0542e071e1aff09c95a02a1f6a21437ce79a3087942758428feaa7b88340e395

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6904790f05236e1df3dd9a19c401a4d6_JaffaCakes118.html
Size

671B
MD5

6904790f05236e1df3dd9a19c401a4d6
SHA1

d5b9041cba8d6be84052fbe8c97a0df62dc34fc8
SHA256

0542e071e1aff09c95a02a1f6a21437ce79a3087942758428feaa7b88340e395
SHA512

b8e82cefd91b8259da68ceefcd7a61fe764ca6cea32991dfa0dc84f75fcb5c0f36539192e00d879614021430643a88436f1c2ad3c1fdb07ac25b00f7478052ba

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000061afe4407de6d2690874f62e21e425fb06004bae77803f9bb4f2b1df49bfb70e000000000e800000000200002000000093100d1c45dc6e89120db3ec5fb85a833b9bebe429185ab639f2602100d4e9aa90000000dc831597dd1be46c2f55f442031290aeef100998528ccd9bcedf939a7cb97709eb402e2fc9acf49e07633e0742da646d84a623876d524992a47d46859b48598c31e0dd94eeeafbc8ec1a1938e8ab07ba7ca12f6ed1807c39c6975288e62218cb488a3d83ac4988d0dba14c47891a0ab79dafae9786bdf04fe1e06e3349f22532f57eefe14bce47081ba4a351ce7aa38f400000009ce3945d216876b31a88a68340a5947eaabeaaf0744e2e8873f083cd13969dd968bb86765a44966e8801ec191d4fdbec88f5e1cb433db3076a1158fd362ec559	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582864"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000753304338edc5cd10d29145dcd3ce794cccdc1bdcdb2a32e9ca9bbce2f7b5648000000000e8000000002000020000000c8a01de6ea1c4c33b65adf3912eccb1b8e4aeeb8b474ead834181b966d2ce1c2200000002c8f456fafd83e60821c482054208a9a5abfc91c4079e128f6164cac9e68de40400000006ae2b18ac88b8d721f0385b07ee79eef3cd36f72bc7a07e0b6057693f9422d768f5d73ad4aec191ca9c900bdc6e0f3c3a88f55e5542949b662356dc4d60229dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21CD6CC1-1894-11EF-B195-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904c3ce5a0acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

620 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

620 iexplore.exe
620 iexplore.exe
1964 IEXPLORE.EXE
1964 IEXPLORE.EXE
1964 IEXPLORE.EXE
1964 IEXPLORE.EXE

pid	process
620	iexplore.exe

pid	process
620	iexplore.exe
620	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 620 wrote to memory of 1964	620	iexplore.exe	IEXPLORE.EXE
PID 620 wrote to memory of 1964	620	iexplore.exe	IEXPLORE.EXE
PID 620 wrote to memory of 1964	620	iexplore.exe	IEXPLORE.EXE
PID 620 wrote to memory of 1964	620	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6904790f05236e1df3dd9a19c401a4d6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:620 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d2c8b46eb5cfd6f255b30fc5f2418761

SHA1
9464f38e5177ec131ad033bff9db167e53535990

SHA256
bd32c703158d66e3b0053a760b7c6d6c115ef03c8ce357e4aa45c3811710ab53

SHA512
3fd8ccac679311e8ff6d407e91e72c0a0e3a6a7beaa91a3ac4d91967f5d8abe5fdec6494cef43f974290d58e10ee7a97291433320c88acdaf21d660dd044d4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1163397d580e6e90972182e52ca941be

SHA1
a0b1d4fa663bfd5fa032f59e26b616d4a6ccb0d2

SHA256
ae2f65d2f8bd8997e6ae921d5b9d26d6dadd20fec89367f582007a8bc14baba1

SHA512
ef760f4a4157e1306f659cce9eb3585f550631ba71e0632193b72f49c9931fc2b1dde87a58ff5f73f80ad1a219a01459fcd1b06f6bf3f35bc3c9b1d95b950dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
72e14a0bc8941b687fc0eefd95e2f260

SHA1
2f8ba0961fcc2a18dc48963f492904d80da99755

SHA256
25f2f736ed6b18b2135332a2195244399cbf167b6c1266881c9ecf0a3678f71c

SHA512
ced8479ad9f88001f4c017014106c4d8d29a087af921b240462333b1faf8db7833dbb6952b93b7058ed622f7c2db0547478c622ea5e19cda9c34f94dd83808e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3b6dd077daca3dd026bdcc3b34c59bd3

SHA1
d2e860012da4736634589eef15a0715ec363676c

SHA256
63530bbbc6a241e968f51068b6e0e4cc439ff16bb61df4bc20f1358adfd53a19

SHA512
0f2a606ffd8e19c7d2a5e848a011a01ee53601d064bec3d74f00e164beb2abfed86b23e02ec0e4849f3aa96beea3ecfcfede6386ce8b3f053c2989e089c60de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
045feb714f3c482ed546870760dff44e

SHA1
7a357e3ff216ba25cbed50f9befdfd6e06c71b89

SHA256
a19b75438b2b1b8981a2f08c20d808e822aa25834d705866b35e63066d2e386c

SHA512
4fd0c7ad7c5dd8f466ce7e3b080054973cf5f3324176a62332835195162177c83789ec3d3ea4d8af0fdaab2aa36ba6f401206309ef2f96caecfe9c5ee52d3426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5bf51c414aa9624de49104ca2c25f8e0

SHA1
4b7146dfa09069f97bb8c4b4812cd8cea53361be

SHA256
846724cfba689301415b11fae4b4f215045756d5fdb14c4aecc40020bb738fce

SHA512
808503d5661f067bcbd2eadede03c589d95de1b47a89176c20b3c4e4d51e9d188d38cf1f4fc9d9c5d621bbda018747ca518d1307c6259b2031f6ae841a4e5177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2476fb8386877e22dc4dfa8edb5e5a94

SHA1
d199f3462c08e58372295683c85a417a162c0f4b

SHA256
2947bc026ff3bf5411fd7d528dd85cdf4bdc8aef35bc6c049ba37c7e8b544d93

SHA512
83b0081f636abd95705fbdb339f1e5bd9689c676ac71c0713d3ce26b27d11e083d09c392cd13a88463e804c04861aeeaadd47627d4015cd58d02394ff5f068af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5d9e9b5ee81cb62662d890e339eeb497

SHA1
909557a28d181836a584824074a823ec3dfb45c3

SHA256
a8065a48dd8340dcae59adc2465acab51fe3908a4d5385084c38422665f048a0

SHA512
7e1d480adc5af22c5fe13d3e5dfa4cefb878d1780ffa4f31b5cac090f69c97222f544744ae5eff090e2c8c7ac59ebb8fc85510c0dee55475850dcac0375ca512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7dbbf9f3270562fb6c17c1742bed6a31

SHA1
6e1ea836668e1caa7e01a42dd8da8125265e09ff

SHA256
0c806846880cdad0452588ecaf8ac475e53da6d6049c20ab50d707488247df95

SHA512
183ef8555b21757c6ddcd02e0d84cbc066bb6dff53793167f1e33d2dd64b3ef33deca57d77b55874815a44afb6d9feaf28dfcb03c601a08df4b8c8ff958bcc98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f06b6a06df3da0a0aa71f16d991bf9aa

SHA1
68c21c533574be3b6424218b18e238af5a411c8c

SHA256
17019b01ad3824c59ccae6073760ac4d85f75b032ebc05dd9545b037a4e06a59

SHA512
f340866b6111bb99b3f3b375652d5aed81d91d835efce0cabbd668fb491368567ba65ef5f9cb133e62a3355bc5dd8e71b55548c2172d987b2a23a36cfe6c010e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
55591603ad126b9a006c847ed4732e79

SHA1
8f470a9a4ddf9392b56c56b0c2836312155f70db

SHA256
b69edd2ae77531d7c6aa7a9f618b8c88019ad7d1c289afbe0cef086bac327f1a

SHA512
974e9b6d836c92ce61e9f4a8f9e79f4d4beaa0a62e8c8485db3c388f6407c015d6fd89299dcf1216ee8df790adf3ba299ac77ea4b473894d810d437fbc773fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab393B.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar39CC.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit