412539b1510e7b0d9371b1f2e3067390aa411d45c05fdbf5363c21f71c79694f

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63f582ae8864003968fc1c9b9814d456_JaffaCakes118.html
Size

68KB
MD5

63f582ae8864003968fc1c9b9814d456
SHA1

3721d383ba2130072e46ec8187681e59b8e1c712
SHA256

412539b1510e7b0d9371b1f2e3067390aa411d45c05fdbf5363c21f71c79694f
SHA512

55df1621adc141f68a0ed91f71af65ae8ff65005d6fd7570266768b932919c1c8f5ed242f5d7e06f93b717df622415b9ae6a5aa4166aae95ca693ac3a973607c
SSDEEP

768:JitgcMiR3sI2PDDnX0g6AzUb6FHL62oTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:Jf0KLiTcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02259e79babda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f59ad13be5ff43fbabe4daabc5d93eafa47ea085defaa9ac9b361080038bd976000000000e8000000002000020000000e4a16272ccdc2e3de30676a2bdbf1631c2ed9446e71c74c9aedfa08d3eaeb50b90000000ebbc35277aa409bbf41a215a314a5f7521cfe13faa340b0f6af52f8e7feac67757ea1cecea5f2921ada90cd89028c54cf066a737fc436507b59ccd312d83e50d7d707a7c7aa9cc835b4c862a93f24dffb3148a0bc640b5902e6a4fd49dcc61068719f70814c9dd3b44f492926e9ec1dfeecb30b61445305c9e3c3e21317b210a4b7c2c7184571c5348934493ad7ff76840000000357d1f48f80037c7547a68ceb3fe5f9848fdc962b33471bc4545e5bd1b56970d3e1430c19b099a3dfc42f8c666108931e89bc1e2dd1a9a3583078bbf9b47784c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000aa20126b9781e1e67d3eea2d7279e49d0218444a982dd1348d73aba82941b589000000000e8000000002000020000000f4125924b64aed93d7b8bb04cd8060075fc030a44b36be080151d43a09e9e682200000001a337fa02a2dc8fc0abf485c2f3e47e8e3454fb4e66143585e44b6661ca02b6940000000ec33bc48b02c44ef136e5d00f8f470d43b40f6fd451741e3cd588cdc182148302fdb6bafa7b36cabd86450ddbb6bd02a5d29dfad841b652721d05e7804aae8bd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422470745"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12B216B1-178F-11EF-A346-76B743CBA6BC} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1764 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1764 iexplore.exe
1764 iexplore.exe
2016 IEXPLORE.EXE
2016 IEXPLORE.EXE
2016 IEXPLORE.EXE
2016 IEXPLORE.EXE

pid	process
1764	iexplore.exe

pid	process
1764	iexplore.exe
1764	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1764 wrote to memory of 2016	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 2016	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 2016	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 2016	1764	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63f582ae8864003968fc1c9b9814d456_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b9765d99ec0d3dd84253461e7d12006

SHA1
79566e7c7a08fbba54d9724895d79489e7af17ad

SHA256
387d76fdb5fe0220f64cb92f28673bbeb00e82cd4337563f4eac09310df616ce

SHA512
1f94453a83984cf8bd5f2c3a3ebefe05acd76a6631ace4976b87eaede1508a06a859e9d26ba4f8332a23d6b7e90751f453e577f74f6817013c892e29383a724a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06f8c65e85a07391c46b5f38972d2791

SHA1
38a00446feb02d1dfe8cbfa25bd83fec3b4ff86d

SHA256
728c487554858fbf9de7c62e716a1e4ecaa8dc89e952b52b51ac1c8385108238

SHA512
776782655ca4c1cff621598cd96d6bf38f5dafb4043053870cb783653d418dedbd35c6d48239b7ad645d47d901193cb0e50bd760f6d3da32d68e51d9df62f5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3135bcb1ee209f07323f769278426a4

SHA1
602001ca1ca6ded23aa1551fce85b3f5983f09df

SHA256
ae8bfb0e34b46d6aa2f444bacb4ab0ae7cb8bf4bb5e55b757a37c3f006a88560

SHA512
7a117513181b471cdeec86c2d2c4d3c118b20f7d1589f764282369bcf1bd1cb6db355c6bf07fc32cba472f7f72ae8f0332fe075934821437337d570b8046bd7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fb6b3bf356d46355ccc90e647a003b8

SHA1
760f7921dd4c3d9281b972b90548844ce7d9dc54

SHA256
27e5353a377524eee4a2db03ef8bac6779f7dc2078ffbf1ac92b14e8e1523f2a

SHA512
ff29bdb07a0e18e52f02e9373b686e50947d13a49560fa3c7f8c96263980b746be7834121c54332f81f386a7e1084a957ef101679341653be6ded0257597d96c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6e7faa2c396ccbe2e94ceffcbef8d1a

SHA1
459c5aed0da946132b2a409799f1471ad2aeac80

SHA256
b054ef5639aa346df84d9ab0211cb4a7a8724af4e96e5246b8fe2d1704f11317

SHA512
d6abecf831d09318335fab0a2887264eb8f0557b7da78a3382e0181a8ffebc233451d1df598b2955a568b3e1efb677eb3cb64e350e0ad94e1b15780c21ff5275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc778a7f79275851b8ba4f2c17b72767

SHA1
59ee907d2fc467ffef8ac5189c3afa4e7b6d0040

SHA256
1467d903354c47f558990c684e3c4a453bedd82c8d8e650c7aaf82d7b3c34d1b

SHA512
1b8d6b4950d4fa9c17ddd5abe53b8dc25e917d6b9c421f3d2f1841181c5e9c687724c349e1269f7bf062452b5cdd30c555f8c4658ff53595a516be72fba0e53c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
920c9f88271d841062d011a60eaeb2dd

SHA1
64b4e4dfee0c683f298b5ce2d2255039852a1582

SHA256
4b18290e386c2bc920aa61efc6c9acff4f9dad006670614264118ff43280d8a1

SHA512
4d1310208f01c67abde18ad0520e541722f9159b104c320e9cb7406e6d13467d0b5bbf3d16f087e48bc3dea850e8269e6ce25e8f06e386568dc3c9002746deac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a3a9d4f6928f7f7aedde4280eb7c60a

SHA1
4c0a134a7a82eb49574ed924392f3cdba1a1d151

SHA256
e2137bd7c22f854abe3dc5e45fc28e3c580f1a14f58772db3252d020c00daae2

SHA512
f8ff938daa026eed848b19abaf7ee968c9a4ee810c6224ea15819e5375771f35de6381fb42646c44e681ebd51faaa836ff9a719bfdf0835449e6c5437f52688a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32fe0a55c41cae8d09760413536b98be

SHA1
30cba6a53fbf2faebd5a2752725adc47a91ed162

SHA256
2883c566c30bfa1f2653b1d4b0b848b4bc8bf46843f8a84ebf600efe083afd1c

SHA512
ce47478a62ec2f356b96633238503052a5770e03f3c364a43cd821fd479c96e5d36f474374495ab9e5ea26a55a44a4ac832453bb7740dc7fd95eb250adb6e51a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
885b0697cb42bb442c9454e7b5539f49

SHA1
d433b6cfc0c40745ce50c40ac0129e2f7647a057

SHA256
a5719e4fb3d1a694cacb8dfd611e025007b42ff701639b6565139303c8962dd6

SHA512
216452bd4f69d99b99f50751cdd7689912b12fb57ca930242d3e6ad9c1ea1df8fc73544502cf91286e40abbbbd88102715343ac8be3c875465ed33956865fa01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BBC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C1E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit