa4ff8787a000000000e8000000002000020000000f5b4c07ad8a2ada6f5a720095c1b4a3f7c0119b3a297d061ccec2e8923c1a75a90000000f5540588823f12f397c90df572ce5f5460709355c5d06a5a3869eb05f6a1c65a7782a17c307886cdd1675011b485f303be636616d5cc470c839512768128f47cdff6719083682842bf5721f371eca824989b23a6a0ad20d0bdcb2fe0153ce76bbbfca09f66cda1787b0c5d8b7833f350fc27369fe1b0ee1a1262d593def5ae282dc95065965b70abcfa42db1660e34ab400000005228ba9ebd9507a9f74e675bacb59b506131f6cd5024bac581e97b89e95698bcfeb6d0d84dd0723bbe1ba55a1fd501d1d96b3b2077530d1a88d4cd59964f65ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D7B5CF1-48BA-11EF-B2FE-72D30ED4C808} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0faf223c7dcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427876916"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2232	2436	iexplore.exe	30
PID 2436 wrote to memory of 2232	2436	iexplore.exe	30
PID 2436 wrote to memory of 2232	2436	iexplore.exe	30
PID 2436 wrote to memory of 2232	2436	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6644bee9a48175e2f5ea488a2a6e6322_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0ee8416e810d91d4757bc9bfa8daa3ce

SHA1
9048da6940955c7dc81d75a761eb3cc6dabb5195

SHA256
b02bd8cc415c347cbbeecb666b5ef00f4bfc62c6b7f5dba44a60806c25ede84f

SHA512
086d3794a76399532b78921e8579d2cb43a260abaf1ebbe705e060688f29cd38bba6a350f3e79d78379c27728e05fbf0f2bfb8b712d3af055f05b2e216bd3214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
090f72ba7c5255c356b780fd3b3336ff

SHA1
b019d4c9c5df023fccaf9bc6e8c250fdb2a0d8b8

SHA256
84c40506596528dccb57507fbf1c65b257199a7480b84ca04ba66fa5f8b5afe6

SHA512
331b887137f8a8e063c23ae92dadf345c7d72cd1d0eb510095541b77c64ed173a709274e1338259cf277718a97e950695c5b8eaf5fc8858fc5a283355f326cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
430438790c8d00ead55f8a066c75c3cf

SHA1
2fd37ecc4629b7b5cf2af37db941a34ad41eda21

SHA256
56c72cf31f1e022d288516d1b449c498bc1fd4dc05185c9e999e0542ca960c64

SHA512
6bfafab121d35fa1ada2fe323e156647d853de6b64b94a95862e585d467da04a6f60f94f2665fb90daf83023c0c2d0002f53ddf737c82f42f530ee8939628b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b8d498f4d843a93e61f4e9b18b9cfcca

SHA1
bf554c420027aa997684d55609b9ff48aa46a194

SHA256
c3ad13b9fbf7574952b2a3da5cace7caab3e0d82c34f229420722eb2481baea5

SHA512
7dcbd7344a396864821be64464e71bf1ecdcc43a466c63335f634d0d4c3dd326c3ca03f7884b367a361a5798ee7346947fefae3d695d339ce0b38a5a550a35f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b8b060d074f7acb8a8f86500412c4dbc

SHA1
194ada7858f151392d93fc8770e8b19aa60b9837

SHA256
012ce2877490e1543dc550a0a9f85d8a855d1196af1aef8f1b06453b0d4711f5

SHA512
0b6ba6057ea89356c6caaa0f9fbff1001a7cd8d1a04559bd432ca978eb9a6e759e2ad3c9485b107b9b5e5ee4caf7ef9528b041c4f16e9b99ce588e6c7281bb0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5d39dfcf0d0a50978fa57c3ac890edeb

SHA1
733bd74dec1f5886d9e780bd851d897c5a5c4a44

SHA256
77079126cec61c11396e1078286f9f4ba08d8ec0027c0ea1bf46158731bc6c12

SHA512
ef5c4fdcd1693e6832071518bd28135e41bb9dbd4e82494d81529b06bf55509f8dcc2b34207c8c5b875c85e5055a9aff6d1eac052ffca8b3f55a05eb7cf1a6d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2aaff0e0923a065de89905b66e33e924

SHA1
e71092c566eb197954978bea945ca740fd0c0e12

SHA256
fd8c740b624a2be97fa34b9be0987ec0334b573d6efa9085a010ff2c487a210e

SHA512
c2e85bef5263bb1ec0e353039654520b4a18d8341980e341bf4add6ca271f33b9f48548cd12140b4ad1729f923e85ab7babfcf348c39a88c351d29f06def47d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cb0bd58187cd5ea839c0e74e1752aeaf

SHA1
dae691a9c1c337cc1e1b78dead140e9cb4e23149

SHA256
b653ff41f57eb17cceb3fb15cd8c86bcddb4eb9311bdca7be7956fb349d10f59

SHA512
743c8f4c93ddeb2e93ac9a284fe42232a63f7459416e9377d03ae1cebe7a0e10a3871cd73d46e737f59f4c1d47601d99d560808c36da6eacf6dc27d9689c2b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8de55a094859ca13871d0b59be1723d0

SHA1
fe07606bb5dbadc022f46a369a0892737954cb58

SHA256
ac03be558e5f851e92cfd8af1c10bd2d2468edab6d9d408a27840951b15180af

SHA512
7525d915b88c54a206260396ba00dab226c88ba6c0157689b57313ce2366baaf35b6fd307a47c758751997791694f27e3a938c6f29d90b76574798a4ed7cc269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fc5c4b1f4c3944d63ef084fe846eaae9

SHA1
75e06d64329547f77286a2b24f8fa3852f94a4b0

SHA256
97db44f3b6001772fc84481960c65e99d12bb819f4e2c45c549c098ec2d6c031

SHA512
4602496d94e0ba8ec86dd3e2d89c40db5a3624d48ad9deea7e2d4244ccb47f219cabb170cda4463888838e2ecf79dbd076fc1eeab79f816b22902421f1a759d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8b754abe89d33e349ad9401c027446b0

SHA1
cad654d4a8934e7b7e0e50d0485e954d55ebbc94

SHA256
b48fab243a4d9e396cb85ebfd57f020c9a4a561d0ed400af677b64588cca86af

SHA512
d3eadc11d2449c247602827ba3be132348382c964a0075df3986fa551daf3d3092108f7dfc7eefed7c09dcb622d9e53ce05032a5ddcb666b87758b98622e6268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
77f6373b1187d1d7df298b78d6346a43

SHA1
7f41b3aa2c9a7bacc77dbbff3d0269b099477233

SHA256
6c15d9611d80c56be49ff5b44f09d1229b6dc68ca294bb375816d410e2090846

SHA512
588493cf6408b0610d8d4ed79da9f692284299a0cd283aaaf56dbf500bf342e32cda36885ea7a54868223d657f838686e0d7569f31542d5e39a89b0fc64e0baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
107b809484a5db510586df786e8c74c8

SHA1
4bf89e5e3e3e22a9547e06178bf5597f413f8136

SHA256
7b9cd496c3c8313ffd29563c284089d109f9412054c500197ca56363bdec4b55

SHA512
872b6a0678aa31177f2d41f657388162ebbc4c7184884b554de91f8e9244ddc3d996610329c1dfd40e0a5d6c2a2fe1e2876e26497125d817f3ff46389e137815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
401cbc679171bfedcb25d3536cbbaa2d

SHA1
7f79ee4237a7b8977dbbacdcc39da8a8fe5eb8ce

SHA256
a85a5b2032ce85ad5835869101b8cf7eb4d65dad43393eb566ab6e549e497398

SHA512
a9ea4b5816552a3d5fd721acd775884d314cb78964228e7f0dab576446d87407fd95aca902870b03adbceee91566cb3d0d17437e732dc822f60e99503ecc9eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ef60ec2fdfad82970d7b1493fabcce21

SHA1
a41846a207d9cd286f14c1452457a9c8c51aafcf

SHA256
4db1f97719062c7be0fea102da039a42a2164acc8c953353062b39851dae397c

SHA512
4dffc7cace0192a7d1690baa51721f32c309acc1eee3693f9b4030d66f9b67a289bf13dc56c711bdc02efe9e6d42e50a541d2562773760ecf35a86ae29b2abda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
777fddb6108c8cdeb2eeeb70cb5e93e7

SHA1
22e6f002fa03b5ef592729bd314e661db05a931c

SHA256
9030d648abe9517004a886833ad8b281da36b212307ba58b6e5dfe12067bc9a5

SHA512
6db8ab5c3e0505a5a60a35e768f9ae15193abb3701befed4ee511b53154544679723f0ef8e4d24102b9647ad06402964d82a2999beb1f627181fcc417af4e7f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE301.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3B1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit