7d19ec573b201404c7e45ce1f754b1f5d918039cb783f5692d0093ecc1b54e66

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68b9fcf8e867f21384a699fb26952026_JaffaCakes118.html
Size

19KB
MD5

68b9fcf8e867f21384a699fb26952026
SHA1

2c7f6b2a7e49184465da61d0b1206b9da9a9c10a
SHA256

7d19ec573b201404c7e45ce1f754b1f5d918039cb783f5692d0093ecc1b54e66
SHA512

3d0e8260b21b38f9a318b891aa310806542715b402bfc020c6f1272a9d7913d6e25d0c814367e68a6396808508c994cd6f1b73a4d3ff78a88e7b63c2ad52855c
SSDEEP

192:SlzaZkakXcdx2k6cwgWGCRU7M/qgMa2yuxT/hvcZ4lKB3EFrpq86Pv6BXQhGSBtH:SlF7ckGJ2RMJpq8nQhHH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f45dcebfa3a08344aa5b57ed5bf021b200000000020000000000106600000001000020000000de4bae91207dec2dc70ba24d417636aa6e58f55ccd9135d5cc6a5e4c82603a0c000000000e8000000002000020000000e147380d244bb8216cef812a9b24f9a06e6e3cd2f195c309f8b7b3c2959aa8e620000000b536854656345ead21afa74ba1bfc98676641c586cd6e268e2480260940bd60f4000000095ff4fec08a7882dd3c056f4d63948585add2ace2c638d2a472373e767e87ae3a1ef90cf0645ce86e826609c4450e122809330746f1bb63e9af210d3838ed674	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f45dcebfa3a08344aa5b57ed5bf021b200000000020000000000106600000001000020000000e7eeb3c861479abca0f8091dc21c3bdb63bcecc204f17ebf7ba739631cf8d366000000000e8000000002000020000000bedd10a2fc21ac533513763a1d1d4350e93acd5829f09ddc32e5af7906bf55a5900000009cc3566622ae821116c6e2b50679fed4630740c3ddb7f29b89aff108018c8e73f0acc9ce21518575b3e7e38ec20d2906841f3b35add0b155be4db0ef6a16e51436fe046061219aa55f34058e32afe7375d5ae64219af2e84236b64365587a980e75932bb80b37de55ba4cba76c2e92932459986057b6df68507d8bdc23006d70db06858545cd6a0c3f35a3d36acbaea34000000076c891dc43aaefbdf891d19ac728f53a276a64c7631745c13de5c7d812ff2fc79d2d1da742bae90b6d60e2837113c3001fe4f4df8d025671827d5f6ec0874329	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDD45FC1-1883-11EF-8DE7-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422575879"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05aaeb290acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2248 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2248 iexplore.exe
2248 iexplore.exe
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE

pid	process
2248	iexplore.exe

pid	process
2248	iexplore.exe
2248	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2248 wrote to memory of 1972	2248	iexplore.exe	IEXPLORE.EXE
PID 2248 wrote to memory of 1972	2248	iexplore.exe	IEXPLORE.EXE
PID 2248 wrote to memory of 1972	2248	iexplore.exe	IEXPLORE.EXE
PID 2248 wrote to memory of 1972	2248	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68b9fcf8e867f21384a699fb26952026_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dabbb3bfc283033faa8c26960b52ede7

SHA1
c2099bf48cea6f24f1294d4a37fbdddf72de4d3a

SHA256
7fe519045b0ef716ad59ce4b2407b8d79eb984cc249d1277b154a2eec0aae6e8

SHA512
4d5ef7f32c894ea9c7b38dcac253cf1718b14736bd0f9105d29d93e1f343f2cc58fd09e2e5fd15438123663d0245cbbbfc260b5aee776d275ed09263edb3f875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42ad3711f2e9267b3d935b2d272dee63

SHA1
2d3d0e51ad1c3ac966688b9d2d400c161f302db9

SHA256
0b5443b6c9a1e6665f83fb7b2d791de30d4ed41859f1b34ab23a0d82cbd88886

SHA512
bc456c7bd3ba111241fc4bd9a140853c7845370d9301d367037c3b9c0e37e8dd8b6327af35453f36a986a10273ca27dce18ea64fdc97980ab8de495770f1b31a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
946322686552fc5c2d70f2ba09956ba5

SHA1
265e1440eeb71cd165510f3fa21958bddc7b4d0f

SHA256
93f711369dfa1b8d57a9d7e19af956804472a09ba0924c067c7ade27ac084616

SHA512
b7161e5ae6d89a47254d4f327fdee0784e94d082d4288e8f7c88013c57488ffc63e7014e03ff1026705ddcf83b8cb9980059bd3da8420d904cd1dc5c70ed625f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8c94c720dd9402240e723d18596a518

SHA1
e8df2d76d71fc90047227bcc3e9b55b1f729630c

SHA256
f7eca4fe7e9a47bf55169a911c468d878626c86319acda03f60b45307ed2231d

SHA512
9f764d1d1cba9dc4f2baa1a5d0a53d01c52fde71bae3f9e791d5f644f6eae7e9152482a31c14a4cd7622e55b8a4d12872beaaca5c51941577433ec78c96e15f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fa3f4927256e7de58bf80c2f8644a92

SHA1
fcc660606ffec9230175c7e4e201687de204d0da

SHA256
96e9db4595d2921c026f0fc3be05643889d73526579bb3c1d2c508f187501d27

SHA512
7bc3799235eaed3a675e42fc60db1fe604c0d0cc0d145a22c9ac2cfa7afd415c810fd9fab49b77edf51443a79b8db0876b4065d82089a46ca59d01b5cefc23fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41fd86c4d27f6d6096f58b90f204459e

SHA1
84544429391664b5bf737be36b7097a1a72aa8bb

SHA256
92f1c5357c61fd763fca1750f9e651dbb364bfb9a69ba44f05fbc14c7504e777

SHA512
b37fb372422347fc807a10e64b70f20a5cc3dc9715001b84698b401dfa0e1bcfaf8c08d8661bb74e1aaf738b0f1942c57f80b63a783c634127d04e50595fd367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b397303b1bd3d803d70c97dddf13ea

SHA1
fb939ccfaa35f0fb9f8f2385c0295ffef4c4259e

SHA256
61827dde1ebc35d986ac695741d936d8242c72c6d4817cffcb3e054e8b5b08c4

SHA512
70515ad4090e897bb15cf04e10796ed17f0e06dfed29300d6320fee5fe7c0eb0d94f3b1e267bc207923e8b4e8cacf26348c69c1e9cb27f089a90374618cdea2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3101.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3251.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit