657a06ee735cabcacc7d8e1dce9e1357bbe5ab0f5af62f30128bd366da6f6ff3

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64798b6ebb0d157efd923bb782358c86_JaffaCakes118.html
Size

69KB
MD5

64798b6ebb0d157efd923bb782358c86
SHA1

dbadd1e1770431f3ca8d95c56a45babe955663d7
SHA256

657a06ee735cabcacc7d8e1dce9e1357bbe5ab0f5af62f30128bd366da6f6ff3
SHA512

52ad6dc8b4e2cb82073831d821d575b4868cbb0f92599e5a1e044d00efa9f13be127ecb50159acc3ab31c792e1b73d0092e8dac73e34a9e9e1a9f8042ec584a7
SSDEEP

768:JicgcMWR3sI2PDDnd0g6G0stoT2jwC2oTTMdtbBnfBgN8/lboethcRTQFVG8s//c:J6GT42w0tbrga9nhc1nhVa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF9A0291-17A7-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b16384b4abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083087023773eae4ab67d277ee41b5d7e00000000020000000000106600000001000020000000ff6a09c9cc59024ccfe4431fda9b0bd8cd1a47db2f1993f0a8aceff34a8a30ac000000000e800000000200002000000054a77a1bfc36b97babb140ef33e96d54c5b0a1a5cd4e7cc6a15d259f297cc1119000000007b080750a93210a245ffa8818184169acc7b60584be6109250290c01ab00a470d2e65b6f299c1b7509f99261fb28c0646c7a44799975163c8cb30292b76a321f707eef13f52cae896e56f210f5809f18ad5b8885a75aeaaa6b4f9f755a1c8040be1599b2600f3a7ce146fe46e4473218bf27b5601b1c6ef437c79bf7f041984a43bb2d785a09e03ef370887b4ffdd3540000000dc3e275125baf8e6e548ad2fe623f70e741c821e74fa18d7f6d8fe3a6ab0a1f9191157c12d6614905f96acb057312a216fa06bfc2e2b73fb218778d522c96943	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422481313"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083087023773eae4ab67d277ee41b5d7e0000000002000000000010660000000100002000000005594ecc8e4e133002ac5a8f97fa4ab5b483276b7e0b5e694a2f1440cf890b35000000000e80000000020000200000002c3223d6770b0234f2537c11674ee8566baa994869a5115fe2c2b595af02158c200000008e72ff2ee109def4896de88e8525b598ce8b3ab8223ce7a7a1cca441abad2d0940000000201fd02d20c5080694851a63b28096d24b812b573868036ec0fce0b5f7e40ea5182851f974fcb0ff9fb30bb6a5ac4351fd7c6fe6734b096edefe8cbd619ac1e1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3020 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3020 iexplore.exe
3020 iexplore.exe
2180 IEXPLORE.EXE
2180 IEXPLORE.EXE
2180 IEXPLORE.EXE
2180 IEXPLORE.EXE

pid	process
3020	iexplore.exe

pid	process
3020	iexplore.exe
3020	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3020 wrote to memory of 2180	3020	iexplore.exe	IEXPLORE.EXE
PID 3020 wrote to memory of 2180	3020	iexplore.exe	IEXPLORE.EXE
PID 3020 wrote to memory of 2180	3020	iexplore.exe	IEXPLORE.EXE
PID 3020 wrote to memory of 2180	3020	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64798b6ebb0d157efd923bb782358c86_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b10541be3bdd411399e43147dd81afea

SHA1
28100f70d49e76249933fd2e04a945f669eca625

SHA256
fcc2cf5cf7d0f3b3d1403bd678bfab0016a13d253040d0bed8fbb58e0c823645

SHA512
8079af416d0af077f702e406e2bee55f2f0d43b08315f9f531e0b4c779c96811580f97b7c0b011ea2fe7d8f85b6d9273900ea37e604168c0da4daf4495f43b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
994e919ca9bc6224837ebe63f194720d

SHA1
b22dc6f15724f0b120215dc5a7528de019390bd6

SHA256
524a1767cbc10d9e808d52b18b660d3776e63fd2289a2adf71fe10ac9ebbb3e8

SHA512
b80209ea8a20e6f46899130dc07dab1dbccf4162b58409af1eb8ba9f833bf3324ee2e615bf700b6c8548c1747b7e8cd98c7a5eb5738b9c90bacc23787706ef70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b553bc78fd38df451522b168c9c86c9

SHA1
ce441bf20268c7ebaf07bd47f7592975d66cac6f

SHA256
2c4f65714971f44a4e700145925a8332ac6017ff3b41b35c3905376cae3531d6

SHA512
8f004e36e95200a05fda92311230331f7fb7750782b4e9c1325725a061740961564845f78bfbc81eb5f6619bbd6587df3e1389d7e4e090068cc9080cd57fdb2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36b5bed3d148abe8c021a92d2674862f

SHA1
5e75b2717f5ecda58a80a8c5d7b834f318a87314

SHA256
c514a260de7b504c3710eb4e3520685a60465e530ca37b0519656fdbb82c739a

SHA512
d8bb5b7763a417393a76407f4224534979781b0cf910f9c2a98e62fc9a904439559aca47a0837f1d8e8a15a08fa6dc7c0cf33d5bc200601675cc58e849aaf9cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9af7786887242d25219205ccc0ce54c

SHA1
1d03d27419d57ef26e41ebeaeaf6d8e5a8879a3a

SHA256
efea95e0115b16515df973e1d99351a7d586d6df86560a755d4bc2af3e83d416

SHA512
9985cabb27d822e74a37c74c90daaf3e0e2ee6bc4692f101c87a25c7cf374b39a401597ea831a555f23e19c7a38ad2cacdce753ec0991b16a707196ad4a143e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70e5f0b8dfcdf8d8f9df0892ce46cbe2

SHA1
38ae0ff50c1383c2cab48420f71fd8c8ac0e5f94

SHA256
8158ce56ef3763140c89db37b0db35d46056c7278df9f64f3ab52d201e19602c

SHA512
34f027cc163c53f17101824c478c516e77865c0bf3ccd3ba310d62813a2b04c408a9b78db5c61b83d0a2492c930758af2696fd5f965c2a5422e73cc7dddfc016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072dd7f85b6ae566a50d60e2a67fc572

SHA1
33c55164861b6166c0ec6b21e402d7947e675397

SHA256
15f683ddb2f44599b2f7208f234abdb9bc34690c7b59be9fbc66b3858e0ab9c1

SHA512
33c53b82485244ecc521494c5353406699c8feafd589416592751d4dc14d7f45cdfa118b7063c1c9df12c17e20083bacf2dcab151151efe4941c004cc94f0a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34a689586eb7214b69b45f390a3eb58f

SHA1
5f4d7351ece7ebe12badf61696996a2a5ce79d39

SHA256
0150c7d67c2d39b1c9a6c398093c0ed3f580ec55534b7be979f614d2579f0796

SHA512
2c779a1c598bcd205914282f85c7bea11fc331ca2897b40b4bb6c6ec3b241d56b905b7f594e758bd1d3aafad6bf001f42cb4cbad80a2f4f3b167719fb3a62747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70f7aceeef8869f1f04ceaa8a3d953cf

SHA1
f88eb2fca95165ebe6d9ceb7dba676bbcd14a185

SHA256
e0b1dd25fc473c13bd10059e36cda79ef01b2e8f6a2f84e2616763645e3ae1c1

SHA512
d862b1180bdacce6b04c33b986ee9e10301a93aa4a5cbc3e06d9cf67f1c703f5e60ddf3475f4557096f1f3b7b7709c0fc53e74ecc0257d32bc433fa1680cbd92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7558583831abd79bbda80c11c1f1e971

SHA1
7771f3a569ff96762c47ddabb2fa6227935692cd

SHA256
587ac0fcf2bd4cee86e443f8bd057fc11b6dee946fa62d08530670bda9852c3a

SHA512
a7fab87a52346b2e39ba650b96d9b8ed93230b93ed6ac99eb660e18839d6bccc36b66d3cd31364657ccfd4caa463328a6bd16f9110678bd679634751b7133e34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9d3f5006bfb6abbb9f9e2239258b1e0

SHA1
81a7367df633f27aa41c2535f90d9efaebc4989d

SHA256
db78eee73a99c158d0b571976f757e6dc278bee260f631baed23a945c2cace05

SHA512
48626797a2d3576a893043a791d583c1e86e75c75571ca023f4346ffac1e82044bc936b7912e70a837385824cfa5567aa814b3dc6b82775ba0431a07ab7d88ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e31bdd4f82bbf43c4069636b33d1c413

SHA1
c3a32a770ab201af9ef7b9c2034450d766de7248

SHA256
2e784735fc8e37fb95fa2c2d4413d6604a2bbd06822c55161edf8b581aa82607

SHA512
a887a33d80278b89e2351998f04b61958373b2cd590d5b4f2ad665d642376319a80f7c48b715f68c2baf31aa380d440211e653ac34f714ba9d2c0dc51c55ca67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3881.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3972.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit