7d5cb029ead6ed1909d64778e2abec4605317ab7840ab3d77b3a32a0f3a1b6aa

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ab308cdf3c866b9c343d1cb7fe1358_JaffaCakes118.html
Size

27KB
MD5

63ab308cdf3c866b9c343d1cb7fe1358
SHA1

1db8b278e45c9507f446127b910f7a74becbb40e
SHA256

7d5cb029ead6ed1909d64778e2abec4605317ab7840ab3d77b3a32a0f3a1b6aa
SHA512

ae33bd454fe9b424d1d137f515d42990e61ee7e5ad60d178d372a735f5ea2b2d0326c116fa61772ef5eef5f8cfe8a2badfca547a5723a0f4f4772fdfcfa15e86
SSDEEP

192:uwrYb5nQqnQjxn5Q/vnQiemNn7nQOkEntJVnQTbn9nQ9e0im60VyQQl7MBGqnYns:tQ/l5KOyzS8P6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50059aaa8dabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d2001f16334784529f664245c0448fbac8b21a49f0c26770b2f4d41a9c15ff1c000000000e800000000200002000000081de383d5d730c057c7b54764670f2f05e59a008ec7c0d803a85fd7b9b4fb7a89000000040499a4a7e91b9dae0aa5f0a7bff702ace9c86967066f3f3e82d297fd7ef77fbd88177108b32666dd96ef12cabe59a0e8296ea0ed7d4fbfebeaf95935af85ce5c8064a96cbc83775ccc75323ce7a714e7a5511c88f595dd48690d0d5b154dcc5699b8f7cc8b6e1984a223bb404d6a48e0f56802b7dbfd9bbbac6f48174e89da0a1802300d2c34756d9c04b49f389898240000000a242cc472e1b335d40dff035a2905af2a2cdcdb19347bf732044e79ec8de8cf85b2d08eb98656b8b294463f035a35e7d9cbbd4d546c4a656167649c149fa526d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422464626"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5148FD1-1780-11EF-A7EB-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bd8db594b1545dafb069296423c744e111319efb6c209a42924027bd10e487f2000000000e8000000002000020000000e9ba27db046bbc555fdc0418d710e89979560ef0e9e1f86c33e2d30b06052b62200000004425c8a2886d718ae51ed0ed695dab9a830793c7e4d2534bff11730bf61b60944000000066232d1603a343d42aa75491e4b8d983ce1620b5ad96637663463def517469d46a45c5a855f61281caa1492705fcb9ca21f1dd98ab91f1fdcf617aa8e3c6f27b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2520 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1692 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1692 iexplore.exe
1692 iexplore.exe
2520 IEXPLORE.EXE
2520 IEXPLORE.EXE
2520 IEXPLORE.EXE
2520 IEXPLORE.EXE

pid	process
2520	IEXPLORE.EXE

pid	process
1692	iexplore.exe

pid	process
1692	iexplore.exe
1692	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1692 wrote to memory of 2520	1692	iexplore.exe	IEXPLORE.EXE
PID 1692 wrote to memory of 2520	1692	iexplore.exe	IEXPLORE.EXE
PID 1692 wrote to memory of 2520	1692	iexplore.exe	IEXPLORE.EXE
PID 1692 wrote to memory of 2520	1692	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63ab308cdf3c866b9c343d1cb7fe1358_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be5f684616a10c4f6d99fccf858a391e

SHA1
4357845fe5671a4b694cd8d9456ce79589354a61

SHA256
bc96b163eedf75ece7071467ffb5c2a5b8bbb8bc03de869e2d03e42dac6ca2d3

SHA512
1eebcd659c451402f6a53d0c72819abbeb4d0a061c60d9e04d861b415004f184a905bfcd264b99e941a77569b0f2ed24a78aa9ecd2d83cf4e0fb5e0542b0797a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09305588f5bcc2cc63d054c1eb44d3ea

SHA1
3810be9890e31ce4d67553daae6019a38ed4acb1

SHA256
ff0651d2f8ec19a1a19e569090ebbf1578eddc8310261387ebbec99f2a2e3af0

SHA512
e5534408a038b54c1fa549833e5aaa3cb3be185f7c36bba9d5fd8e991aac8960ba77c84bd99f7682ff5a80cac2ba6950216d564d7f3547ab4e54a821ff48a957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
686e9cc7a420b444a97e6d0491cf2ec7

SHA1
baae3f62ef118211fa6981be25a8fe1f7b750477

SHA256
90545cf6747a9b7b345e92de4416afe4a9d05a948880d9b20b1d19a39a210a32

SHA512
04ee506adfb9c465a2422d65b06a0c2abba9592da84c687b6a8799cf3d343becbb3a12e8c9ed24bba1c9ece295c4427a4912d9928eed1f4ff1c82188fe824ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31d880c14eb390a02b7a75f65125d2d3

SHA1
f9fb6abfddef79d23ee8f9bc33b3b39f9d7454c1

SHA256
1a7495b46fb37c25b2030a023cbc6bc770ca759437762f77d3584fe1fcb6e1d5

SHA512
8a366f122cd7ab9b2e8a1103d78692d3adad427eec836367e2dcfc566162f76f56b27a7bdeb5beb5f015a45727e927aa66bba6fd5cc8c2e269a2b02a19242a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7918ecf3c3cb402bb8ad619ba326ff18

SHA1
12ec8b3c70fc36f79e95dae1ddebf593837fa727

SHA256
5036ef884a53559945c740fae08c8a933586ae97c036b6dc401560571ee22d8c

SHA512
9b985fb0687b02b6a7d9f732d8555a1333a33d672b4b32cb67c96d885ca313dfcb9d1a89733ae8991ce0e995a7f5906dac4e8ca8f27c968bb50e73933cc7d328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a5621261105c783f87818f88433ee11

SHA1
a74795358ed7379a041c5d4d699ef779091d5356

SHA256
7291bec6362a61fbb2ce96af1b6d6bc2e772d33f32c3cd1578c066738c100c32

SHA512
67fd9eef2a49acc17b33e6a30dbcce48f0a73839d7a6460b4faece4f4a0c15db1674135790a50e2a7f1434a6c661db0b4a38580c4d0d06c01e5e34fce111805e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efd1676dff7e33072a4594335ea221c7

SHA1
2aae8260ddfd0467fa23f25efd7c311029741b86

SHA256
48dbbec183c707c2539d3c21d5d64bd83be1a4d27ed15dfdf299461fda9dfe4d

SHA512
6e5d556da36cbe576d541e16cce92d371bf7a3fa34bf4d88c72ccc43c6deee0e3375e8b3345061a0b3377118765534ad5141a8e12ff78e330f5260bff8700602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28d3af31b827df832433097f4318c5f4

SHA1
a44a0d533b9a266f025d012f4f0329bbb4b08468

SHA256
503373bc313d06e6eac83e9b0630fe728d7991418612d2c59ff398b44f64d068

SHA512
0d997f285d53585eda6b2ba1d70e527b7630147c3ebdd40e4599944e7ca6cfefe958ccb8b35863fac3972920e2e0536c2cd0677f0a32934c9bfd83888a6d8df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA665.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit