6df407bc0d9309955f73a49495e0cdc02701497ce789be7a0d017511e04e0b7e

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

690411f7cab6ed79525bd5b50ae066a4_JaffaCakes118.html
Size

460KB
MD5

690411f7cab6ed79525bd5b50ae066a4
SHA1

bff31c94d41b293ec741f584d50ad84b55b3408d
SHA256

6df407bc0d9309955f73a49495e0cdc02701497ce789be7a0d017511e04e0b7e
SHA512

3b2de6b89d123c66537b51e0c5ed39384c08e1355ea99450ea0782ef66a5fbf8e437a122cee31a7c2a02076c48218c497563d61d952dcb3081844b599128c185
SSDEEP

6144:SWJsMYod+X3oI+YylsMYod+X3oI+YZsMYod+X3oI+YLsMYod+X3oI+YQ:dV5d+X38R5d+X3f5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582808"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112420076cab33498416300ccd3ca71c00000000020000000000106600000001000020000000f2746b354c5dd3ff35caaa36af2996ef54baecc72dffbd857e1622645a05ae6d000000000e80000000020000200000001970a7400de6932f406586bea664694e3885d67e6b926c819e919a7a39221205900000007019ca4d040cc4b5605d665429d76a325017aa18a799217662ac47d8dfeb8f8406ea06bbb71be57d30c99c35304bd6c4d753947350bfcb32346e60ef5eb51b56aee6817b588afdef79e0f0d1d23d0f1a89c3f6e890fc930663fb5932b507069adf8e09767240b08aefac25f3ef640ddd4b02b6717c46378571507bf0353fa1d46ac62afedf97474eb339b4f9e5ca63584000000082867f33d85c926835f130dfbeea90148d10a983c7c31a150dde59186907c742be993256354b522c47d41aa1e1ec263a2d6b626b02f289f6da7da17a1b457a04	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFDBC211-1893-11EF-A965-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112420076cab33498416300ccd3ca71c00000000020000000000106600000001000020000000a65dcb2129e81c6c7fdd2d1033852e24ddf75fe8a90fb09e79b57e63b9ac5cce000000000e8000000002000020000000103002a3cf3668b0f503d726938cee1ca6218890fae2fef4ef1664dd084e850d20000000eb93f4da6b3cb0f16599a3da3a1421cc92b9235a77b85d5f0ef93d49c6a15f5b40000000a512a4578c4b6cc27bd41ddf6c5ca5ae6a36fae32e3412b6976b8be223b6c8c131a60d4bdb12a4126235bd5d93b9de2234f115bb190e51145a475ec2f964bf9a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106367d8a0acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2868 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2868 iexplore.exe
2868 iexplore.exe
2940 IEXPLORE.EXE
2940 IEXPLORE.EXE
2940 IEXPLORE.EXE
2940 IEXPLORE.EXE

pid	process
2868	iexplore.exe

pid	process
2868	iexplore.exe
2868	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2868 wrote to memory of 2940	2868	iexplore.exe	IEXPLORE.EXE
PID 2868 wrote to memory of 2940	2868	iexplore.exe	IEXPLORE.EXE
PID 2868 wrote to memory of 2940	2868	iexplore.exe	IEXPLORE.EXE
PID 2868 wrote to memory of 2940	2868	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\690411f7cab6ed79525bd5b50ae066a4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2940

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
79807d9d5dc83161c4040ebb66e936cb

SHA1
ad464d13b4bdded8cd13038dc8435cd2e1f9f4db

SHA256
9b83f5ae5f36232c02ed5827182cdc55d28c94e2a673e42d1159e47d17a6f65a

SHA512
d4d53b632c5a276cc6a964add0b09357ec20b0ccec5e260f29d96e84bbab7e74b590575f28e86b2c58872146e9173aff9777536590d507c8a65c2086e87a9da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1b69898585face3b40ce4de535674477

SHA1
629c3507913f623e08b2a744075dcb3fea594e62

SHA256
358062cdc87b822fe309ba8fa150a3751da84600ed8939cf37504ff974c47fc4

SHA512
bf19325f3bb6602942c21d77606f9e6e16c608c457742b28e13aa7c909505235ccbe54dc5b1381587f325b31af94fa3883b0f4f2601dc9e1938e8d60ff93847a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
88fcf71d0ea9ecba53e4dda49e9ff435

SHA1
90053154a5f8e37a5471fc5cdae0b89745d850df

SHA256
d21c25a2f2264335ff427c376047c2d9dce832e8b01c5b2e72b89fa1b72729f1

SHA512
f912108dd986b997fe9cdf709719b47db4f75ad3806095eb466f92618f3ea25dc8aeea2b4068ba66746c037c3ba501aa41676f1c9ea5e14cb0c29277178e5285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
161f6dd571dff0f95fa9b6b37df64b4c

SHA1
9c43670fee21ff1d921f1fc994a65fe1f76762f6

SHA256
de2682ce3de7e8c3074371b2907a20ddd11a0f5e5fbb351bed9e173d8b5b9e4d

SHA512
2c2eb134854ece21d01a8780ecbeb6d0f18564b02a4c1589708103cea6aeea27210210614c9bfd720d70e1fb7c0deab6b006af1ed47b12bc1b50ec0d7c0dca8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
697752b9c425b19e2e2f904edfb0f2d0

SHA1
1f2071c2b55ce412c8c30c21fb96b61dfab390a5

SHA256
6255a837be920299adb6ee80e09f0e14b978315592ff854c8a2d4aa55d11d06f

SHA512
2357bd29ab6505daa29dcf832e9dc42d7ae4300dd27b98fbf115a2bf9bbb562c9f5a2627a774b003e274f0aec7875498ee94b8af68d73ba94d52696394f7f6e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8177895d39c4ab3152ad0e8297d8d9f6

SHA1
458979664def8464cd27eaad6a21068245908788

SHA256
54e470a651b966e1b9b2a3f141c695b3eed265161f0b86ba0816c7c426313241

SHA512
8b935d56c9f56770772d93580a6f29cf4442d2cac63d15b658df2d617bc759328562466eaa47b4f4a9503d2e11dc338a5040c2e8b1b86c4604e1ccafb069030d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7c3dd213614aaf18b0742bfe938d7858

SHA1
89c73f00db156792ce48aacfb9d7e698253e7caa

SHA256
c52c5351c68b15d28c62279a2eb9eb6e8aceb534ec99bfacfdc7b75e0c780028

SHA512
4f2401a49f35a1985be63328fef2c791e0e93af2d2e8cf10fbb1ddbefaf09612c63b052450324dbd7117c2283bdd04ba094a7e887c6c4d9cbb23a0a58bb854da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a38e559ca67554366300da0675332df5

SHA1
23f6eae620d501dd03ed4f8475560705eab16c8f

SHA256
a8eb0fe1aaf28f9fdf585db3665cdf8c1e93fee8cd9c21d44bed9cfee419a698

SHA512
3dc9a6a69f1449f3a979901902320b8566b00b34a79b054ee5c568104c8349872e5fa069a3d2c1581370da2030cd4ab901994b4688eda1069a008a905e13ca16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d9ea7d9769bd455110f54fe2a0eb8fe8

SHA1
8fdfcbc825fdcd595bd32a7734fcb4dd20e2f300

SHA256
7903c3c81da3914d7ca7c04ca629370264fcc42a60db94fcd04d0cf7a436398a

SHA512
30f4ceb2dba06c681c6c447ae383d6c66ad7355e7981bf13e41a72524dc8ee98575e5766ae0b94831a44ff630fca8782c9a46f6c24aadd74c7baef0c7424b808

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6466.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit