f16fbf24038cfcd827235cfbdcf4aee0f47bd7050e6b50f6a8350345f96f16ce

Analysis

max time kernel
140s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68e50bc4116031ea5bb727f96e9f7e57_JaffaCakes118.html
Size

11KB
MD5

68e50bc4116031ea5bb727f96e9f7e57
SHA1

df00afb4ef3c2b5e4b79bef20895406d36fedcd5
SHA256

f16fbf24038cfcd827235cfbdcf4aee0f47bd7050e6b50f6a8350345f96f16ce
SHA512

01bad1524859fdef3a3d43fef7d7b06a456445bcf18f8eb8aaa1493850d289f9f1d0449360a39bc21df31d84f7905e81393ecbb3eaade10921c1f04bac738b2a
SSDEEP

192:L1VUVqtE1/kJrxvuiDOf9WRleGWRSgRYHgBThmN4tv8GID8u2u0pVvoK15cq:L1VUVqtE1yxvuiqfARleGWHRYHgBRtvV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422579920"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000006796db786aa29d9ee2c41edda5cdcfd2c6acdce2f678373045685a4728664044000000000e8000000002000020000000f84268645308e4db474971a98a8301ad744d778084a4c69777e3a2ba71da446b2000000015b8dd4f2be2688a4eefa4e5727a2e2901463768f9fa2e2f406646b770da3d6c40000000009fa5bb99ab6d7a34ba7e064f7ef329d6c0f630679c0d97eac9c7c6da1a72e0851182de2d68cd303749b319315cc7b2575a4ce33688471d6b20d227dcc42c62	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005ed90270738aab7f13ba8ecd3d88622f309552d259781fb6406b1080d1c479df000000000e8000000002000020000000548fae679e64297aafa294eefbe6de48302d8004d985a5ddaad2792ec33c6bd590000000c9ff82b9662fddfab02679d2d2e8603366c9679d6fd23328ebc881eea502eb34f565bc27713c1fac161d12b4d9b616207d7f1e5de2c8668b12b7359f8243a9d742de737c7e3a6a0aa85f4ce3ab627a1a0192503782d805d6b9d4e3ea294516817a8cb8f63621497dba8eb1de8c9b6ede729c7719ff89e10d6d227acc57b23cc6ef4516fc1aae0e7ae439d3893c3c367c40000000358ff0c516ce4ffcb05cbe99168cdd029b2b54844c3992d43b3e6eb98c305f7d2d478025428383848e9cd6eb27a37daaf3499d2e7cb2aed6bbce3a22ff36bee6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50874a1f9aacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{470FD511-188D-11EF-BB1E-6A387CD8C53E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

348 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

348 iexplore.exe
348 iexplore.exe
2348 IEXPLORE.EXE
2348 IEXPLORE.EXE
2348 IEXPLORE.EXE
2348 IEXPLORE.EXE

pid	process
348	iexplore.exe

pid	process
348	iexplore.exe
348	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 348 wrote to memory of 2348	348	iexplore.exe	IEXPLORE.EXE
PID 348 wrote to memory of 2348	348	iexplore.exe	IEXPLORE.EXE
PID 348 wrote to memory of 2348	348	iexplore.exe	IEXPLORE.EXE
PID 348 wrote to memory of 2348	348	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68e50bc4116031ea5bb727f96e9f7e57_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:348

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:348 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
834284c9b57fb433a034309e1664e57b

SHA1
e3ca2831ba7f80580d3169a82864626f070a8dd4

SHA256
aa9b3cd50aa68750558903b5dec61f04a59025bffdcd59277a5a472d2f0c92b1

SHA512
22786c262ba97984d0b6deca9d68f39c2206d05854778cc255e3b5548ae3f191f58ddcddacf1f1ac5cf2263b1f7ebf4a508e2cf8019d3452ca546147bf6e112d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f538208e1930f26e4de92dec91abe6dc

SHA1
4e4650bf62283942ac2f1972e7a9ee1f622a7a58

SHA256
889f63ac9a666798568ee2694af64db1e5d2ac1a2b646deca8f43426dd7194a5

SHA512
7907ed046076937c9841389642f15b513fdf7ded9d26ba09d16174b5cf8c7c46e55b69ee0e2ffe8d51695208bddcca7908eca4491bfb23eab9e8440573186734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee0fb66eaab7481f7f8d7e892edfe83f

SHA1
b73f5b056dd18187465cac51cad575afc783a36a

SHA256
639aae2e5f92c0dc567ad0d6e539d90d259df682d858880d1b9a598278962d9d

SHA512
2d00a3ba93b7d5c411930302ddbdde79813994422c09af8bd53154ed168b7c3d6b6736d27ebcda7646793e3fbf6016b33c7d9cfd3e430038042e750ee3cb8099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c46ac514a0a43861557455c1c2019433

SHA1
00ace78912753d365ca2d5eefd09f15953429fe3

SHA256
2cac7252f4b9af1c11a89b6bf449ddb9e091d504356b16389f3fc88945cc217f

SHA512
809191bff8dee42e4a586660fc5457c10997621f3dd3616778d1953b22917c25dadf5fd69cd8e1357769ebd1bc2e0fa0a0b08c71ecb38dcec87eadf962ecb1dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f88aed3d2a977fc353203148b21589ee

SHA1
c7dcd2d5d1df6fe2e089343460fa732541132cc8

SHA256
7f0e7b6a4a2eea34ca9a7ca1aa5efb825d1bba4386367773a8b1317566ddff1c

SHA512
59de1577f0eaedae0c1cd766f9f8ec8e03b984d0fadfc27ccdd1ae74c9400d34cc8da2fcd971c1fb8425013fb019f05cd54e2b4e58f039f6260bb1a4b4fbc0b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b51cf25b4fa2fce28b714cb33cdf0176

SHA1
513bb9e9fb953d93a905c93ba63e17751ef88c5b

SHA256
b5cf347ae17fb719373d06efd47a524eec254515ecdbb2e2c37c1b5e3587e8b3

SHA512
aeb4b20698ce3430259d72fea2f2adda5f9ddb6c4e5b692b291aede18050164a27082c85f2d7b158c196cc0d56c8ff52ee4b264d045156f20fc9124559d287fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc8482814f956983082e3cf2d9751a1b

SHA1
a1d6b315d517ab8a0dedd2d5280121b52cb8a15c

SHA256
02833fc4c457a24452c31549907abd9d7ad79b9a5337deb992529c72794145cd

SHA512
288de2becb2fbd9c24b380793796c6649cd559419fb1739e3c278ae5e40d9c5b7ac86e1f0556a34c89c3d9430d3591b23c7946e7ab376b24a34b8c852cfbd99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba107abe9477426f3fc0244a40e1772e

SHA1
02e61178675b441fa6d7a0ff4e5160f4afba363f

SHA256
3ee2fdc9159f7461951884232d945f91e17c18f405a248af5bade43ecdc12238

SHA512
dd6e870e4172e3522e3a973f0202dcc3c38a729a2cc06dc5ee0ea97010d92bb9b0c3e8c49be4615798b00e8592468e9f31122ed4fd2e8b579d9b29d131f0e1ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9304ec194d474222017f94ed47dc667

SHA1
0589a34418e1b02d8464638cc456e7e5886a7c9f

SHA256
74fb18238e2667bbf82d166ea65a632e516ff88cb5854a92f021d0e12d473bdc

SHA512
ad8581a51eeb726d7451b1519d3b4c5ce1eaafe0e186c9ffe42a2f3de88d68cf179d1b52982c943c89e3bfbb1829d78b71eb76bbde2e01bc730c70413d8d2ae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72647445f80ef537a2c4467add3b9a52

SHA1
61a3585633472008ad650881667d0eac385aacb9

SHA256
a2cb505b4b676dd81db313e5a120257b82128e018ab35970df1c268069e6768f

SHA512
def4be222247f6c4cf9dd4aeee816b1c20be0ee7c44d11cc5c61e3cf89b6836421f13793675421aca342383fa5dfc82fd9367aec42b2888051b923d0d3ef3b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f0a6ef74ae5ffda28c3fcea08aef54

SHA1
7aff21fecefcc96ef589253fa6e68445233084a2

SHA256
99c48d1c377e427bbe90946a8ad49f464211b13f0b3e46ccbd8da7a7c3ee6fc8

SHA512
bc7e72a61f941f9b2678b38ec4fc9d3f6d37a12eef8695a2d2faeb0fd4bbb3bffa10ae471a9035316b9d3a460cf1cc72db5184f3a1884d07172f836513ca6ea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c2bcd7570c08e76f5fb18ea4cde4dd6

SHA1
9d2c6a4d64abdec3acee1e641b3e60cfc994147c

SHA256
5532313dfa5f1d2b7612937fcb82f9b688bf4a1df817a21fa3cedf9057bda527

SHA512
b53cdd2251fbdb03559aa42359278af0abedc23b97771de54c3ad48df23f50f2c9f6e156fb59111530430be24b7d2ee58a60d0603c2c53284be37474708c1ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9413aefd08964e68043726c20426552

SHA1
230805e56666aa2c8408dc3c985c807c152fb713

SHA256
5f137f2b721bc0b0c5ee8b6bff231135447e72e6bc2816a7b1968b16cc500e1b

SHA512
0a331adb49f40f0b98fd377ef5e8259b8bd2e8597c48f8443c787c606c49966c58ed239ba514f65f3784fa0a900e61a4f63903135c1c3547f9f9d390380a1665

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18E0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1950.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit