bf0edf60f94985f0b09052ece5a4bce8b6078970bb1a4d679515545ff0676b6b

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6902fbfbdbc0c7bde5df7af1000c4dd0_JaffaCakes118.html
Size

69KB
MD5

6902fbfbdbc0c7bde5df7af1000c4dd0
SHA1

b199b945ea56ef9417b50ac709a1e7e89856a679
SHA256

bf0edf60f94985f0b09052ece5a4bce8b6078970bb1a4d679515545ff0676b6b
SHA512

3610f01128570bfc22f006f7082a856265fff0d53ff690e7bc7204c38d56dd8e986e7f729c3466c1d97b909b47157548ede19846c66901e56aecef59601ae3a1
SSDEEP

768:JikgcMWR3sI2PDDnd0g6sB7ZoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8sB:J2+TSNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e37570a0acda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000080f5ce67353c21c24aabf4f766abd78a7f820ff1d6ee253129eed1bc67569f24000000000e8000000002000020000000d4441c2131c75d118c017f3d80bed95fcc37549cb1005159f3ac81523730d176900000001e33a433ba565cbbfbbbbeff133057e2abebe43694aaf0ee224e7961ed85b01ecfe52b81df4ea5ed47f537c83ec8daeffc9bec865d88cd6762480aad3befd9eaa77ac47a5048ba842e6cd3af5de0b13c21f3ccda84e265b32d68b93831eec5ba208bc8f2132fba07d57793f910bcf65e334c6d490f709ff7a607fb29c5f45f4de0856b68bfdfc356c5c5efac4995027140000000ba1724501d6425e547cd4b57f0f270824593052fcb7833c139ab07e04fcebb91e5e4f3638d61faaa52d0c359be864f3b61c322108834f7d7cb909b3971c1ba55	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582645"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000dae5f57f9507c11eeb4f35c69b9e76c34fbc6fa9650422ce10845df7a1e2330000000000e80000000020000200000006d53b7365d77eefbf42b1ac8e7c76a2f4c433208ab8766b9f2f838a92af5d6222000000053558743e9e436f3650ea21ea6a182c1ff0f346df2df262a6b249371ed8ea43940000000e9b79626e306aa6a97e299a8d5707aa462e5b70cf32d9ab6548036287f2e4636bc22d6075d807f29eddb6e89ddf57cd9ea923629f1649cad74eed2bc8ca6bb00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BB0FF31-1893-11EF-91CF-DEECE6B0C1A4} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2580 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2580 iexplore.exe
2580 iexplore.exe
2000 IEXPLORE.EXE
2000 IEXPLORE.EXE
2000 IEXPLORE.EXE
2000 IEXPLORE.EXE

pid	process
2580	iexplore.exe

pid	process
2580	iexplore.exe
2580	iexplore.exe
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2580 wrote to memory of 2000	2580	iexplore.exe	IEXPLORE.EXE
PID 2580 wrote to memory of 2000	2580	iexplore.exe	IEXPLORE.EXE
PID 2580 wrote to memory of 2000	2580	iexplore.exe	IEXPLORE.EXE
PID 2580 wrote to memory of 2000	2580	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6902fbfbdbc0c7bde5df7af1000c4dd0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5804f49ccc4a7df30136874474579dd6

SHA1
eeece28e0d3be3f0235c51547c8aae0220bfb8d3

SHA256
7815cb2203865322726ef3662ed1d5250a08bc8eca501250c807edd4764de6be

SHA512
3d87d7c1c9e79e2673e751e3c5fca49fe1cf22cf7f28d6b6ab442fc3ff009ea19fbf79ee4cd8adc3e9e7557f6c7b5d3b17b9e1250f35fb81d1bed83957df755b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54fdfa51f0ef9b231ba9fa2874167304

SHA1
914bdd8cd0bab0b732114833145a3eaea7aafad6

SHA256
79f7316bacf1fbdddb23db362566b8a21068252b894b79749074c752a50e16dc

SHA512
0b5c38a83e097464a1ed2e103d645dd42d90c8e879a21dc6bb624302f8e9d3b044e7c5118a9b74c5ce1c8bf612cce9687ea06006df1e3e3a295d48393e1994d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e08e78acb5068306195b87bf69d9275a

SHA1
513f3c571b6f2c2fa228e15b2907de0cdc47424f

SHA256
3180d040932eb082dbbbdcbb2b75af50ba3dc966c93e2d36b864ef58eed60581

SHA512
6b882cfb5f3d37bfabbce41eea67a937ea0f410728052e432168ddac586e61bd0a05d03408362db052c458c10d2cc889e2436db5c4c74bec147b05a7523827a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bacf4456309c909c5875a1dde3d9490

SHA1
5956b2ba0c229fb1dc1f48c273b8c6d6cdd0956f

SHA256
32b16bae68e7aa80f35eb9e08016ade3211dd15ce08790a7af3cf34a0858af27

SHA512
2924ee38fb978a8ac695c2f451a63fe673b61084382a85b88fe133537ca2173da5b7ded56a2f87545f682307688ccdfe90740f7ff9365bb311be652781967fdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dc352e13475c6fb9c89b68bb10df378

SHA1
5f0f739cf1da340721e8f30d7e7d30a88df2fba5

SHA256
81f79e374c5aa6a7a6279e6682a99f30a899366ecfd68a202b33b4ceb6df1492

SHA512
95bad93d3ddac1dd3f0041405efed1d8ffc65e395467d466fc66fb97b7f00e685ada71af4c430ccc6acba15ca85af0ca77597e4a157833db8908c41a079aa0eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a951794e499e11fd140f7e7f4c8ae20

SHA1
c9d4b1e6ed9c6411656b78a03a822895549d3846

SHA256
407cac0055ebf17b6bb156eece6049f0aaf865a3453cb5e8054fc21b5a3d49ea

SHA512
1814b3da7fe3451ec12f128eae817010912f6de3958662a5769ec96a33869cc77b1e932bb99a72c53b1746d8b49096cd0ff0be66118b403e26b67dddc521cf5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f17067662c9b3627080e8863dd514260

SHA1
37cd47562f2e71820c8fb5c0a03475c08d5b1ff7

SHA256
e1acbc8d9bb74a6aa0ecae911902f65d0b94747dd606d19037102d6cf9613d2d

SHA512
117e3ac03fa963df277830b5d0073d21172aead8236d5801608ffbdeb9ca5b968a8cd438240ac092e7e2bbb81fa2bba8bdd55ff2a47aa0520dff5abc4b582dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42196016734184b3243a1af2ddb3a59d

SHA1
549884ccc9314d4bc6c14aab2b1dabfa55487b79

SHA256
89f333ea4799fc0a04d7515e9730bb0d6e295f229515397b8bd6e025a0f468b4

SHA512
47716091f5cf3f8b20e45f70476ff3e4a6e0264ba8079703122fded8df70fd98de370553904827a31eb01fd9e264218b8eafc97543f71ae7af3673eb090e0a91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c41efd53edd373a23379553b9d85648c

SHA1
6aa600b2cd990171904c7e844e260f7aae9daa92

SHA256
9d5ff1a4d53a5d8480223d4df1752081bdb68a0c3600e287052a2805116f2031

SHA512
0ee66e72296b514390bdef2dbb754cf3f2cf7d998a76bee02294cece94ecc4681da7d551044459bb788af040a4b4a35a8e109a220c658793bb9a054ac6847dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
964fa3a5f8c62eac9df2b810213ca208

SHA1
8972090dd531e5640b366121911cae01132f6710

SHA256
dc00636ded1437751d68b1c1f757c735b1b1336c9667de865254c7ac3f2c07f0

SHA512
97d602a98555046c0cdec743feb8c2eb5c4a887aa2882d40a762d60383a6537cf9ac5a165737de3af2ef9f8275cdb18ee88ee0037e954141c9def2f16feb33c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06dce5a974a9155dc00ecaaf22051403

SHA1
6e5b097321f16507a29aeacc5f8975419141821c

SHA256
69e3ab9e6ae8b61b070d0eeb7ad7ce9693433644fa84882590077d9a26a3746a

SHA512
9ccdf08cf39eac04fa5e758227559e9583718321cb23d46347a9a93da8f8f87d57f4dbed67d06faabeefcf059d99ef873ef21884d0e9452b8ee9b6507d649254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58ecef6e03828fb5b8a43fe9ed4999fe

SHA1
8fa259cefd7ab2e9e264e886765e600d1c7cc5d0

SHA256
dc20cae9afe541f1cd820e3490de3b8c555c60173fb8b54f946953f57d54e586

SHA512
b36f0c8816e40c6a9acf9dab44620b3269409a023158822297945ef0cb855bc9f5b01ee5438e8e15e76ee552cfb60ae19461fa022652c7e3bd2dc9e54826750f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85fad5e004703c2fc4025a14b976defc

SHA1
7e57ac83cf6edb8f30bd62e66edc31e994d7907b

SHA256
f1f7e5ee6be1351f511c91f38eb063490446d86abaae13695dbe3440b2cea578

SHA512
d8b9bfadd510956a3901e8139f7e79c2c627ceee1cf57b96a1beaff906131309e416bdbb3fb6b979248db99f7539ce4bb38538c411a427bcce9f784ddb9de383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c45ee08e197bd48dbbe80697bcff7c3d

SHA1
9b5d6df13014e4b8e1815d689795e29804cd3044

SHA256
b3a7a69e982cf0da9873e8d85cf520101cb2f60b3c8e124dd4b6a6275aae4ee1

SHA512
d1670e38f15c692b00f8c39da603a6c7e025028b3ef9b1b48065b57ecf20f6491c991bfd64a049c46494fcf08b79a3f4aa90676ad6cf1d5bc52d25c4c8e8a37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DD7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E47.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit