9f46e8d42797850b5ed44aba7fe88311905f7c38432415142991c68c17e8e4e2

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63cde215bcd658af4a4e200d5b113819_JaffaCakes118.html
Size

20KB
MD5

63cde215bcd658af4a4e200d5b113819
SHA1

e837daf867e41bde32c78533d7f0b31ff25ba829
SHA256

9f46e8d42797850b5ed44aba7fe88311905f7c38432415142991c68c17e8e4e2
SHA512

b120bf905eab449d1fdef34027e536c84d0a1e4bf6d286ad251f1e7b85cf4c695a6104fa8a88c15eb1c27d97969b7c29ce91a1b1477af5cc33a87017848b5229
SSDEEP

192:Cnmn0ikr5Tn5c5jCu3NoNhvTY5AIxTN2B3EiAx8/OyfS4fAufR6WfxtSfoEZfRln:CnG4hvXIxTN+xA7ypkvi5Ri2GlyV1o

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cc158194abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7115EE1-1787-11EF-B411-768C8F534424} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fe393cffc77bbf418647b5fb5602175d0000000002000000000010660000000100002000000063ab6eece7871210dc00753404e53ffa26c634f40215ce3e3a113b1924b72839000000000e80000000020000200000004f0cbe5802d803a4ed06007fe3f173ba5818ab01b9e14b6895c1b1fe1ee53500200000002f6858774be327ffd0361e09c94de1b4686b9ccf5f4e5865d9eaee486760299d4000000074b2fa99dc262644f31be7fa7ad63d843aa68e180c8bfa0bbe55fbd8e5043e09d0724209c4fba7a88595afbeabf2051d56e1d6d493ec5392d0bf69ad382f910c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422467554"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fe393cffc77bbf418647b5fb5602175d00000000020000000000106600000001000020000000888ea4bd18ee596722a920dc57227138c9e0c647494acfad896b2785e38068bd000000000e8000000002000020000000c03b82593da795dc1f00a472c34902a7a94b3b108b593cd386202f4c319a149890000000e95c569a260e479ce204f6152dc4068ab72bad7339eec29841582c0347e959dbc8b445277e17f974cd34ced6da5a055f8ed93433343facbec6e6a9c2b802829a1a9054aa9779292b8a104e2138923b79f946c5e18e0b1614a917f52ff55f12abfce7c574a1fdbdf697cfc89fcf89e38cc122d71dce1271e720884e57c006fc3891f8038d6f00aa0331f5cf484392ceed4000000013490ce4ffce80e04033477bd485472ff018cda164372ccc965a5789db28c4e3ef4357ad59223feb058129da0431ed1635a3b74290c972a7f0d6337a6e0d87c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2136 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2240 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2240 iexplore.exe
2240 iexplore.exe
2136 IEXPLORE.EXE
2136 IEXPLORE.EXE
2136 IEXPLORE.EXE
2136 IEXPLORE.EXE

pid	process
2136	IEXPLORE.EXE

pid	process
2240	iexplore.exe

pid	process
2240	iexplore.exe
2240	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2240 wrote to memory of 2136	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2136	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2136	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2136	2240	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63cde215bcd658af4a4e200d5b113819_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6efaa08813d0b48d7177ed42e4d9249

SHA1
8ba6e1af582771177a34b0dbe4f518f88eaff60f

SHA256
e7e5cd74b7237aacfbd8577324d8b3152e4c25741959d837acfdbf7f5d133147

SHA512
2033fa08b22fecdf84b55318b943029f8c64ac2af333260393bc2f764cf027511cdcc4dc81f2de45ddd6c64d77def34f68630d062f360b0703a00ab8271b33d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf84b5166d424129edaac00420d5c6ea

SHA1
c53719513df7735d67f96e635a868cd1ffe7d81d

SHA256
0e8da067a803bb48bc36e66752a84f4a8cb103ef769c717bde53f0f726614036

SHA512
efacfcc6d31d40209197f413f978310ac2824a958093c16b92b56c86cd0804f8ee7541953e3de08d4b6035c7ee8642ea5e3dba7b429f8ca7a2afe6cacd1a42d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b5c11e71a8ebb4f106386c5997a2221

SHA1
f366daded46514c883fad2aa48f616057dca85b1

SHA256
fd6cc210dc8c970a25abde2c90282555706ee7f8dc7caa778f6bd5773c643125

SHA512
07bcd03fc37c83f46d00d54b170c32daaac1dfe7fd14ed4b71dd983b5e51f60e59e93a92244a764dd4d1d70747d569d52a7bb9e0818b9cebdfda2567fe081639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
220aa74652f7fc5196c997768d4dcf62

SHA1
efa8ab7f3a15457c75b5c6ebdf9093db07a17237

SHA256
ff27ca9a02a6a7b59dd467457173003aad1dc055ddb4bacb5bcfceb228bf17f5

SHA512
340ea915664e656878a716b6866f8ae2a1748511e421710ec10eab3256016660db2ae01fea798980d0c6f3dc8faf699c0ed1ac221bccc224dbea8079a115c4c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
396fcd2afe3208ae899ed0665b9a82d1

SHA1
1395ac94bb3ab3c8d35f03bec36f2b096eb1e8ff

SHA256
b413e3fda7386150ec415dbe95e626c323d512f716afe542fd847549d7422680

SHA512
04742a0e423c3c462170bfc601f1ab52746f0966202de303b02cc04312d28928b9fc2262c80d300e9a126ef7a88298865c6cc3e80686e2b4240e9018d4b44863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b7d50c442414e5e03f6c0453e8a24b1

SHA1
b938df64b1512518613b706224dd76738136ad15

SHA256
ade25fa675732df17e1858e3e22e2a385a8f863dc4c96decc76be13087f2cc60

SHA512
9220e154d362698dbe100481ad66e4c2cc9dc995509f5da95fcf7fa4836b0e4512d2f871a3ef17b9a3269c56e7379170e8e0773c4df0bee35d240b219afc8dbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
636bc9fb259300bd16b3a506f39cec33

SHA1
771dcae367797c9eda497d197f0b62d1a979601b

SHA256
6c3d6af2f97df6c98cdedebf1d9dc630d4de5fade45c1a9bb9109c8a9c9a58a5

SHA512
deb163af668beed2118a30e42be1384a96a1fda8ab3d6c2e29b0cab8da82714285f1ff2abbb6acabb26fb926edb187ce69efab359e60dcbebf3509ec22a59fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e823882430adac7106c5de04be2003f9

SHA1
90740d8c80bc387408e123556f9f704753fd30a9

SHA256
3c3058c9327f345d89e0fdf6ed6f75a9302ea263efc5abecffe398f256537309

SHA512
b3ad5786307812aa57e3417ba5dafebdf611b6296208d5eea561eb7ce5c618a585dbe9d92c2fb6d79b8e7a388b5647a1a7fe501c8c368cdd2e0cc9f54506a356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a41871f37253891a5053397a1e96d89e

SHA1
5306b6680d33aa2641295c32d48917244fa27088

SHA256
829c8b639668b3c1d8b60dd4b9046a76d904db0be18f8faa806f05e30310b87d

SHA512
c05d23f3b74dead4b38ab69c67dc4583e12bde18d0034952dec7a98956801ba4fea13090f7b1735de64a5b50491fea03b5b068ee0678b55c392cc1fd123f2c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b29de9df412fb6d0ee6288b6f8be94ca

SHA1
ce12dc9942da69030e0fcb471d863084ba0d7940

SHA256
49fe1ba429c658b5679866417274f2e6806785a395a500b1e79c9c01678480ee

SHA512
e08ec5596f0cb55f3170c1c53a68da9c989c8f49f430a0a71a79e4b7eab974901df59e6c77f6319101f285bc52a793ddb96be1dd5519c7c76b845202d30edfe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98c508b5a2baff696321e59b96b3a547

SHA1
b4a90b7d89aa4c438f1e7ca50ff5b297483fe559

SHA256
1a6b4dc197571338eb24324de2bbebb56736c9cad52102f14f719ff65616b1b3

SHA512
c95eeb444cd2f047eccac0ca2600ef5dced1fc558c2a232db89720f9805ad658317af4025c91946c86406bdd68f042ecc47ea5b4322da6471e87d14e25058859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0106abd69f56af07973d269656614a01

SHA1
408b8d95910d47ca740e4d765243e8491ef11f66

SHA256
65aac8103a9808cacccca8bff0f6844976051f5bf937a3f475a9c9cf8ea71def

SHA512
2ecdd1b54624ec17304f780e9660cff61a0014b557cbe6150eebb93db2b0c864c4e0d361f4fa22027396b00b07afe2ccca71526ed388dd88c1e38bf658525290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd29128a8b0542e74274d33d71d2c3e5

SHA1
7c12ef45f524a1173a2ce8abc57d572ce0d343b8

SHA256
3e6f7b2115bc81bc46178b9566cde92c249384828c1e6eaaee36763a984e3d9a

SHA512
b5e9dee0ba532c3328a75da263974ea6ec6f4f37bf2e5eaf8ee9cbdf5fffa84d8527591b62e8adf578fe0a0432b46925de61cf573a146f04a8681442ac29727c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b525e13ee7a6aef4c593e199adf253ce

SHA1
b043b0c3bfd7613990eea93ac52e5da22011f07a

SHA256
44e95cd8303d08548918da92519c382df12293fd8c01de273086e2139300ddce

SHA512
8f7393441e571488a5333395cde121e23f06cd1175dd585840b8d46bc33d716451829ca62c94807503b9bf4ea0687c1c1050942b1efabfcc4a88c3993eae01e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5f88a77359b742a75fa6248c593bdf6

SHA1
47c24c29900875be7fb4228351fca81b17f0a3b4

SHA256
52910fc4af96064c64f2409ca5188bf80e53ee4993695a22a4ad1ab3a6ba421e

SHA512
62c55a054e3599053240bf386f546274b9f6261eb9cb65aaaa4c50d3ead943b326239c79a661f371e26577be327ec635ed6342a7b2e1fd7f684ac3a3eee9272f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4962.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A44.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit