89bed94f06abbf679e5fd9b899403c6c87096c45734ddc171a2f993daf100731

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

657b23f32fc6f4a293a044d9d6d6238b_JaffaCakes118.html
Size

26KB
MD5

657b23f32fc6f4a293a044d9d6d6238b
SHA1

a01126f849a7db6470c03bac3b2fb32486e92d66
SHA256

89bed94f06abbf679e5fd9b899403c6c87096c45734ddc171a2f993daf100731
SHA512

004010db9263fda0f71f34c5c65963d9d046cc763dc6f9852e2ef64d1dd76db6a56ee68d206d33703a6afab50017e826d9f9d305e81528d067a34319c024d704
SSDEEP

192:uqEXDib5nYzanQjxn5Q/PnQiemNnmnQOkEntNlnQTbnpnQkCJVevo7NtpFo+NzQh:nczQ/DygcKQg7F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dffb12e452fce54fb53e8c9fb036a99200000000020000000000106600000001000020000000b05b50c27a49cd7794ca122312cc0f1229aa3a9aec13dd9f85b4bdb9537cd84f000000000e8000000002000020000000ff7b6da5fb8b2bba60c237e22882156e02c3acc3da79454774477834ded67f839000000042bcbd7f5bc081d5acdf5d5ce226684de27b0fab218e2c73e5f2eb11f1dfb11a9ce27c2bcadc211cf601ab09b3ba1b979293deeb71811787d38e22bbe9c136c80742a3da2eb8a39e6cbdff604bda9dc9b368bbe14fefce49b2d4efd430f180989c0187cd9b33749a67e18388475935c11ded4624ef9a16d9ed932b0d094edd7ddcc2d36e599e2adfdaf01ffc89432487400000002cf291be0280d297606266c2116c1505f5b744900c00420df5cb1308ee9a415c3dfc392deac7fbd890fb3046395a9d0c0d48675c3044f61cf0535618b306f54b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422502335"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dffb12e452fce54fb53e8c9fb036a99200000000020000000000106600000001000020000000a7a6825a9345746e9b2745ab4d406df93fa1c6634049b84e1c02ee99dc3ecca4000000000e8000000002000020000000daf85547d587f1fd95bce48773dff209ab0561ffc348d6787457d50284bbaeda20000000bfa0844eaf6e6b0a13605485c6b6be60314cddfeb3da4d918f4adb8038e84b6640000000cc5ba16a8ea0927c00846696f99d047803ad9e9493fdc8466a843b276974b648bc082b7650643d78c0c95c6c994178faff2a4fa2a2d408ba3ea1d66336f0c0eb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2334AE1-17D8-11EF-A01B-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7039db76e5abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2276 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2276 iexplore.exe
2276 iexplore.exe
2984 IEXPLORE.EXE
2984 IEXPLORE.EXE
2984 IEXPLORE.EXE
2984 IEXPLORE.EXE

pid	process
2276	iexplore.exe

pid	process
2276	iexplore.exe
2276	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2276 wrote to memory of 2984	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 2984	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 2984	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 2984	2276	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\657b23f32fc6f4a293a044d9d6d6238b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b17fed1079f41dbcf912922e5bfa96c2

SHA1
3826f8bc66c130dfd198440141ef5a1d15f2fea0

SHA256
0356e46d50929a2bac8c891054719400bd81c03ae392bd6ce51b96cd01329b23

SHA512
40fc8a10015247a81cf7574d6db3ffc597234a31512f74c3cdc6d87664a604e4daec1d4f2beea0e2a073e70ec0b0170dba5ab03dbb25a65d279e9c19aebaee2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8a81d517d54f67e2c5819aa7af037013

SHA1
2146ededf7c234849d931f6b1cc29d84f2b29a6e

SHA256
c6799df4f0543bb97d26542b3ad8f4dc28e433bfdef22e7983e9d9f80d43a96b

SHA512
f8bb3070ef16f5dc5b700bc707c818e5ebc48731325c45eeb5859b6cb7d80aef9ae4fb0ce20b2a9cd3981adf5f3ae4484fa0d723a31c6075f1fe5a5f06f49d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2254af1753be49b68604b085f3d4c958

SHA1
c07a5957dccdf3ae1da0c505e4df4f84403ea393

SHA256
d90ef0f6b1d239926b68484bf162e20bdc59a7bd9ef0bbd5f562f56f4e67063c

SHA512
8e110748bd5ddff3f314e2ccd759a4b28ffb7649a13d2556d5933da17429bc53e1a350fb86b28a68c5874b7ff96e928cdcc99a782dcf763e66865d5e7bb6d83e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5f260d86c7567eeed89d732e3bec3bfb

SHA1
a47b828f1b84ca2210b29f3a7e2a17b5e5224a7a

SHA256
31afbfb7e5e525c35f2751b47179705879efdc12b83c2462fd9327013df81aae

SHA512
fb3d9cfca96cf7c2854b85ab4d0124132ae8c8afe52b867d1c4787980206888cac9776caf78648be0a56ff218f439d79ea332b02942c94228d66e1d13e788e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2368dc49ba1ec0693662e349ba75322f

SHA1
3434557e763424ad65f64864a2ac307e216fe8d9

SHA256
a85f9409545a79cde87e72e22f05e179e8bc3b6c89f090df7c71c3425b7a9101

SHA512
ad081eabb3d87a76e78ab0cbc94d986387a560a6a1e818227b5deee0cd903167631632bb4e2876bcb5b01e3ef00450e9d7f11f44641b5dfacd92d60f81442d12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ec717be04984f9e3e4c2f57d62fb5b80

SHA1
5357eb9acbcfbf5aa329bcaed874c033d6171f5d

SHA256
96c3e2d3cb24792052b4d5dd3c18a4d47ce587396ff0fcd55a08fa2202bedbba

SHA512
9b03595ad358424dc8c3526524b5de68763ee59d3109d7d84aff5bf715281bc4e7b70417bb50b6150bff069a0dff46ad04cb04779c74b1a5b98341d52548290e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d0b2abe4c05b5a217df85fe4aa0c4bde

SHA1
6157f292d9f8828fa88f38cd93a5d0d4bad5cc2a

SHA256
b4c5111296f8245fab996e9c15e0521473491082164b7228ccf64a782c331bd7

SHA512
926df5b442d0d87b1b25ec038e0209a34979681c32e3dadb6badaddd001e5daa766bc82aa2415c2e214c17f9558d7378d674f8bce5a8997d8ec468fae349fc58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5ed0d6d2c26d3454a303d4d138a2045d

SHA1
2a37bd66866bd809e4a9a58fdf563ff7bfdf742d

SHA256
d0ae3052407f261533ae8052ccfff9b0c6d2c98d69b25c002a4c4727d84267a2

SHA512
ffd5f78a35152b0fc45e430ec8ee1eb57897b4b6fe53b9b9c44f674614b6f5fb1051ac3b1c202c19bd783be106e6b9ba27538d19b305c4f162ec94d59b384422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d33dca682adc77d218436d8efcdf158e

SHA1
4cc7665f81cf9e559af0a99f55894e23f12a383b

SHA256
745e4564d089233966e70184a3b35e8ed62b9573d488473de8f2960c34242528

SHA512
a98221c4091883fb053e96ef432d77be5fe60502060a2e369bf8264e92fec6a2ba935b635339d11c3babb377c44abc6d76aa17d7b4592ee8348a6709b6782c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ad51f465ff1adbc2d535cfc819ebb625

SHA1
0e3340e8f8c9982e337ebe3358b1948b35e9e127

SHA256
6abfccbaf85d02e9241462227bcbc7a4f830faf938f0763932d146fd4161cb62

SHA512
5beddb14935311201cfa66e78d754216ca3cc54f97b9647c0857ea49cb98fe62f40b220e794dea7d0e8df6c03ec078a2c8f68e56162e8229ef0111e5715947f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2204.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2344.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit