12c3ea2519427403e87e2238db703f7513cb911c6c96cc8ca5e66b50caadbf1f

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63a61d42055e298a1463c6b0d9332bf9_JaffaCakes118.html
Size

62KB
MD5

63a61d42055e298a1463c6b0d9332bf9
SHA1

a5823594c660de626ea03b75760d972808e65a2f
SHA256

12c3ea2519427403e87e2238db703f7513cb911c6c96cc8ca5e66b50caadbf1f
SHA512

35364f1fbe2e061a53da3c2dd95261ec72cbe54fe4084cbc67e4642ac19905cba0431c3b0e975afe64a8a9a7cfb1bf2c3b7d7d37f507ab1fbd57c27338543e2b
SSDEEP

768:JivTgcMYUcXGeCSXuhnoCk2BoTyZCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/Ijkk/:Jv2RvTbec0tbrgamchNnWC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec6b25a844c31a4f9f417d08ef349d88000000000200000000001066000000010000200000002fadb3657ea4352d92a84b3445364c7a48b5f44200116e04875909844ae8b78f000000000e80000000020000200000004f63209cd1b54ac2602a2cf6040513e9ef30fd88597cffa7d0c43277d40b7b33200000004ee40dba078bc12e43d52b86131fcedfc0c8906e1edd7efad11e8b6c2cf7425340000000dd3a8904de843105376bc9b73a0cef28191275660a8b89f694263622ed642fae9875439456db766e60d91927202b67ac41357a80e8a4dd267d18f7046687a1e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e056f6bd8cabda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec6b25a844c31a4f9f417d08ef349d8800000000020000000000106600000001000020000000974f6351aeaea0214a904bef04f84455573042b3da415a3d9b90a7d9e5b76a8b000000000e80000000020000200000001518b73bfbffb0cc00334e0ca205d1e5734f5211f901e6777b86d6d800a8a93e900000009dfa5faa5a79ab61cca1df41ee4c0e890b789721f177007b168a846ce8c61740f03025e079eb40514ff0b53494fc20bb4d5de60440276c141a6e4e5dd0deaad0a90cb140b6546ea18a7131b5e7d8dbdd1d778275ed0b95689a65d508237d2b622c9de43f63ac0cb32fb5c6ba33d53c0483440015ca381b1dfd29a686d8afee9975deaac1666dceae6971a52bf2c31af0400000009a8ce01ae30a0deb01c92515de9208d682a47b123f9ccd2a9d8a65c1b81a37b19e45bfede319373df68510d4690ba8f896c02071839a83ab729e4283eac22c4c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422464229"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E93F4D21-177F-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2168 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2168 iexplore.exe
2168 iexplore.exe
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE

pid	process
2168	iexplore.exe

pid	process
2168	iexplore.exe
2168	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2168 wrote to memory of 3036	2168	iexplore.exe	IEXPLORE.EXE
PID 2168 wrote to memory of 3036	2168	iexplore.exe	IEXPLORE.EXE
PID 2168 wrote to memory of 3036	2168	iexplore.exe	IEXPLORE.EXE
PID 2168 wrote to memory of 3036	2168	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63a61d42055e298a1463c6b0d9332bf9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5227e8f263a28400ef932c8f6f436212

SHA1
9b0665f94c444fa47fc8e6f430aa8f6224eb21e2

SHA256
3dc077fe0e31a51dc82c35a3d16b97ea7421f728f264c27e295a9f69d51ba865

SHA512
85846a659def59b1ad669768c241fd0be08ec05048d07679dc632d21bbc3d317a86412361fe3df215c28fa8ae32e1e4c7fadbd305cb66d65522a92f69f6d7ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26b2e68a37d2d4e137021a91cb32a399

SHA1
78af4cd212d3196d66174d7e08572795812f6d5c

SHA256
1a95a5cbba552ef11add74a93b2be9afee67510e10fae1d25d2fb4ecf15ce5a0

SHA512
547b334b53714014213703514317f847f0fe1c49e256d7b620acaf3746cf8f84170f1afeec7a3358fa830e25a358b740924f01af8edac6992fcf13b0850fc770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39a910cd73eefffc872d0f545b55470e

SHA1
af908bf86cdc5799c9febe2882c0ba6dfa9fc96d

SHA256
0d1b5ba2c390981f35b85bf4202a14cb742311172ab11a766f6643404979c125

SHA512
56cb72e53a4983f295d89b168f10056a537c46933d14fbc161c20b85d55eacd10fedf05e511a05c0b9f68f0267b275683c91149947252615c0c1c2377e531d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52b09d1702a2719b59d84faa5e7a9051

SHA1
caec74f87de9e03c6be217ba1c3f2fd000920daa

SHA256
f1b28abfe99b8af6630e4d5a91ef9f6f0791dbdf452a0da7e75ce18f96834775

SHA512
81316c3c806c186af4f79d366a68bc0fb7d1123bf4f012ec81fa8657ddc54f3d7960c2f2adc2b84a6d656313093a2ae7cc5d4c56c937ce9cba9e1e7a0b2ec05a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e8b622964a0102b8a427aa960b0d5e5

SHA1
a8e3e4c7d54c0249fd6d2e5729a724d92ebacbc0

SHA256
cdb5dd5b34de8d4bc8e5da841be0cc2eef88f4fdd50ee2d777e040bd0e749e33

SHA512
973900fa40a0354feea097c790554cab8a3ed5fad5dcb998ab690bea365c52144a8618ce11383f49f899bd123f931c0e569d57bedca84078cfeecc5521de770c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02d335e58a4ae5efc216ddcc6cbfcd6a

SHA1
a1e5b7e90823fe91effe24ad67702059a3ff27ed

SHA256
f81981bed368ba12485e1472cd56e613a307b97b3b40eacc0a12983bdfaa893e

SHA512
d742e1f3e27fbadf348cf13577c0628430041ba873a3354218b66156706d54471cc0d5c3f3c6d13208922855f98eed63b37e359ef8e09ce85e2e7d3ac84fd76f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2262b9aa9a25556e4a143b8c53950f96

SHA1
3af848411e7ff24feaa9d3c24ddb49113ea32b17

SHA256
7462d5f406f0e7799b092b65d0b433d024e4fbb519c04fbb50c1785ca04dfcaf

SHA512
eaf5064b5044199dd49d8cdb4ede5f177055d68ffcb7e26b264b988b40b0f2234fa88004b9a837743bb04051d61d34ef83e132495753a12ba512781c3a8b2429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67e96f8aeaf2715d3526432149580106

SHA1
8a82de7e644af55e8c63dc8f6f098ca96c308995

SHA256
39984e61b652afcca9a6a9f8703ed404702ca5b650cd1e3e6521dc387dd680c6

SHA512
433d896a8aa58c38e549fa1093593f424bf6c8ccc684917761008caffbdd7e4a2397280d75e7b04e4a9e9e91f5d28988854fb0ab3935079345fc16897467fe9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
929558ebf735c5462c258bbeb3d5ec53

SHA1
aefa0c7df90e5aabebf2a8cab65e1f06cf6dcaac

SHA256
da622cb0ccd4c2694a5ce76d80225efb92a38416e90129466a0360a1b9d921ad

SHA512
acdd4eb5edb0cfd24c511c3c39ed32691635967b1bef90701559f4eb6ab874943d5ca08d5f9f13aa5c4ccbf7d26d4f5ce8f99f2e713c4e9ee8a5f20f6d5035b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
337eb3faab124190cc8eed9b2b9f6fdf

SHA1
41fcc6798ef489e1acdfe3ddd22a88899a0ef80e

SHA256
4b0cc5547a2e141202728587137b55ba130d979cb7366d86894fa0a2b7973bff

SHA512
6236ee47747242fcb6858f37049c167613a727638a3dc9d0936f1811ee0b7157e9a7d227862136994e2604d14f3e801f099b5446294540c5f38125ac9ef6500a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab474F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48EC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit