f292a18a70332c2416fbcdb5a95c0ed699bdca0da7c6cbd7d78012c3e41d814a

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63e46a42b2afaa6e328aa3caabeb18fc_JaffaCakes118.html
Size

460KB
MD5

63e46a42b2afaa6e328aa3caabeb18fc
SHA1

21022f5f3ed5db733664fe9f26308e5cc0203bdc
SHA256

f292a18a70332c2416fbcdb5a95c0ed699bdca0da7c6cbd7d78012c3e41d814a
SHA512

19420a26d75b1e9062d4ba923fae2f3ac0cafef4d619e16096dbef0a0956ed84fe499a8956a21d89d5c693ca330a407b2252d3ba04c5dc5d304186dac2bcd9a5
SSDEEP

6144:SYsMYod+X3oI+YMQMQGsMYod+X3oI+YLsMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3q5d+X3p5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002a71a2dba8f8b0bdd7eb9ff558efac9c73049f1f7cac55d2e7f8e6e17c9d4463000000000e8000000002000020000000d8cf4232fcf32c3b07573a256e5f46ad2634b56c9d5629e385aa181ba6f1bc9a20000000fef9ac1ddd90fad080bdb52ee26c79a1f660936b1a097832e7321ba1c843465340000000055d6cef15e92aac6ea09c1715edabc226694adb9a2a1f39670236bf9248fc58e3124612e10dc86b8ff90dfd2e06e3609dc81f4e75bd92d2aad202205b599822	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4024279598abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC927AC1-178B-11EF-B904-5A22F41CCA2C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000001860f193574b3a65eca437b9bfdfcd286ffa8480d008751a7f77c6b9fb09cb91000000000e8000000002000020000000e279da1cc8c4f5baf7406337b5eda6200ff7ff6a9a0a208d1a721796f6c2c57590000000c5d8455dca4794b53eb5a492db49fd3d569d3a9a7b3e3ecc31e3ca91fee8ff99f726ea9dcef7d6627a589698c11001616d0fdf057a00e1b9f414adddfbae0c02d81de5b62958af2c5daeb5c523cb8f9c2992af0928fcfeda7af300084aa6f238019b4f53ea17a74a4bd34a7b8df967e6517e7714bf31b9f2086f7dd2d6a17afc86ca7fe55ab8f231387acb2a76c9860140000000f33070efa61fcd93283e864a5600a00dddb0d50909a9ca454490c6b755a78ec7875564ad3c9d2d1e3231412de72fcd9ad27e746a7793167dc4e930c06d9ba2ce	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422469310"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1312 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1312 iexplore.exe
1312 iexplore.exe
2724 IEXPLORE.EXE
2724 IEXPLORE.EXE
2724 IEXPLORE.EXE
2724 IEXPLORE.EXE

pid	process
1312	iexplore.exe

pid	process
1312	iexplore.exe
1312	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1312 wrote to memory of 2724	1312	iexplore.exe	IEXPLORE.EXE
PID 1312 wrote to memory of 2724	1312	iexplore.exe	IEXPLORE.EXE
PID 1312 wrote to memory of 2724	1312	iexplore.exe	IEXPLORE.EXE
PID 1312 wrote to memory of 2724	1312	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63e46a42b2afaa6e328aa3caabeb18fc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84a76521f32c4a9f0f4f0fb0fe16e3e0

SHA1
973c499a211eb5609224e738622a60ea40da95de

SHA256
1a7bbc584464b8f2dbaa0dd809c2393762d58598b5e6a9d72ac57ba4d0e4a023

SHA512
0227f4373c69f10b82c39c0c365e7ba971795d8415d052ab60a98716b0e9c676a4381c66ce53b2a561695f4630166d61576588e10134edd8a9f479fcbae57bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65f7667196b79fe3f717c91250b094d0

SHA1
063d62d3b0a5d63fb5ceb393ed0d601581154da3

SHA256
94cdfe8b9d3e5e663a92429281a628b5345b2135a3af3806c584ea35f2749226

SHA512
13ede64bdd22b1f142d1eeaafe34b9387167935bf552f07ccbaf84ff0b47e12dbae8495883b6a58168673b6cd3aac7d9fb3623df5d5b378cba305041f6ff8e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de0829e454910004bce67daa401ad101

SHA1
f97b0fe4f1264932033025e2eabcfeb9067768ef

SHA256
012ee77526f927732f5e122bca5850d768c21dc03cae04782bf0c7a2290eae2b

SHA512
21ff80df97939c2dc61d2536fb246225461d66f44486695f08e101e453e25ef028e5e0ebd59e2c0e70aeece9a6c3db057f533a0b5323c30eadbb7c95f697b7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
977c2825595978c366f544f31fb152ce

SHA1
a862d9e603f73d3ae5002129b729ad9555fc6014

SHA256
92a099df10525664720ea7b1962ae59072dc6f0fa27fc5e007ad27115b596d0c

SHA512
7386ba5253bd315471834cdbaa6eeb6f50fe1e4b2f4c2e8bcec42165047cfc8e313527cd99bb1175bd7efbeefd8a39eb6dca403ac8c06b2ccec00dc827e55f30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18a40929d61488d1bc6ea478b033fcec

SHA1
f3cc319b2d6ae2957f6b48f6042774f5a0511788

SHA256
41cfeecddbf2c4736cc03c1d392674af5713afe61f966ab2a114135bebaf6e88

SHA512
29b05c0049fb95356f4512b2435f7305119d4d0baa4d7c88eb0072daffe386275fd3bfd502b0e43aedb7caaf44d7f9b7a751cb007417f41432f58dcbdf8ded22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd1b3d9b143c519c5b27eadd1b13ce7

SHA1
70ca08403a5c8ecda3a0f81cc731a94b50ccd091

SHA256
e2103c230944845891c948d87dade1be2640a8f3fedc46f2c4068c054cc14cc3

SHA512
a98f9fadd9b28243114dc999563c06d2a33f7dff24f2dbb08c4d23cc7047687e0615626cdbe14fb2ba78844f56979f74003e41c0813eb2c350707f9bc5ccde53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ac3c7d4265838967605e2e3f4c02554

SHA1
c6bcea9858bb3a6346a43fbaa20cbd1c711466e2

SHA256
ede2171dd3781c2d5ec3864ed1c26763463ae9e1033394ccf092d70ba9c5e3e6

SHA512
6b5768b58904c3c6c85b1cde871b29d8412803c0d4d7ed3cf0174c8f7fa1cb80e8d3d8f5334595f4ba4b12c0d7bdaa7062f2b1c0bf7f129d5132166103905fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40cb765040902fef64424d61bc556d75

SHA1
981ddd2c3a6d89279c396371f94f2424f5d470c9

SHA256
13b3b0b2f7521ca539e87fa0beb47020803d2d40e570162fab9e0df5656c2f76

SHA512
d9aec4df6f58e9974d954980988aefc27c73723491647e176beb1fa5cbc352b0811ae12b9e4b8e1816fc67577874608851f09cb1f8e50f8a750491995c0d6c62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5ade942f104e20e70aecec939b4f583

SHA1
ce8190781126840550df44b34ea571b7cebbb75a

SHA256
ad98af83c8ca644811cae47b920a8925f5b44cff61e2fde6d1db11ff4ee2a2d5

SHA512
10f855d675b3cb86d79a4ef7c7eb2c38fdddeefb5f2c298949a096c7d9931e89b4de6baa73bb0226ee01da7bdcef0dbdddc35fe41f6e678666e6585645de5760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c3165a45ccdb08acb22764df7e8d6cf

SHA1
c7baab7f990e84ed137c4e33a3b4603021468254

SHA256
83abaa1d642a4787abd0889fca14aab434f20f9794e1c2442064f452e77e3b45

SHA512
9a9e518562339cf7d6a778270a7356416bd10633729d56dedab7e608027903e2bd1dc771c055e3daa3c2b9d835007b04d77729d315ded9d01a5510fc18c4c523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0270fa7e6268a66c6b876bd54540a983

SHA1
b7c79fb1184cec0c2c3fae4499233634c9f42474

SHA256
1cd8b291cb21c99807ca83f51e0236a25b642d5531ad16a2a107fcdb1824e7b1

SHA512
608a34deb0a661dda55504dcd5d28945712bb0d84b8780713369564d4c3755b8573d80e8ff41f7dffd24db4a5678ca510e460d9be9a1cab24789b376f635ae76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a17da6fc8b1314b11526d1b753078b43

SHA1
26f056de0c75ec522bb0d46cdaa6af3d548bffd0

SHA256
5ee574a28ae3a3f3f7e43b73996ebcd0eac96cf4e4fc15016a7f319d0b82d1f8

SHA512
39f95f70244f0b4598eca38898de0bdd92308f8fdc6e5cffe272c00211d6d552ab634e0487375285567bf8b72166e53322d9ecc57f5f405ae50f136e52dad66a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5db1f8d6f440cf1fc947b0f1caa608ea

SHA1
8a8e03ae18c0351439ef6506a4e297948fafbc8c

SHA256
aa0f7d824d913100c9c334d220e06b621b71d867a1206b1fb32231fbc441fe1f

SHA512
c66fa15dd5dc0f6ef3c21d528d5edb67268f298942aac163d59d4f2e20fdec6b857044eb6c5d0d93833885b92a2b44b474271fdeb83a89a6d3582c7c8575621b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58dd142d0b92942c0e13f59fae8c2130

SHA1
93d0a7ed39ad6da06ffca23fde353fdeb0aea8fd

SHA256
f4a9614253cd7230b0c9af9795b90432f87ce77668d0ed38c91bd211e9a8cac1

SHA512
1b98a80c86c7696d3aa2133ac46f914cebd12a4fdcd6ae566bd8ed4d67d489b50d4b12021334f74281fcebc94fbefa9b6f840046baadfb913c98d4041d239312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ab910caa31e423be36c58735ccc06d4

SHA1
f4a431cc6fde9fe439409c8af7016b2190a7c3eb

SHA256
6032029af079efbeedbdd0ad7a41da1f7652b5c20f5aef4b65242c80b4106b06

SHA512
07addbdd7c258fa47d258fafc8a79d17170d790217acafe0983ccc45de76f1ef635134fafc4309ce81adf7120a9a98a60831f3a3d05b87ffca4e4fd2f4ed5060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
921a137279c1a6d3b2ed29396a8ab580

SHA1
df31a24ee2a3e614f0a8297f6d184ad740f15a8b

SHA256
f244b87c4850d48b5e1e62ba4134f54f28d2b6fe60c31d7c3cd9f9c098ab3c28

SHA512
bbb0cf209d62e0fd29705d29ea0d92b92fa8e70c1e63f7d159ccd996822c64dc868784e4e4afdb2fa3968c31b65fce09e1e9d2500db8bb5e47fe5e3b86ddea64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3EC6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F28.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit