0f9927e60bb825b1eb81f2c5a6b60770b8efe48b43250691f8a17f4c6268d630

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6903bc17a78768b9be767db88e8f92e3_JaffaCakes118.html
Size

460KB
MD5

6903bc17a78768b9be767db88e8f92e3
SHA1

b7d5834df314276d826edf5ff4935cc48bfb9b1c
SHA256

0f9927e60bb825b1eb81f2c5a6b60770b8efe48b43250691f8a17f4c6268d630
SHA512

efa02bd909baff458a748a89393d641435dba800d73a54d47ffed1fdb5ab3fb844bdb3dd0ba4c6688ffff1758d9f1bc7295b817d8bb42de1ef12ac867a3ce62b
SSDEEP

6144:S0sMYod+X3oI+YvvsMYod+X3oI+YasMYod+X3oI+YLsMYod+X3oI+YQ:15d+X3hz5d+X3y5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efb6473b65ebd241b671861e2ca19a8600000000020000000000106600000001000020000000774586ef75a05c22546d9a8acdb7fb579527b7183473329a2a6b082cb165dfb2000000000e8000000002000020000000a0985804bb8d8a7a6afdae43c66dd345e4344e04dbb89b4ef369f99ef91b26f520000000135e20f5828a3809cd5816018c83429c04919e5f74d97c1d8f3378046a7dcf894000000034f132c9b177218c06adcde2f01bdc07ce07d97f7019de53cd8388dbb5572dfa4122e5682fd750349990630352ffdfa5bfb1ac498f0c4e05bfba586681a1273a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDE75841-1893-11EF-93CC-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582754"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ba7fb6a0acda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efb6473b65ebd241b671861e2ca19a8600000000020000000000106600000001000020000000d2d7760b9b19acbb3a7eb6d28e3803442469a19112311d91a3c35cdb069c6016000000000e80000000020000200000001586f07ae622dac8a731328c87a34920b259d1e3f44f2bddffa52a4d0fe9c88590000000d903a519e9adb3c00cd52e2a6ed324f84ff9d0e8568cd1e24dd6b05301217713175c94b28a19ed02d2478d9d4ad477410f67bc6001d58089a5deca556e789ded55dcec48e0244263bf200d707e831a3f945d8b18bd4ed1994ccc9dd9192b0a8066c02e7fa20e677011c55c196b2234b5e3be7c3fd816aef62ee483cd30e9558cded288346d6a6cec6a1b72687d960de040000000197730010418bbf412c596aa1059813dc3b9094db6902ef1be70db325312082d608a279bb85f29de4ea79b86b85a3ffd40ba684d7b105c7ca5d5eaebc765a3c8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

360 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

360 iexplore.exe
360 iexplore.exe
1680 IEXPLORE.EXE
1680 IEXPLORE.EXE
1680 IEXPLORE.EXE
1680 IEXPLORE.EXE

pid	process
360	iexplore.exe

pid	process
360	iexplore.exe
360	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 360 wrote to memory of 1680	360	iexplore.exe	IEXPLORE.EXE
PID 360 wrote to memory of 1680	360	iexplore.exe	IEXPLORE.EXE
PID 360 wrote to memory of 1680	360	iexplore.exe	IEXPLORE.EXE
PID 360 wrote to memory of 1680	360	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6903bc17a78768b9be767db88e8f92e3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:360

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:360 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d033cd763599228b99978cf7bd484fb2

SHA1
c5f7ef9ef73b9cdeaed78feb139eaa05367a1c1c

SHA256
4cee56e4868bbcd879ce5dc8ea8f7e18f9bbc76ebb23f6b03c97e27678c145dc

SHA512
a437b454cb10e4169ec3f9948557f93e2cf0485ee5ade2191f1f68979616ec8d7c42e2efa3b2d4a1c6609a48e08b14f879b79b4df596cd99b3eb5881789de833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785fca98396ae679b04301dce58343c1

SHA1
022b6484fec7996ea73f7c6fd05c359e5e638110

SHA256
98560f72562e08cdffb1c0239b561d43302aa70a613da8349263cf86ccbdf2ba

SHA512
4ee655b8386bc2fff03376e0d3f7e0f16d24c403dbfda2e340b7f251390e656c5b0326f98d79181446ce340fda9cb7947e9931b0f19fbe24d7876dbbf29d81f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d347cffbc99bc87559792268e44b1f6

SHA1
45ffd4116378e878f6a56b4abf1e472c43f89f90

SHA256
6f7ee278bf0a18bdb328b4a39e4ca4d287d0957acde57abf327f7983d0ddd0c3

SHA512
f18db17f4cc3b49db70a0ab53d993f9d54ab30dda03cd09e0aca19ede5a5733a68e941dd6972da11d7d57732f7d26192b530cc5bae27c39bcf9a27bbba87bcc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f48228472ff2a6c63311f9f921b156fa

SHA1
f1ef29197a25b413ad4601800c04d65a33e8a99a

SHA256
2de81b3301d29bc0a9834574b9c238b5285421cf8ebf6a5c378dcaaeec49ad01

SHA512
e21084155a2f0903b64605b44976f922ea7bcb68c6c94272c90fa03ce5d51779a92f28aeebda403195c77aa94f8a6d7ded0069e3f045085938372af18530f92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef3ee015aa26db16cd6abbe64f8c3da9

SHA1
949e5ce5f13d4cb86617cf13bdc19bae16501b9f

SHA256
63b3f959617dd971156ab83f02c864cfc1bf5b288969e546f96763e73b63ff85

SHA512
6a74b08a92fb84527d14463c648bb46b086d9e20afdaadad3f14ead3c123307d876ec571069eaf1c53614a932f9c3728efa2505ac13331d474ca2b4811db8183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5371b86116f4cb42e0cb99b83c9b731f

SHA1
467fbaa38731bf7c124894b9a6f519dd3b4b63f5

SHA256
cee9922e3c1e0e59d98c5216c97b579887c90e5c69ca64df52ae04a889bf4e66

SHA512
6e0f782e86b782c3ab88cee01345cf220af006d47eb0b3f93fb797310ccbc7f8848e89ab879ee81cf78fad507abf3f486bb9189e6183caba8d6be66632b24adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b48eb462e4178c8a58ee0782d9909e46

SHA1
381936c6f1cdce6587e1522ad3270e708dbf1a1e

SHA256
29bc0d33229be988ab3f30cb996b3eea9602e8b9fb8600cbccf34d9679e98dd9

SHA512
f5073f26f063782f28fd4d79d8f07349625a27c83ddc6c35fad5f399bb4b32ee551a7c5b81d95b4ce0e88fd0cbe3bd2dcbf764f5f72f6b99ca6b4d3fa451be06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d51f27ed27d9b983b7b30dc219d9accb

SHA1
91143d1661952451728c709f2499f4085da119ef

SHA256
3b5d5d367315c00b7d4f69a892e80957411f23fcc6c83dc1022a35f980b69d87

SHA512
ea0767d342d447103976cc5189019d1f5295c1cfe7471b5fd4bc3335d050acac18de6e1bd98451a923ccd25cf5155ef435da56b4363fe4e4746403f7afc03acd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca101c3e8b5343c8798e387435c5232e

SHA1
8fc3c1759a7f2b72dcc8b90a2d01e388b8ff3806

SHA256
71cec764488b1493c75d3010f27b2fad6981e3dac18de6edd0911934118e0755

SHA512
6bd284d55c5334e937230aaac2b4000af7578c5bceabe922e505ec4b479e5fdda652dada6967b728568a454104a640150914812f2d68f03c15fe6df8c37fb7ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1625b0f0ee1c609ee65d3362892c440

SHA1
9f2280b6103e235fe35593bce559d5d864e0dfc8

SHA256
20643b404dcb46a254682d8da7419b5204ad2dc3cd34cd225e1f74fd33ddad73

SHA512
de79c15b95eebaa008a59b1afcf79f2a4f562525b16f7f382f70787224e7f5323d61defd61606b06de133b821f4e1d0fea972edf0ceaca0b6e8a60b5a2e605f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acc1e6a70dc9722cbf99027e6141b251

SHA1
7f348ff5a508025a20ac1684700e7df42a61ce87

SHA256
1a0c877f819fc67f36b5fa02f32db1cc79a3839d38948d3374d8634c0833a364

SHA512
c54bf5d4df735151dad69cfd41bf612aedfe2a8d991b4b182f9433ea90307aeec47253c3f108c2308304f768caed628b7286e9b742d46b3150d7c8d60ff01679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ea4379cd92c6901012605feddd24b1f

SHA1
70416e137488a7a3bab4c78b4e716bd65e635bf2

SHA256
4692848830e820379c7308f0e6328ace940d7d4740b3a656a357ad5eb2f0cbc7

SHA512
3c4565d0bc5a359823305d8b0bb458e554ec5fdffa62b1b89cf3d0dba483e809514d7837913ab469e8dd270307098ce2a9a40fa8bfbbc57b54249dac6efe989c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1746f4b24b70f434d7a751e2d48dcf4

SHA1
bdcad02084f53f22e542906d15fb0410f45076ca

SHA256
53208cca1fd6866b55a0d2c75f118b0c08692598aedd554dd3b0c4cb2b841358

SHA512
4a9ed95fcf0e7267f2441d905f89245ea7c0f7eafabdd4a229b376d6599eaa499652fef7d4f78913b1e65b4b06330fa8519b477c0f726bf22207997d54f873b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c84336b7a3f4c821f530f8e78b17e968

SHA1
80cbf8f01cf394707f78a444c4a380640f5d8940

SHA256
3a1d18e303b960323f975dca54d57b8e9a5db5c50226e85ae6db26be1f46fa7d

SHA512
0c818d15ece8a42875cc87b40224ab3645facfdb277e74dcd43418cf631134a88eec49122a0a05ac354d475a04e97e11822e4dc91b464196ba75e7d3f0b44ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F02.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit