d363f3610d84dfe45a4a5300d1ef65eee9d9a5693d1d62b5d29c3ba0b44fa7a3

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6400ebdd6dc435ac162053d16cc91941_JaffaCakes118.html
Size

60KB
MD5

6400ebdd6dc435ac162053d16cc91941
SHA1

3737e5cb12af777d86bb7982fb9f7bfe015c265e
SHA256

d363f3610d84dfe45a4a5300d1ef65eee9d9a5693d1d62b5d29c3ba0b44fa7a3
SHA512

28506d09eeac5bf39b03eb1ca8cc7fe83db1f1847510d948c36213e1ecba8d960a5760c434d26e2dda6a2d685c036e99136729ab5b662f998714150ea885d69e
SSDEEP

768:JivgcMwUc9GeCSXuhvqP7NuIoTyWhCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/IjkE:JniRJjAFTRgec0tbrgamchNnWC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ed997f4c150c1a1e33b4748468c87247dff33893981e2eb7015c1ec87ed35b82000000000e800000000200002000000090fbc0f61e47621bfa9be38e87c1b867dae56160af0846f02c9572cf00ef455e20000000a148fee1aa78ed6ceed3c495fa33a90cfed767f58cc113d982c3be709f0b575e400000002c719268b35035c8ab4504638ae8e71afe04089ca328060ad9d15f10eea90a106053ad2b170d3d6f4f6d2599ada9cbde03eb281473c2b2ef71a0e17c6c8d8363	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422471588"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C23B451-1791-11EF-9F9F-D600F8F2BB08} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f18e914a963261d6505137388a4474e98bb6f0be161baffdc7d1f95cfa183b54000000000e8000000002000020000000558cda1c519c6fd608ad00c75984d1cfdb4a758dcb54ad9a1a2e4bfc8b172310900000001d220b9ef01c12d4d7a245f17c5834caf3bc81a7f4b4bf70f4bfc6cd544a10fb72381ec9f15179de9c28c063d506d81e71647d12751fc6edc79a7e5c566c27b609b5eef9785d48714032d1dce1f271b5d80973e7c4a5580cf9cd2ca5320d1a6d32eb357ded221bb071db42e55a8dbfa5af5b63cda6d5563976ed05fde91608760b999644defb7671cdbf22179a341dca400000001ac358554ff994a8bb110c77074384bef5fdc4ea624f4844509fa9e5ec9409b98aba31f8b1e7d5b3ad27fbf55cdac87c1241a2796a3ff70235947fbfa724e495	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03dc7e09dabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2148 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2148 iexplore.exe
2148 iexplore.exe
2632 IEXPLORE.EXE
2632 IEXPLORE.EXE
2632 IEXPLORE.EXE
2632 IEXPLORE.EXE

pid	process
2148	iexplore.exe

pid	process
2148	iexplore.exe
2148	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2148 wrote to memory of 2632	2148	iexplore.exe	IEXPLORE.EXE
PID 2148 wrote to memory of 2632	2148	iexplore.exe	IEXPLORE.EXE
PID 2148 wrote to memory of 2632	2148	iexplore.exe	IEXPLORE.EXE
PID 2148 wrote to memory of 2632	2148	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6400ebdd6dc435ac162053d16cc91941_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8164811d0ac2874658f03740cec61b4b

SHA1
209107ece94191793214abffd54932df6d10bd41

SHA256
ccac02d03327b2526af141ec1d1721e39e9ad6864d5400c1d7a9efb4727b7352

SHA512
cd84d08089a46096947e3d81c52129e9bb380bcc76570533469092305dcf8d84ab5ef50f11ec2e28d73c7c9010615689061290c83a1f50e1e1e326c16142d10b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c58ea072c121737a3fe08d7a36a69bad

SHA1
85b896ead1a96075c8e4b73b9c5bf8d4374c8187

SHA256
254389f9a839efc03e9550c338f310f73aae44a22ad8cff21598caac992a2217

SHA512
ea02f3c53cae9d8ae38f977857bbedec810cf6703e348b82c9eaa48d5156a18a40b8785ff9998ebb164b350ac623035aafb4def7c58f114de0f78d7583e4922e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72d773b4b2825c8390735e14a467b536

SHA1
65e4ff5b2bb7d3e3617d121fe11e97adc4d73dcb

SHA256
2f60592afe11cc5fd9e36e632404f77ef06081309eb075851a94148266e6c83b

SHA512
448225d48fe3faee58b0355d998ffedc52e516ee56d45ff4a95178fb8e6df84d6c649df59e497fea25c56998dafe0e764d8322f5cb4e325228f53743597daff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62ebb35d6642dbbe8b970348612c6faa

SHA1
31209e113f5d72c87cf739608655e1e289318710

SHA256
a6d7fff2e9c422d68bb5ea8eed3f44e35bc308f6a52858a4107fb1461053d13f

SHA512
8247ce3858d6c1b5e2b98b23dc4f52c6fa57b6c79b555f78ddb82f9321cbbe2d6a45524a5f59c8e089a42c14039b838b089c4e62a6e2fe14c64ac98152c933cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a7f4aaa63bec6d51064723d2f2f92d1

SHA1
6f974ca7dac03380693c9b7b57a88bea32b17050

SHA256
0338436eb4ee7955917d0cbff07949d255951d7716083b3ab19f3e5f62971df1

SHA512
384622b26e8f44319f749f503e33cc96094caea31e7d6d4c796aea7f86b0f6c85a426c612eeae167855adb51d9e5a9872613215a27993d87d24e94539a2c1872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd7fb7b762a1c47e7e2897d9c5379beb

SHA1
0cc85d232d02571befa3d4a725363f545da8fe65

SHA256
4e4affa96343cb12bcec36f2425b9efee5d7ed21aad06353764d974724f853f5

SHA512
dc2f5a39752ceeda1bf5da8b6c1e8bb92a5449f78af8e4b5f82b3877e82972e7541ee54570a01d05e2cdf24bc0e6914c7862e8108525c35ef50c17491605cfaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70cbd476b1b47ea3371e78cf5a5079df

SHA1
fad2eca10531d288f4cee76b2f55ceb7f68f7c0b

SHA256
6d67ad346adf7a2000579e072236d1e337be8c08dce6398af430ca28bcb77862

SHA512
ce921efc7539001e2ea75e1632710d74e4306ebd2262dd8ad60e21db16ee2f56cea85e0ea66fc76f71590dafbf34e4df118ca50acf7c494592c034e21080a869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e942c7bc6395bc85b33993ed6f42c60

SHA1
2d0b98ef0ce80d97c3fd8b3942d377490d0e4ea4

SHA256
6d9c76835d16c81084c01e1e666e5d8ce47736b05d8ed92ce22f65380b7ac228

SHA512
1a0e11017580626dbc71a836dc4cf168cf2c4b12cdd16295b54f5c36afb7a855e24df68b69ec862eee9a4b2c528f60005e512eea2a944cf65493bf8bff544d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
575602abd3b520dc2dcc3d96a0bf7ce6

SHA1
b8d5d160b735daca2e958d860dc5c4ad3427022e

SHA256
370d8460cbe766a778aea78e32133a23be934808ad37f8726e0e2e96831da8b8

SHA512
a7a89980d10419d4328ecf5d910fbdcc82cf7d458da08ba7e139854ec50fd0d79f50fb94dbb620dbcf8848c2cf095a2271d3f404856ae2456404beed2da36451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce1da97bad9805ad7fd056d48ca39c25

SHA1
2563e15f2293da551b154b3999810667fe6cf8ce

SHA256
602b4967979b235874f2f83eaaa3ef725960f85731a531161ccae21ca4f4abf5

SHA512
ed1e485a853818d5ae0c003c5605bc76fb32e05826c8a3084d13e6162e68d2f1e306b3c6f16dda38ace4ee48a528b47bd5b7566f5d8c818173ca804ae5694492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be6871455b9cccf637a397e1d773a082

SHA1
e15539f35fd61876aa35d08fabd6335b2ea40690

SHA256
4858a6b175274572fb8ebea70a315a42d50e046a37bc32235a701ccc8a66cb16

SHA512
a2c4e27276cd829d3c71712d9233ec483402cc3f8acf2635fa2069697aa0ce52761bbb5067d535e866d95c90a0706a85d8fca18b1c523b97e2e5b619936a4d40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd4971d13d0f5926ceaf121e7e706b2d

SHA1
660a22a031af75bd111e2a928c16a818f5f35710

SHA256
184208dd8169761ee5f0ef69c9025b13c29af3abc54d01740e572db1036c63e3

SHA512
b51629e8a792219ecf28fe58c51418dc642aafbd585858a4569b0a1d3ff8604742ca33878b4a7af90a1127e3ba40293328d27372f5686348522036a7200f7fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
360ec04531b9d3820399b53bfbdc380d

SHA1
b17ac10ecd527a5e1fc369a0961ba560564aa6dc

SHA256
7b658f9a0aef04991347cb8abd1829f42892d6f0b32188bf819bc92d0b492025

SHA512
4e7998feb6b609120a5d1abb8c78a3cf78a4e33e457830ecfedf4bb185f2a7d0e206b9286a6e54d0380e92019f168d00d6c0f290bdcddf4808657d570d2c501b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26E5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2774.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit