1471ec119518ccf26963cc65f358162117a23e67c7191ad727f2b1f96fe6a341

Analysis

max time kernel
139s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6903a031ac2e2e9474a8251bcc663c1f_JaffaCakes118.html
Size

67KB
MD5

6903a031ac2e2e9474a8251bcc663c1f
SHA1

9a15abed0bb1717f229652e0e0d74e0baf46cdcd
SHA256

1471ec119518ccf26963cc65f358162117a23e67c7191ad727f2b1f96fe6a341
SHA512

6a2a94dfc29313a7ac45aa304d8a972f31c24f32e265e32c9fcc2dcfe3dd4ab838532e5f6f46cc7a8017e0e4ac815523c6eb4200e39b819d9a1482fb76a51347
SSDEEP

768:Ji/gcMiR3sI2PDDnX0g6su6gxoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:JdNTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582743"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000c74cd6b3c75c23249b29a02f62bfecc82e12b54b6ab73078a1735b739088b739000000000e800000000200002000000036394f1356e7e0c7c05f0895babea29d8b1956ec75b914648d49d3ba59d85fcb900000000fc2a3ce0c50aadc6018a182e917a2c1d03c43e55c21c06c83f656415c14d1c71b37b365d64be7d2087ef22a0a13a59eca6c7590314874a4c4f847aabfd13948b17197d2ce0a1477273e94c43bfc6374a169989a7bdbd4d346658ff3fe4d0bbc12ad3b9157c825fc0fb817432807ded58d311734c585672084cb8f3532f1319eb39bb0a0ecd85b5e54546b2adea9ec31400000001892441b2f36856ce0cc1dace3b0eea5389bfcea9091ab098d8eee9109f2b232e10aa3e79cf1f73856765d90040b3958678a0f93628dc0e2048d92017c6fde7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7EDAE81-1893-11EF-805B-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009cb7f9c99f5461f0a13dcff27ad4c1a9bdd0944b005c9199c646cfe46fdc8156000000000e80000000020000200000009e0c4fc64c151d128511e5960256c912209ef2a8d663eb9fae75cdf5f4bb968e2000000013be521bd55c60b99ad0f98f1a0f2bfbac81e35ccdd693f6b2c9250ccf2c39d5400000002fadb597375afbe66f7f811673d6dbf995c3a24a954df62e64932cf80049351349ea66fdec1865b3d40513890335632da1c1799499681bc0fd74259e5ba15a03	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04cc0b3a0acda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2436 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2436 iexplore.exe
2436 iexplore.exe
2356 IEXPLORE.EXE
2356 IEXPLORE.EXE
2356 IEXPLORE.EXE
2356 IEXPLORE.EXE

pid	process
2436	iexplore.exe

pid	process
2436	iexplore.exe
2436	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2436 wrote to memory of 2356	2436	iexplore.exe	IEXPLORE.EXE
PID 2436 wrote to memory of 2356	2436	iexplore.exe	IEXPLORE.EXE
PID 2436 wrote to memory of 2356	2436	iexplore.exe	IEXPLORE.EXE
PID 2436 wrote to memory of 2356	2436	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6903a031ac2e2e9474a8251bcc663c1f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d36832865e0d057395063732ed03325

SHA1
fe6b47d22c772f22799068ceff141e567bca7e0a

SHA256
67ff84061a786511a7cafb8234539beb01a4633755e39b58bdbd4c8fa07bf797

SHA512
846783955e11d41990b22fb59c80de78bd9bd85bce46a275165b84d106a85ac0fca2f3384aae8eb0ac6a21eb2c52b71b4048c5224fc7740836bfd2966a523a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dadd96574e720d08fd9da874dfe626ae

SHA1
013b127d5696e412609cd397d50f21ed73f170bc

SHA256
ad8f9758ca7428e5526683562f82eb1dada52a364a58f4969c8ef69109d1d020

SHA512
9e8f65a91b6cb166429d9783551c03a3a44d2e31ca6afcaa34bdd1b7b883b4df7848e8c03aa39185add7e3f2d1007ef4a65c871c09ed66c23fc44d3210144a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73166518598ff04aaf62824a6b3d92d4

SHA1
25336db4721c0447a6e93341a4b239b1deaf6c2f

SHA256
2326dc53a4084afd1392e55e8376d8a76c6847e80b64e06d8dc861290fea170b

SHA512
d5181374aabfcf4f7071ca4bf2af0bfe670c5cdfbf537cb42db656fd0905ac5496ed70cba5eeabe42c1054123d78c17430252740cc946fb2ee685d6ed2d472aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc9d0a62f007afea3ad6ab243d9bce9e

SHA1
767f67af714957ea60ca3c4c833b5df747aa3b4a

SHA256
6d66381e47b8d279093adf4f7ff55db069af0e4120b8fe1bc7d6e88e281167b3

SHA512
2c44c3228ebd4cf1addc9bd6950af6b335d01674fa3c1e4d9b68f069a4074bbfaf9f4185ffb613b087c28c95fabd1a04228e30bc52f87c111dc386b87fffa15e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f3ec0ac56fb3f01fb2f80f1d1738d3b

SHA1
6f0cfa125dbfdf73cb2855cf267aa249a344cad2

SHA256
28fbc4ded18f72ef94ab370fe51771a1023c6559b400c6f2d6ee9ac9db35e1a7

SHA512
7bbdf6fdc3afdeb51cb53a29825ede0355c60847811256bce0b2040ba2063eb7d9d16b5dbfddaac73b9d1e2fd405cd33cdcca63ba5854af35bce39a9f6f5eabe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3112adc5b32a55dfddd5634b12ab75c

SHA1
fd648c998baeff01649193b4b862578d0573ab70

SHA256
c3632e4f55c05123e183f95dab49d9f9dc972c74a49dd281c063ec43f304ed23

SHA512
57d591dc16a5064f6ab92322f0d0d52af29647bb556232b93b10e27a965b6745293a32170139fcb07511b136a333ec0d38566d37dafa2e70599daa43dceebf02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09cdb1263b89f443b8ac7e068c096e1f

SHA1
45bcf2991e897fda85cba49ec630d925ca31f7a8

SHA256
98559c642d79fefcfc11ade5a58fbf3f140f36246ff22b74c16bf81a573e168c

SHA512
1d8a27cc0afc1dbb4f3c9c2acaf9dd7907d380169d97a982125fba79f66fe0b3f82818e1eafb96f109ddfac11da848086b837eab0b3de631453bf2805b5abfe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
911479d5411283f13dd302a710373cd7

SHA1
6e92b88e9cf25e9e25dcf742234a64bee3b49687

SHA256
0569e1791bfabf0943d7580e971d72daa3786c65322e85f7bd7fc609de5dc540

SHA512
d4815fff64dd293d54b5f07be4cf29311dfeabb54070df9e29dd9e74571c4638625d6b05d2298c3584bf82fd9be5ceb89ca1584ec112734ded944a52f18651c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a074bc098215e498a2c6b73160cd291

SHA1
9087d6847cdb892541e26f0edf9a1d06b8057652

SHA256
c54e317fd606893e1510f9211c188243c96468d011967c95498134b11cc33409

SHA512
3e7280323538491d921b917287eb24c4addecf05ce70af1351253af7d723e815ed989f246957ecb7af13b871137a58c7872d781211254b55c6fbaaa39eef1de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e48b364fd6a460280616c49132f97a7

SHA1
58e751ccc62be213c0d798655a0f07201eb50457

SHA256
be54c9f4ca75fb5a8bb785ae44aa05b15561fec4daed8bfa2075bc16c7384193

SHA512
0146c685c876d4bdc8559b3a9bb04703be524771d6b3841d8727397c011138ffb77fc93f7766d3e0ac13f960a36db953edfcba9888ab996873cad1a1db6d39e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb58a8add4c4756f8811229ec221a122

SHA1
aed5a1a08e19eb7f1bb7762091e34cb61ede08df

SHA256
3b9dcddb5ff1334ce83828a0390a608df593aa0fb25d41420efaa5046e595f63

SHA512
7523c3751a4ddcd7f62dec1471fd53128389688fda7ac01c7a48883c2c9b2f98da8831711e450c9c3079d3e2699aa7fd6713c5d5af01891c08fdf8aa43660551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1220a5607c0b716900d8158b030e3bc

SHA1
a74c806aa1f59d244a64413f668d929b6c83b6c8

SHA256
b371a0fbe75a23588618db96400fb9eec05ca8db89999411077fa274bb372231

SHA512
4a217a659508402a0e8857740cf88556b4a33690f8cebfac1c73268877a884e862dff71029c2e5b3f11384a8ba515a69075af1148a27b7ddc7a33c8c7481dec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f69379aa0da5519a45d0aec2ac59284e

SHA1
e5ea6de77121c5cb3c5e81946d6b2ed68be89b4a

SHA256
c10bb665f7dd6a938b302d9171d216850a7d31dd8a50d821a9227c6f2b99f811

SHA512
d5070456c48b2c0f5fe297d7c32ef5eaf9146213299eae640f6878ed35b71c7ded581276eb4519e497ca0f9ee03d4b9d6f9c00fe056c891c21fe065430313503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f19eef7320b1b62e1ec2e0244ba767fd

SHA1
7080d4c37cffcd34c880af74baf8ecbee8a4f708

SHA256
bbd38ef891e07765b82dd89ec83cba0a477bdeb11f08384e6ed233df79d96471

SHA512
9d6777745f5e86fb855708105233b15a05cb2c00150d96af865c436b51837beeba058e4724dec4b4ca37c0433996b480b71728ee02b21fcbe80d3062c25659b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59d0aa3b1c5c198d3d89225bdf889d67

SHA1
8b93e1729a3900a1e595489fe8c3c3896e7e1181

SHA256
db4805853547ce7e2b82192f340c123913d52f1766b4684d37ee296e39e81aab

SHA512
c3e3a48f1990b22a99dd1102a81ad0e3699f4c870861637ecdbb299e4b438c7d39ab405234c2c386c8613cf93fc1f77339dbb542337bf14be1961962787561f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab698F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69A2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit