026fbff148f5d6ac8bc0c5ed00b53eed87436860ea80c57e482d7233a7741f0f

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ed3c017c72ac0ead2cfa61eb206aa2_JaffaCakes118.html
Size

4KB
MD5

63ed3c017c72ac0ead2cfa61eb206aa2
SHA1

ab5e707605cc6220e883431525f3748ff3ca1113
SHA256

026fbff148f5d6ac8bc0c5ed00b53eed87436860ea80c57e482d7233a7741f0f
SHA512

a7ac90c12df2497bdea7ebe271d088d18a186623414edbed39a8cabc2f71d5fa648aa48a0593e1cf6346d225e11dc10f15ba37524a4ac47d2e9555cca44beabb
SSDEEP

48:s5Z7WNr4TkeqqtG32Aa83A09LyHkkZU9NzyQ4Zm3YB:0KqqqtGjX5yEl2Zm3YB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78055651-178D-11EF-BD9C-4E559C6B32B6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422470051"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000557068bdd3e334cf94cdb084ab5563a8f9e17112a3862e95779b2a8688874a00000000000e80000000020000200000002c2c81f97469825b25b5a74adf1cfc78608762687b28f72dc444f26d1081cc4590000000cff6c180a9efba92f470ca9707af774b932d48cc9cd8a545274a140f48d6e87e1058d82bf0a21a47b2d6b7a648a9d2cc097229561bc68960e6e67264112afdd0abc010bbdbcb8e78ba73919bf297a3bd03b016e2d641e2753ea655af0a06de35fc5baf3e54836a26319c8b4776f56f4dffe879b1af61af843f89ae03baa7ba08e45e22a247bff283fdfc6d1c22b0e90640000000f5eb47df50adb1c75d36ef513038b02be36456035455789d062dc04307aa0043538e081f8f16ea443bff601f85cb7e81cd8d7471d3a45656b05f6726f053825f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000abf766b537df63ac38bcf1d50659c74018ac963c2ab8fc80de3694a07b06d5a4000000000e8000000002000020000000af478d26916ebd0329c1391fb03d2643a3380fd63702aaa3d300f0257a06e69b20000000d4f349692cde4ea9786bb55b1b11e6ef4b71ceebc9a08122e17d8c147c069004400000006501ab9592fdc346b5853f5eea3eff69cc1789eb9c4685f35a860fa60607416f6d4b41afc1702de3bedda04ea437bcef54b9d45d63ce51310001767346d4162a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07b514d9aabda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2900 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2900 iexplore.exe
2900 iexplore.exe
2072 IEXPLORE.EXE
2072 IEXPLORE.EXE
2072 IEXPLORE.EXE
2072 IEXPLORE.EXE

pid	process
2900	iexplore.exe

pid	process
2900	iexplore.exe
2900	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2900 wrote to memory of 2072	2900	iexplore.exe	IEXPLORE.EXE
PID 2900 wrote to memory of 2072	2900	iexplore.exe	IEXPLORE.EXE
PID 2900 wrote to memory of 2072	2900	iexplore.exe	IEXPLORE.EXE
PID 2900 wrote to memory of 2072	2900	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63ed3c017c72ac0ead2cfa61eb206aa2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78be84f9f41cd9cb71fcd00da05f2573

SHA1
8c505d6bd9ddcf42b63bbcd3d366ccbac14f588f

SHA256
65a6e44f5d3cd30015b79fa96b0c435b088066404729076b6d85a2e91c76296b

SHA512
50d84e36703927aeb86f8e00af4f862a715114322158430451fac7a8bc96622286149224efcbbafd6df9aa6c47e0e48af3bde0ed07c4170cf38b4c31880cad7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
228af854909ef180513f0cdcbc4466af

SHA1
62e3a7d868de0ad1da562953c88da1fd33b6dc30

SHA256
3277fa48dff463bbf017ecdc9cc94a08b63f12484574ff6f45eba0a1ed19cee6

SHA512
d7adc794cdea3ec13ee8b312934006c5e72f263d685e0e925e58318c1a312658612296b5e866e9440b24690b198aedc30eb1f1b191d4cd81226dcfab25aeb663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3c15dcebb5e67aeb6c8c244a3810897

SHA1
343425d0fa346d2ab12c44281e9fe9560a8a9bd3

SHA256
edf649a13eed9a7eee12c14f366f93d3f92bf625f1dba08614a95b520ee62a39

SHA512
b458c9e19e747901ad152fc6317acce84c8eb49a6589ba230753badf57a3a1b811ac4b79ecfe27619d69542e9ed42ebeb1011d29b0d705629781981b936fca7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f829d23f6e06191721c96196df863e4e

SHA1
8513a804c7925e53e316d8cc2f2cdca6521173d4

SHA256
ffc55c116107d770933a5c413866b0d4dde4f9ebc67fcefc4af72d06c9c3ea63

SHA512
8351bb5f3647a19307a96f0683b0055e2a63e17590098e4ef3a0138693279c61f7fbaeee8bb691fb9eacd49e67dcd3fcd867910d08eb85f61cc91fcddf22f302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f62872572c3e24bd72bc6e8674d2301

SHA1
d6b81c57c99446ec5ae6aa11a21e5ece280caf8a

SHA256
bbf7cfb6306fe58d6fb884ceef8157508e0396ac56a08be55ab0c66dd13f6316

SHA512
2e7adfe2f997856ecd87b86fc57500f5d5f560940e05ca8274b6cbd042be645dd8e986cb1a86246044ca31d03d40221c60f17c9aa674de1a9cb5c3e565ee40ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5ff580e6b324b16347430e9739baae5

SHA1
727a558ae660cfbf430d86ca2670edf073393d01

SHA256
1f004fe17a9be1d4cb65e369e8e2a911470fe33510f673c6e9504367a522861d

SHA512
804dcef554748a8803ca3ba58014f5b868aaa3c195e95f9e274a71cabfafc82d94462980094f30ed8bb91cb78708db6e01c531f649c3794b98ae6b24870c0ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c9b204d6a18f3a0c96db1850bcb63b

SHA1
aaaadc1b7ade22005bce8bc9493ad97e4982ce4b

SHA256
8b3965b8a59757a4adbc0070361651ada32a775a1840959e45dd85473cbd5067

SHA512
f064b62bff5d55961ce51b99c64ad124e742177094208cdb74d89e83276f6126d9f4049c799ae7301328ff73093934554c5f275d299fe9c0d3cd838891bf3180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6fac9971c4d3aba8d490f93a50fa8b8

SHA1
7a5552df391bcadcfdf5f77451a2e793b7239568

SHA256
4f21a72ed0a8a1c115de54a85cdfc29ed1511d0b5aadc3cbe42807e7d5d7a5f4

SHA512
1838b983d372a52b19dc1e5b6f0c5c780ddcc2c1090295aaed3c52385e35d0a46f698f3c0f143208cb3fafe5104d20d5bb283b961359a9294b369a8a013a6bc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eae2e91a9e532a0e869a8521dbc6821

SHA1
719f4c6b37daa5121eb5577f643af58b71a42ca9

SHA256
acdb18321e942b49ae250a93e4c82b8b4fd2b7ba5c6ef41cba21938651ea6c0b

SHA512
4001ca97cc2128dbbbe054a1a91ef05618b05499fbcc1f0762cce9cd579f36a0f40058ddb20b6788cc8b57ed1d264f2cbbf184b0f7bd26284fa2720461b47057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
422768f7aa4785886749ce41285fcc5c

SHA1
22aa3f4d6136d043dbee368ce35b67e47ee93689

SHA256
bb16f357e2a359241c1ff07f3c9369a8e67804df82691b32094bb5b36cbcbaae

SHA512
69d4a15d1bde82f317f5c1d04dab698bd4dd51402fc046c648d1677ef4bcc4955a5f26e91fb27645d130c7bfc657ab66616863afd7415d693ad1f541ff1ebbc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f65160cd06da758099c8228b1622d9fd

SHA1
9009e3e67d9b153b2bbdfc416bf33eb898ed182b

SHA256
034fbb168eb1e264546d8de253c6ec40608e3b80d09998aac04612594b0f6fae

SHA512
fbd132eaaf55fb49c6914db8c7b17f90b25785d1c0cb2864a5c696a3f2f8398ca69babd6b2f77fe978dd0e5cd36dc3d05b86ef0c4d887c49296a6eb7c11d453a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84620e0ed08f5231943cf1a39297811c

SHA1
c9c673dcd8c72b0622b70b78fe325dd53964414e

SHA256
13b7d27aed14d2e786254e7f1adcc89b8818d40751a217e3d21f3b2fe493dd72

SHA512
d1f43708b73056dfcc416c37de7bab7fb07dbc9a320fc004a63a2ce7e0365cd71b7de3538091c13f4912d332146f28c18e0f5e8b6a731d84b6ad1e04fd436299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b39a3188d7ad2442d4a13cab246d4b4

SHA1
66e409514e7882069300d2baf31ef11fb3d57c3a

SHA256
8a25c4e296f9f7f96d746def4209fa6f8e01a4d6d0dddfdf8e738b534f84770b

SHA512
df5dae6a467c5e9d23bb343cc25a301cd1b6e3586776d273238ba6ab57718b6c3c0362c4e00e64c711dd2a87d130dc738cafb4744ec4de57b8fabbe88cddb721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46ecfde1a4fbb90b637051c70aa64f68

SHA1
9993dd59d37c56c99f437c7fb39970324bda4ef4

SHA256
942a0da9b64c062f94241ca6faef157d60abd8903665cbc1e398a8e8f28ef2fe

SHA512
500678f4315cc14485bb19618a26dc59f1512d852b371031f598daa2e46b2a844aecadc6fa3026e57e3f7b38f9b8427f06a0a93e10a3608aa92a58506794eba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ef9e89c913108135879d4d38078a5b4

SHA1
d989c10039baa72d55cace2f8bfb8fe730f99e4e

SHA256
e759ea4383e0334fcf97274a53cc801419ff9eb90b7467fc1bce03e8e2be6484

SHA512
5ec6b21799e65259f8d56a56ec6bf1800f0de65fdf11f09784fcdb9b73cee85028fc6591fd25c7050f2d5646fddff8643429a5e6ca930565557f08b2728e1103

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EC9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F39.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit