3f049139ddec231e8225ebff813704fbbf06edb1a6b63de9276029017a8e76ae

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63add89ad329e9ec10cd4590e781efe4_JaffaCakes118.html
Size

68KB
MD5

63add89ad329e9ec10cd4590e781efe4
SHA1

9541d387405ee76a8d4458b9702bf141215c87d8
SHA256

3f049139ddec231e8225ebff813704fbbf06edb1a6b63de9276029017a8e76ae
SHA512

c9e1d87c0e286e26023dff2c2b1db17a41c0533b0b160d450eebf0edc029cfb37d34beb2ed70a76f20f9d5adb4c40f4b57a87c9412b49e99984209514f7368ba
SSDEEP

768:JiuogcMiR3sI2PDDnX0g6jOoP6kowmY4xmYRoDoTyv1wCZkoTyMdtbBnfBgN8/lQ:JzjXodoJiIocTcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004c19763e159cc0f1cbec5f26bec021c55ce52ffe8912bfd6db4f4734f8469de1000000000e8000000002000020000000481c9f9cdf76128f2253efd0a873879eb9c42bb51b67ad797ca3a59244163b8590000000b742a0acae537559301d6f442692230b5a232d16eecf33fea0985a1bd0ef09d1d6be4d1091948a09a28457f321204ce0792f807277d9d8d03d1f83c5da16b836c017cd3789c3c2e0383f1acc26e5dcf22218f98207902ffeafc375ab57dd44c82242070a224b44c02d8715ed82a6ed32276b2abd178ce674b018bba58059ab8cd4685dd6033f8b0679a7c02ae30382c540000000234f64e79c7663d7ac4a68a3a4d0f78549b2f8db56b07ad9ff0f267b6aacdfbad6bd06a88f8d69eeb1de1a690ad501cdcf9fbdb864dd5530a1413cafbfca384c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AD2F161-1781-11EF-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c941408eabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000619eac7fcb95347eed4f73b9dc25dd05ea3b115eff0c0254956544d84edde51d000000000e800000000200002000000046adfa257c299088a711ca6a30e9d4e9bc3b580492de7f063616aee151dc88d320000000465ce268cefa43815bd617e63ff4175a03a1b3d8055c008f8cd6524df7d0f83b40000000c6792d13333eb12d5e36481091edb1a264f50c2cf70137a6c0e8123e02ea12e3d7a8a8ded3822b1fbad6e3af1d2565201b09ce28cb90a595f6427c19dd164493	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422464879"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1284 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1284 iexplore.exe
1284 iexplore.exe
2032 IEXPLORE.EXE
2032 IEXPLORE.EXE
2032 IEXPLORE.EXE
2032 IEXPLORE.EXE

pid	process
1284	iexplore.exe

pid	process
1284	iexplore.exe
1284	iexplore.exe
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1284 wrote to memory of 2032	1284	iexplore.exe	IEXPLORE.EXE
PID 1284 wrote to memory of 2032	1284	iexplore.exe	IEXPLORE.EXE
PID 1284 wrote to memory of 2032	1284	iexplore.exe	IEXPLORE.EXE
PID 1284 wrote to memory of 2032	1284	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63add89ad329e9ec10cd4590e781efe4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3015f65dab3dc1ce6e13ee863a2f4e3d

SHA1
b4dad3c89224a3feb7a0fe170e3cf41fbe2a34a6

SHA256
19a2c2d164ede63e296fe4f04f6ed2a58ed55a860533d100a9140cbadfed0569

SHA512
6fab3f1ef62dd441b3bb21093e8102fa285f2b2c5c2d2d0df1e2e3d0f41c0c2992e39f4e099446ed8b9a576836b77eaecb3b12df47bd2a74c278821cc49176a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0aaf73eae9b13ef39bb26246eeb5ad2

SHA1
6b3c639dbf8a40696aff81fe68b78eaea1370568

SHA256
90154d663915cd406ff75453206c56c224858794e3af2cbfc25c2b94dcb9f389

SHA512
ea088bb629e225e47bfe9d8756d57ed85dbfafb7f8b73b374158f2ab0add231c12fad119a4988db85fc7fbf655ac396d95c1f1e06b36e5fc750405c49bca62f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e9c9ddce41b395d04901ede6256905

SHA1
71bb550e429dad6c17bda0c45e9191433717a6fd

SHA256
c990dc5644ca913735394a2449820ede12efacb0416ebc5378e649cbcf2fdbae

SHA512
e5fd77066f723cb1333797b4f860ad5349473d73e99deb8f9e297aea837285d86e026b17ba6c89b32ff9bc441dc41187359f88bc445ee3373621a3f081274a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40ede10921c39396310e2d5b2a927dce

SHA1
6f51a1a32a7e38098eaf8a639eb5fb423e6e690e

SHA256
b06a2ce5bd16966891d0b843de10b17da44015d5876bd5033bccf5769f7cabed

SHA512
1abb11dac95540b4912572f5b99345cd034c39cfee932e05d6ecfed33cddc1be043dcf3d5d9bb8a4213448a6399485d4e0dfa92b3aebc64269c2b2989fa8e545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e25cc24f3a66566d92ca51937a094c7b

SHA1
0d399a90d7acc10a72d2db31c86ffb6c478be048

SHA256
72998e1b231b1c7ad2917ae31e9e2bb0264e9ee69ca754c314bf236f40f23d9a

SHA512
6e184d50dd776cc82c71d8e92a5944e867cafacbded38866cfe67c4d19830cc4e3da5d2a826ae263e18bba1c0a2f7164a405f8d7feff70d2e184e73c4d36e7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b534dcb4dc84a92d7506985d0d5dc14

SHA1
907ad4485536a93e5b39ec0a93d679a871798991

SHA256
21771950bd340dd99b9baac42a69428b83e2280eca7011fd1c29b68c7e9a447a

SHA512
3c6ea52d0c4fd31152eac8452a0f2ca5081086cc60f5464294ebab639e630e35df34f3404131ec71de229132c5aaa6eac072cde87b82e4c287901a8225265305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
848dc2a2f34f2a0a22bfe835da30dc07

SHA1
c0fc34d8bbb6439b9fb4bdec7c1c1cb412f39f99

SHA256
2b9df2ad477493a08ab6ee2b18876f4357cbb8ac52e3696e4b29af2b4fdef7e5

SHA512
84e4dd4abc1feacc3994ebb95ddd8e7a06991c0c0d617573c98bd0195418b59af83b8dd8a491a18b9c639320af7f7a2e98fd0b7fbeda0f2541f3be8616a4b961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b44f0e1c0468af64b3d17694578b56c4

SHA1
49c139091048a5ade54d5ec1340ff164077bdb8d

SHA256
c404f1340f6fa503cd83f5beb46ed07371a460a35fd2e8429d25a9124b1fe0fd

SHA512
503efedc8d8ee983d91ee732de746498f4817fec2e302f727fe88268901415f9ebbd6d7f4b6ca5e8026db71d6cc8d7a897963957a527571d16d05b44d5dc1aad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab2d6a0929c6c620c91b722a58bd85c1

SHA1
e043de1100a926aac269683a312b18df29b4e31e

SHA256
028d09a55fa22c48cf2576a467f274ac768b275c38fab47fe86dddff384f9ef9

SHA512
978aa6be359adf40e2a083b60686be14cba3b28aa0dd51236eb1d019d00fb35a88f8e02a504b2d982defc5fdad23703cd302f296cd7bee81095ed08b91f76d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d683c64af743711ba23c31490d8f1640

SHA1
54d2254c941587d2a54109313b64fc28ab5bb28f

SHA256
684f7b77fa5901d17e8af969a5c4f22b6f3e55094f00209d6f12a0a37972ec56

SHA512
109a9d41d3224a757520fefad4920c376451f2914041d0e3412bfb00ab3e16e747fd89ea945d63222ff12cd205f2ba63861798a65e96fa1d0ef865e2e16dbf7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fe564478dc76de12f916bc98e3c525f

SHA1
4613d98bd7481f595bcb2d0411505bc58e11b543

SHA256
a81bfec83f498fb4a742e25caa24a903fea4639d894fe4a9e804b6902c374573

SHA512
2c64f19919fc05d9da6d5c4b1cf9041dc427905ee751d4884e9cc77453f0aac4143f8811a58295b572469410732e325ec00594f6257653cef227a94b70f58dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e0e2d27969f2d13a1ad859360e2e360

SHA1
af6121e0d2c384f8bed2696107d5c236028a0256

SHA256
1a7642adaed36b26271f7ac1e5e39c929c3722411ac5d795f07c12c6273575ba

SHA512
199bd68bca2cab19f8d1734a3a74cb1985445e3a1f45253ac2ec420231b93df64cd089733ca442cff53719c873c99c08cf4044b8b2bd59f5ad37e5b8b4985f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5954b23ba3faea3c1bdeb31d003a8207

SHA1
3fd29fff485df914bc1032d3277b83f1cb12e965

SHA256
cc07ac6d30babe452c17044e95d644a43541d82de29d5ca254e99b9f0291f5aa

SHA512
fdbf9a208c1736d45f2809f2db27363a98acb9fbdc8bbddfd9cd9ff5ca9f4cdfa51d28c6f8143d49a87126fe205848d5aee71c017d79b1a4fcd5c143637be036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3232338539396ad644c947666f43ec99

SHA1
8c911260804d6fa1eaad65580704d3694c081ddb

SHA256
03e961063c2d8662ef5c4721ff8efbd9ce0a0e2b4d3930957e951ccddebd52d2

SHA512
48cd8cc61171768f91e96ba59ad2b88158b443aa147725110b9228dcd7b2ee42497d4bff8a6bdd1cf63da884ff96cb5ebf1631bff67c6c845172cbc18a79c5a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA038.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA134.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA168.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit