641fbb0c9157fff5adad272cd08567c7951cc8ae0407b95c1b8727816feeb936

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63b619c55b84d0cbf0d1bba605254ec5_JaffaCakes118.html
Size

3KB
MD5

63b619c55b84d0cbf0d1bba605254ec5
SHA1

6a0bed3596a23c1a74c732ad8a5092f704a0176a
SHA256

641fbb0c9157fff5adad272cd08567c7951cc8ae0407b95c1b8727816feeb936
SHA512

28094d2ebe6c31890067e609c68685af38459163bf4dcb75948603f38e0b0e01c5914315f8d9f810f66817d1efb98019966a63471f781f98ebea0ac08664f276

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422465517"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7261A21-1782-11EF-8554-DE288D05BF47} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e55243e42278f4192f2a13ab4ae89b2000000000200000000001066000000010000200000003860db2f30220776d8f8ad11dbda6741edd2eaa1c3ade3f98901bd1f2d1189fc000000000e800000000200002000000076c816e45c44e44bd7de2c3359887f44774fbc9d5db975b558443dfb6e8911dd9000000032774168823ddd7549d384fad25f402ae62ab01b7b80c6156604ae12815c77c0398a7a26b4f547ffd9d779fa112ae78264b440918750f1ce3210036dbfc01268d71e1cf6763416b07b71f15c41c9613adc1311176db511d6d00ac45152f09a257a923b5de2fa00af43968d561a2adf559de462c7de327682ef5eb7b6e4b190c80f70d22406b5f0d60c3334a13f208b1e400000008e8a0539d3de2ea18623eb19e139ff0155d4448923d653d4c5401ed1114d9bc230c371978d93d384bc165fcaf0138a0ac7fa76024d64f4e7a601672228917bf4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e55243e42278f4192f2a13ab4ae89b200000000020000000000106600000001000020000000314121bc3d446ce61b6b77e515ad0fcae12ff1dcaaff2316781eed84c915767f000000000e80000000020000200000006430e29d890411e4848066bc9d6daaf003078f21d10a703d21d5dae5d508d35a2000000075ba785dbe93b71f1acf8c5834f23d1b1ad7598c1ebd59f98a298ddfea17b6874000000068590f58d51453c52398da4466b581c4392bb30bc1a2c0ad6e9a6fbd23ac328a6fb393517e175f479ed9c6651e55ce075632f546f27abb3dc293c4d003543e6c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004ac5ce8fabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2364 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2364 iexplore.exe
2364 iexplore.exe
2260 IEXPLORE.EXE
2260 IEXPLORE.EXE
2260 IEXPLORE.EXE
2260 IEXPLORE.EXE

pid	process
2364	iexplore.exe

pid	process
2364	iexplore.exe
2364	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2364 wrote to memory of 2260	2364	iexplore.exe	IEXPLORE.EXE
PID 2364 wrote to memory of 2260	2364	iexplore.exe	IEXPLORE.EXE
PID 2364 wrote to memory of 2260	2364	iexplore.exe	IEXPLORE.EXE
PID 2364 wrote to memory of 2260	2364	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63b619c55b84d0cbf0d1bba605254ec5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
237575d4dc5736914f45702659b2a3bc

SHA1
f130730833a9b0636fc2493ec3acee8bc182fd31

SHA256
5b2af4b91b112639a530bbc80430fb30900277854cb36222f987be221c891607

SHA512
67e9c56c9dfafe6243c6d11c18915710330b72591d62894e73f8b61a2ceca7d6dce4fdb9ff1666015c70f9ac112344c480b4147f30804965597a624758fda1ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fca494b8c8a772e7044d3ccdd0f4c91

SHA1
fd53fa910ca37dfd9d0bd6e8bf0048f43ed2cf9c

SHA256
4a6232ba142c9487c7bc23fab87d655676271c968c2ce76d3368d2cecfd0acf7

SHA512
e0b861b6f2679c1c1397c600397fbf283232b965b9cb18045c6ca3d4de063602090ca15e8bb6ae059e779ab3e2080664afb8971a2c224342f3c9bdcc0f921b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e4d708a262f4492adcaa0d16ffd00f3

SHA1
9b9a0d1200d4bfc09f3f59ffc32555039dc09bdb

SHA256
c4f60c430a5683a831ccb1a0bdbd4287cda27cee39e6d5a58f6ff1a867d22bbf

SHA512
a1c66eec69aecdf712a81789033c4aaba83c091922d51188c35e6587d594930f9cd89df4419f725464fc0e28bb6d6d2ea6de8ce4d2ecd29e3e8ba88157269afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdf27b37557be0de7fa367144895e675

SHA1
1461bf0b9eeef06aeb8019ee9a55ca24b589980c

SHA256
f80e0d7f2f385d6ec10ad42f5f64fe8d5fa3dbe6a4b147135f6b779b61be3029

SHA512
d617acb3dffc2845d6d23342cbd8bed1ccab995b77f405ee3de8f42a0423a80df25d9f042bd7e747edfd4e6d81d6b1c7f64d3295ac8fff0d3b7e745ab2dd02f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c0a9b9ed338d7a7fa390e60399fea3

SHA1
161cfe0d378a04bbf9afc152b94e0b01971dbe22

SHA256
f88e383bf6d62187816a19597a71953170bb744bb3d0c1597265dd77b064a1aa

SHA512
8a37f8e99c164ab9b3976ecd24f050edeb354434a350b9c5426f6d6cda64f5f47af36c868bc69416785b63465b00e2a8974fa82dc1311105152563cad4c96d6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa04ceef37bcf077277018d43c93264d

SHA1
f08b0ef3bc223b811c640fe2a7ec3d2bb96bc033

SHA256
18e278c558aa20a1537b6676efe18a9f6b95222e4b6fce75f6f0d4c95bed55f2

SHA512
af071a309f8777d6e43cd3c6e08e0e9ec12e598cb96328df102518fab86bd609d96d5e66b3f24dab9acf2ab26909242c0ab18d2befba7983749219ca47c7c6a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6c84dbd7f5e6e97c6e8a6d94119afe

SHA1
110d5f6b7e0818dfde439730dfba1509a2d11619

SHA256
8545ced9bcfbf6990f246892a708976893845be9597ba8c6b359f99e87a59691

SHA512
5b79da9ddba296d1ca9dd4de6082677526f4859fe1a420a4cc1e94af107f5736788eed3d008d7e33538bd9e839c321d9dd47eb1aaeee4f25ea1d1d6d2d3c685c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d300885d55a21fce191e3eeaa78fef25

SHA1
d1c64574b5a4814859c0846cc6304fd60a5d0c40

SHA256
296dbf21ad623062cfa38db92f39c9b9f59a9f3deee06d0faeb8c8c3d04e3fde

SHA512
53dc6639f236388634a6606a7b832bff3679eb6c1dec535d9499275d708848e640e1afc76caf4bf76b657011ba9acaca06c8a6aea11e74393236d1a54df738ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3af62a6efe4748e6cd22b3b1a2a7861a

SHA1
46bd9cb4deb1e42d94287173c70baa30ad994b5b

SHA256
bba638af9a8e7f5421e6318aba31169aa10ad90f00b6b29dd853da76d6d78df3

SHA512
7dd1c10347e767bf55d8cbb7f974f654a765398183e8b36d919dec0d84eef9fa8360aaae45588ced40bd10024cbd05d37dcb6479577d36c482b43899fbd6111b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ba3ad374d2181cf3dc2104adee99604

SHA1
0d6bf9547a58ebb4aafcbebbdb7cab4d6ada6d01

SHA256
75e7e561a15ef921950b9af41c85097d853648c1913ad29ba31e1a6ba483d3d6

SHA512
0b0c81e58055d21de9adcec852e93aca4dc5cbd1d63a255af2e7f682bf083bee77e9782e0fc326b4e25a8de7f5e5eec5a20498d25cd0db99a282701d746eed64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e162d4f637d44d5ec8017318e35269

SHA1
926c84635f1b2a78dd77ffc83855144b04a67317

SHA256
d73e06dc318d0d6b57a860c0e85927594ecdcb46397f5338674f9587f9dc2e55

SHA512
8b094105137eb4d71185a3bc54e7919cb53e97ee75772d4ee8229394b19ea8cf7449605e5798c29a16608329e590e255eb163431e75c1bdb64026e26b8857f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc3d159a2af984b14506a2a3ce5161b

SHA1
8b7ce7f3d8f2e3d9a3efe72b4511408a324b4671

SHA256
aa7fe408486122d79c2993883662215315304230c30f59710ad2dc7ecffc71ff

SHA512
e6e0faabf49ab9fcf38fc682fad4e655e0a5ad058a5494e41c13dafd8f96195b6492a099b1d2308720e83eae8456ce7afedeec0db78d463a689b1d937cc882aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f4cda3343a7a0b5e83eda539fe40ca

SHA1
719dca4088966a78b667b751d2808ee4b0eb05a6

SHA256
35b63fda543ff7b978f073f9705d52b83ff90b773cfd14d8f6b8256b71e714f7

SHA512
b62586d34f32cee75c0750e05b994cce4dcc6eb896d2181f03d4270bea1e6f852380f62a6589f6fbb091a1fa037dc9f1b6277d4bedd42cfde56c4629f72bf97a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e0632d8d7a957746838974089068d38

SHA1
b905f9760cd61370f40ba3a437dfd6389fc0b8e6

SHA256
0aa3d8dd7343e134ac44af70416cc20eea1cc24958e80967714645d610484592

SHA512
9c22cf3bf87e723b72b6983b06fc2dc0056e5dbed679ba9be8b21e0cd0092d272d1495335a70906855a45e2827b64b061c386899f07e0fd27bea062e2d067ef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfa538c31de7b2596737613720a164e3

SHA1
f96bf9e07e73f8617fc71005300efa629d52905f

SHA256
d31eeb3c0fe102b8a75bad93603dfe8c33eea6b590bcd7eff016fb433f5b68ba

SHA512
eae46e3b657bdf0d998cb0e7f003f273399f3de8a96db7eab5b4129ae0db7ca835f111b59dc919671b2f233c23ede99785d950e679e94b83c6c8e0167d363586

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E55.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA356.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA36B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit