ca3f9428b88c063e1eba512bb62cedf267dc708eaa625ed306570fefa93299ee

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

690156c07528ac58b95f7ffd47880cc2_JaffaCakes118.html
Size

26KB
MD5

690156c07528ac58b95f7ffd47880cc2
SHA1

c7d79fd2abbe76f59495ad5e4ba8ce1bf6646eee
SHA256

ca3f9428b88c063e1eba512bb62cedf267dc708eaa625ed306570fefa93299ee
SHA512

fe7fe14a88f795ede75f5003cb0a338bd6776390dc04bf0236630390b77e11223028c052cfb3e66413e7903031cb6d32ab7bbf3929e87608625bd76f758d8499
SSDEEP

384:SwlbHtUE/aNQnKBwGqByVuD5hecN6ixNjzOHp0JPCbbKsc45FJZZDA:SwlnniLqBwGFUixNj6Hp0YKh45TU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582504"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4974DF71-1893-11EF-B0DE-E64BF8A7A69F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1932 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1932 iexplore.exe
1932 iexplore.exe
2804 IEXPLORE.EXE
2804 IEXPLORE.EXE
2804 IEXPLORE.EXE
2804 IEXPLORE.EXE

pid	process
1932	iexplore.exe

pid	process
1932	iexplore.exe
1932	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1932 wrote to memory of 2804	1932	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 2804	1932	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 2804	1932	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 2804	1932	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\690156c07528ac58b95f7ffd47880cc2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
772275f70671cadcd0a4c37965534798

SHA1
87aa196a712692d6b57a979317403bb6d73e300b

SHA256
f3801bc931ee41ad69163fd771e872cdb7b78f57ff57d0126d077c1ea32f84ef

SHA512
2affb7e1858242c5b00a29253f489d567f1c6590498ff8d58f68d01023a64a6f0b1e0c38ac3fadd02fc5aed763a1dc18106214956fa9759eed1515edf189ed18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b49bc2d7e466d0f732b8e2333cff37fb

SHA1
8a35dd8c88e939a503c45a8f4bf291c957c00cfc

SHA256
36aa5dd3e325b72e6714380b63c011d17f52d26433a0ec1e0ad7846b358b7d6b

SHA512
39a712882ea40ec3431aa20ea1c7e0da7ffaf116668551e7ed470a09d94bcfed3aca7aa82e54d11e2d4771685b5468ced8a31b2af1fa6c29398e968ee7409414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9130b9780df8f4e4aadd2e8f9a6f49ab

SHA1
106d8905c4f173796486a93d949701eeff403303

SHA256
f3f6110b451d9c5856e6cc9fd6faba9dbc3ef25432847280c7ae793666c6c3c6

SHA512
78fcc4d5a6d00397bd7a27605274e0d02e837b550dff21b9c820bed0cb9fe7e8cc630f3fbb574983b5fd23cfbd25eeaf597bff56e515f4d5b4a5b45a747f3704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b62fa9ad39b8f338d1c7ea27ef04bb34

SHA1
a961e45d71a19c78efadc3692eca871ba657df4b

SHA256
ffc21dfec499b5cee553769ee2f85c2045fc7e5e1ba40c28486041ac1a029432

SHA512
b15482f16247933be5d4822fe87f12b1d632000a7cfc748fe0c92f1855fcf45d7326ca0023d76b26be248af6d3747d3ae338aaf43a4ea3a9ad9a9d0c18189130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f82aa383afb402e6acc854a215548aef

SHA1
5f65c86c7635cfb8edda27b63b746ad53eb4d354

SHA256
a8d4308a416034ad8b83bec11f866bd36b8cbc0d88794373779a0f34ed31024f

SHA512
25f6146325e8e202d97c11d2dd6ac99abd6cda80fd0f95bba96a3da278f99df930933f8215c95c810d17cf857029f8e6d1beb9c5cc9b907abd034f5dbc3a9fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
924f5252a5751fe27e211aabfb680395

SHA1
2b768cfd2f963b260166bbb0b6740b6cfa14c7a6

SHA256
fb8fc52e44ff5b9ba2000d754ec35f77cbde4b2a4f13007a7ebd264be5d197c4

SHA512
20248cd9885e3a734fa367da199eab7c4bfc196ff08553cbe291c2a526f28ad8270e6e9409d341f8d6bdc1531c08a5aeb3778a314ba09670cade0e32490573ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74e9b0a7208d3ff1a6e38ae84ff3c2c6

SHA1
169459fa5e914e405c806f42a57b6321f4357b8a

SHA256
5ff7e5759afac531671fe8a4a2bf8de7a00ecb64f21101aad6c461eda097a687

SHA512
eb37dfcb5e95e5d5fd8adcfbebd1096972c878104e4054536582d06e0d655967484a513f42c0e76b557584ee7605ae04a1464c0b519fdd5f7c57a68394ebebae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
467c702227142c201ce47f7194f825fb

SHA1
4823dac42fbe6d18ebc1cf63461d7d9750884846

SHA256
319f499eab92b33a32542d646798e69f12c264641b6b3487f0f569beeef91f7b

SHA512
84770d29519ac67c8ed667f476297fe369d6089ffd9654b378cd41e05d76bbdb476abb38dac4b635e8d1edab7decee846485defd7af928e8835402941ad58ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24c9b87bbb0430e7964fe5f8c2952360

SHA1
65e251f30c27186c32293febee40aff2c06b1917

SHA256
48bbc8aef893364dd9e38feed1f5cad20d3a946074fdadb782c55e55b2e0bf05

SHA512
4aa8a0227788a45a388f2229a1b5078bc2de831230b37cc20067d09bb91a186f3d1b71f6d67ed4d0f7d2e83e540678644b04856318dfe5f5b599c4f05eccc548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c8dbfdf99e5376ab0a444e46a9c20f9

SHA1
df271fe28f94e7e9ebb32a7b0a436d6ff9b5b30d

SHA256
fa47fa9419f66e0d96af97a003451ed1c373cd5baff35cce06234b3297254c63

SHA512
6fe926ac8d8ad50795bf41d602adea592996e8d39a484cb4e7de402eb696455ef558c8503fdfae9fa9f40174e4b85197ee8e14da715e5c016b8219f6d2ae4c4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\CQYOUDF9\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\CQYOUDF9\www.youtube[1].xml

Filesize
229B

MD5
34ba78e8dfc992b336f167fb7acfafe8

SHA1
6426cf84fe5b1e5368374aaf349876d7d74bb2bb

SHA256
b2580675c5d95d7998ca4186d00b74656452dc2461092c61cd54044913157950

SHA512
62947a47ce62db7fe8a16bf75dae1c1e19401fc7711911238a227b9ea5589ea8f921482acfc7ba3f3a20e199c2a46b0b311bcab56988fcc54a069f844d028905

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19D9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2245.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit