77ccd4df3c82d802c887435cdba43ecfc8fb51f7f763d0b86062af7027f72a10

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63fec4e14f0961f6222301aadc6e8edf_JaffaCakes118.html
Size

23KB
MD5

63fec4e14f0961f6222301aadc6e8edf
SHA1

cc43c21379a2cfd76dae135d7ac270ef04f18b33
SHA256

77ccd4df3c82d802c887435cdba43ecfc8fb51f7f763d0b86062af7027f72a10
SHA512

35b68e435909f5c1455988869aec16669319fc8a1cf70d64c828d9893b63a7536e3327c0df51152d8ef8fdf96f813eb6e88a9e8cc4484a43aecc505114957d7d
SSDEEP

192:uwD8b5nCGnQjxn5Q/1nQiegNnOnQOkEntjnnQTbnJnQzGLnLnQtuqMBAqnYnQ7tv:XQ/qGDqM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a2bc769dabda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422471410"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005182e31f7a707d6e67ec7c9b3dc44b2837fb085d196c218746847c80c4513869000000000e80000000020000200000001b983e5ae55308d13952bd45a9e8ee0fbc7c237740949bf368277aa25d7fb31c90000000bca0399dc7b8d46d436bde729cb7227888496f82f2bf976394b805a711a8ea27fc652f4c48d19f3d38375cc3164a0c319e23a279f1cca84e96bd45d8d0267769e45804623a73ccb49559f9bec9ea8f6e91a3ba3cc6b3d569bd7d7e4365b559a0bde5eb00bcd7e6340df08ea6baf6fc8931aa6bf69b892789425211c45a1acf655d5f9cb99ea84662014f136baf2a38b440000000ede6c0e402d4e9db9156b3cb6b859b8f25b38adc665178be4f5db5f3da4eef55dbfe1cb8c361bff13b0ff14c955a02d722dc8e6a9562985290eea6b369844615	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004bc71a70ee17667d3d29a2cf8903497becbbd5f7ee70b4861651e58dd55e1a78000000000e8000000002000020000000715d0357ac71cd28eea00543c9ab37bd2522a047dd0723d971a067b18b275cc7200000008b368b3e8da3a52f211d7785c4dad38e74a45405ff3271e381d5a6bc594bd32040000000b6364396ab9504a82e7a5c4d7850115b7f30bcce095b3620be7cf0fb3d75c3f062d926554b79cd7ea6361e5078308597d9b63ff36847752b3857f38d9e9d8c3a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2094A31-1790-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3012 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3012 iexplore.exe
3012 iexplore.exe
2984 IEXPLORE.EXE
2984 IEXPLORE.EXE
2984 IEXPLORE.EXE
2984 IEXPLORE.EXE

pid	process
3012	iexplore.exe

pid	process
3012	iexplore.exe
3012	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3012 wrote to memory of 2984	3012	iexplore.exe	IEXPLORE.EXE
PID 3012 wrote to memory of 2984	3012	iexplore.exe	IEXPLORE.EXE
PID 3012 wrote to memory of 2984	3012	iexplore.exe	IEXPLORE.EXE
PID 3012 wrote to memory of 2984	3012	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63fec4e14f0961f6222301aadc6e8edf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af2892d36430dec1141d2a5524060969

SHA1
a45d9c3fa64cc25703fabd465b5fbb30cdfd2818

SHA256
a64db391c962f9e91739ae73fad662319421505f405d65e5bab30251c46af499

SHA512
8bc331b4fc889efd3af4b0fe8bd4b5fc01d4361bd8d0e0a1704842ce73457a856d11d6bc629d8ec76144d0f522cbebe09315c03990099cfc95c669c5d17112ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77eba1e387a064c99f225bc7878cf395

SHA1
8a88ee1d1794add620e5df88fe0ecdc1883c6259

SHA256
2061b8ee3fca468bc4d0479c6b8a0acedc431b5a6f4d1ed43dc11bc67b939a99

SHA512
f22dbf1b7f20dea8cc4443e6de581734326bc7ab9a371a012fafbb635e48ede224f5e1231271dc67bc27dfc3af89188880982d79b70adaabd1d11da66318c0d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92ae6f51d01a82a1a5907db00bf76ab2

SHA1
148e037f94b8d44bc662ecf286fd4118262b910d

SHA256
8bea5a4a753d86c9ea776f0aa1481663b793f1be6f2c27bcfb19ed80346c0a95

SHA512
1e9a4a727a96ede16e620b0a2986b510fd0fab78fb32c6ddc6fc5b32344275d84d2cb92c65eaa54b1db7eb3e2147c35308dee7ceeac187bf3bcc63bfe83e9d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abab65391f5352af7c98afa7ae18a798

SHA1
0d94b2261e0dc47dd52abc6b877dc0e299f97230

SHA256
9ff0eb79bd99ea13abaf7a377751bb516c07fe4262d646c377e68da6da20cb68

SHA512
67c8e5530b5da422f91b745b2e09aa51f9451983d87542c473d903bf5f1e6ce2230bdc8a8577570904850a881d1876df50ece944b93d569dd8f6035473b89fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5fc6fedbffc8ea2d09d90fa6f735a95

SHA1
d99fd0703c696601b592ee4b928b81d2d41c0b05

SHA256
31c509e31060607ef26345a1d2ad5c1164de6bd0124275c3d3cc56a30c547a2a

SHA512
b4e96c91291f3f8ba89095f676ce91e24cf2a898fded20ea59f298e395640784bec1533ec66fdffcc803f456c87cba547b1bb99d71cd349e9c8a1296b16a30f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b19cd43facc0ccd77245339cfae10f3

SHA1
fb2a775e2148c64c2c3ee960909edddd7ecea9d0

SHA256
ba4277321675b2d0071a1be8c6cf99b1e70b70d89ca9c4796871a4e6c83b8979

SHA512
e54862c41d78d4ed12675b51df3bace2dc081fd50da18b97ee1b5b00c44d4fd4ad96ffd9b9188de252d994783b26f43d75b62a7d0b5c9ec710279d603201c065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a7292d75e55e5c50ea408af03ba0ef9

SHA1
fe2c47967ac9670ed865e9169360f9149b96c9d7

SHA256
5d8f8ae50ee423e112c9a776b49638adb71290465199179930c2d02915de36ba

SHA512
6896a36cae51c0a1e9349ec09ba17a0e0edcd59c36f7c6bdcca9702650e063ec25bf9a7b52d0cd771b552b676a65e60200cdaca4c03de41fa592fcf7eaa81878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9be4caa077957276e511b5a51094a13f

SHA1
12b68899335fc6fcb70bec797e4184c37eaedc68

SHA256
6764412f6dcbd9c7949b9667d83176c41f4eaaf2b7982f1c40dff0e9fb2f7640

SHA512
ec0523cd1e2541011a5c5fe03e50c49344405b845b47e7a1ecec20a290e7fd91b2a8d545d8a827bd34efe66cd71f68a4b490d6c3ff9a4b11d0976362d13fda46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23a1cdcf5cc39ca2b93325833013fdcc

SHA1
0f083446e01219c19a0d6cb0acbaee9d7b3c6b8f

SHA256
a4471820a37253c9d060d8b6eb4cf9e38c722d395ea9e37e67d1c94f8a43c935

SHA512
a2f3a9664a8b31a39b201f96160a7f609a665ef4d0d0159d329078bb0a49ddb26e33be2b9960524521e1fcdc27fd8626d4f422b844d4faadc875591724ffcd41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e26d0df71cdd7c29425330d87dc84f8

SHA1
d94106223046e906a3a5d7a95847a0ed26c7359c

SHA256
e1b43f8544032fbf1cdffb5fd5a81119a54872adc5a096c9278393ecf73d4fbd

SHA512
5d4f90c6080b0b83cecd82d289add31ee7d7ffc629de3690d0d1de59c2b0b94becde50b2c367faf5b87c7e0349f6675aeed70f4eecf50048fd8c322e6212c2d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2f37ed8d9f20590a75a02c6f1cb47aa

SHA1
404daf62c6e76fe21c8ceacacf53a9cd9446d32c

SHA256
a40b643913a16a0ace654b5234d2d73b406f2761f0ffd3f6b2ee6c1193e13dc6

SHA512
ff4922324add64cd8e1ddf77eb2e474f4d1354e0ff4c0d49a1dcc08b9fdc4a689766251474258ab0bdda9b0259d4d9975398c07f1b7f0625c56ab66b9cd7d73f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2ADA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B5A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit