d07ec8f1eb1ffdbc3306acee6b384077d1edafa1f5cf60255a6c3695e3e3368e

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65879951303b833fe825c4d1f240aa73_JaffaCakes118.html
Size

437B
MD5

65879951303b833fe825c4d1f240aa73
SHA1

e8f5ad11812aba7ecf60113fc4fa4f36168b41a6
SHA256

d07ec8f1eb1ffdbc3306acee6b384077d1edafa1f5cf60255a6c3695e3e3368e
SHA512

c217ef9c96580ed477995c9e7e8a7659849cd9f99ed6d46b1c9779abcf528c7f1e53d1e2cd6a21890f7437cfd27718f7ca1adf0586a8f1d1f2a2dc116367934d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422503315"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005d9727fe6fdb1f643f3ed949fd7fed7e07f5e714216c0e7aeeb46170c9e0a04f000000000e800000000200002000000097e4af18fd9d2b913462667ee0a067a7cbde39cd9c9e72dbb7f773f29b10db2490000000b416e140e146a063f979f2a8e230f59f0c255c8592f56403b7559c6986f02ca4061f0db9e4fcf89b1d844dabaa8557c9450ca2b25b4765d46bd73551c2c8eb3defba09a06b72881facc6a03432cb7ded6406320adf74616f7c42e9365d2d56851b6a240d3f80f8e58bd2527a1891dd1ed33a18345bebcf849e5de90b0876b9b44aac16a8927ba96316021b9e80ff188a400000000b45c1aa0980f6bfdb52ccb0685b10da3f0069cc3286937de193cb0a70cdb5a0ab2f1743cf3ffe9d49da8fddf8103d0a12d3ae96962f298bc0f5307c495dec91	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006ae60133ed3f9db26b4ba6cb731cb501a26de514d79e5a631fd4d6f6cf3c6535000000000e800000000200002000000097ff02609a6f4f733104b1b535e90d0d9a1b7b5be42a185167e21ff3fcae1756200000008422c82495f961158e1c2a7e437d43864525716296f16750b3d0a18b00242cb1400000008e1fbe0ec36789a3b650ba4f4e68e5451737d6dd994660af84ec56272fdae508c0cad6be329b253913748d0ac59baa93d1ad616d637affcd8f0bbfa52a65fd0d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701a6ebfe7abda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAEFC451-17DA-11EF-84D8-C2F93164A635} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2032 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2032 iexplore.exe
2032 iexplore.exe
2256 IEXPLORE.EXE
2256 IEXPLORE.EXE
2256 IEXPLORE.EXE
2256 IEXPLORE.EXE

pid	process
2032	iexplore.exe

pid	process
2032	iexplore.exe
2032	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2032 wrote to memory of 2256	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 2256	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 2256	2032	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 2256	2032	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65879951303b833fe825c4d1f240aa73_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10cc59d57aa22a3b6065c0fdfd04d1ca

SHA1
f7f9029942933cb3f63c87b1947940a59a92905f

SHA256
35416c084da6d1e24496248ff680ea95e971adf1ae6dd7f81c0dadd99f8a8a33

SHA512
f9bbd7638723bdf37f6f7c3996044bbff91aae2085aef58570e91dfa9f725fb6c2bc121ad28effd2d2548a018d90ff7a520d76e2164d31bcf5e846f8d57c74fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f039f9603d23da691dfb01e2163b306

SHA1
1cba3e253e54cf7d359edb6dbd57d5f79afd26fc

SHA256
45f01192de0bed8621e2f9f71aa178ab3306c61f22d3e79ab21d535cd338bfa0

SHA512
006beb9c2419cee4b90462456c151e48e3a2f343aa914703a06d7ac633e383e88f3f55c751d2c187fb30f1e7561a361661e36ffde3f1977df978b963268c03c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f259a819cd4687be9babf1ddd5dee674

SHA1
3432a5548cb6de50da070fc8b8d4bc797c46d400

SHA256
f5e192c49a4d86e7381a13cce6c37e3539cb94111c66100f28ceccaa0313912d

SHA512
d26afc3759e64cebe622d1cc05f1025f7e3c190bf4d011078ba75fec928038262dc203072d1e3b37438380edf8961e636ee02a50c30f6211e94e801dc0d00c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df0f42e4518c8c3393041ff1c1c9369f

SHA1
f807ef6465f5b8c76eafeb8243c289d87d12ecc3

SHA256
aac6a5913bcf9500f532a6ec85bde0f4f16b3fb0c6f143806bea40718d6cf36b

SHA512
4275253af2a3eee6a19dfb6fc37c51cfefcb787300c138432200cb408e2779a788762c650c00d4b6427877371ee6f0a0bdd5aeb7ba6abe6cead64a392a80c0db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be96581eb88ce0849c73a5b4d9649d8

SHA1
da200ed01d986cef5ece083f0ac52dd1f90174cc

SHA256
b586ade87dac8b3364005b91b0f5fd754a6649ca74431e91b531784facce9bbb

SHA512
e2dbc1c5b98bcdd7c8be1969e3feb544b4e817512aee6736121c7440499dcf9e85272b282f6aa70b3bab1b390f9b1bb64101e89fbd117a45f1d8161e2939ba56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be1538d2ab6749cfd4bb5d45d437f1bb

SHA1
bfe6016bbf6ac3a8f408f6dc14ee868cf00f672b

SHA256
bb901c21218a908062305fb60c688656dab83b13a982c339c19a3fbf73528614

SHA512
f07a03d6601c24d78d4f002115d2e7432ea061511303109dcaf1a957921c2e5fde395d7e0bbe1d2f6b291b55fa1355dd594c3b0bb81563cdeebf8065fdd52ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57a9710a000d527113cf4ab8474f52ad

SHA1
060d25df882cd233a5db6bcaf9608ee5539a57bc

SHA256
383c2830d4d263df93b22db277baba830f88f08f5047cec1f2589530ffa78b76

SHA512
8126923b39087e074124ccb11d62a38dc88851e4fd7c32cb5b7e09bc814897b0d6577f48985ea50efab5d9a8b9b15203f29e5f777d356a158b949c1deb2c5a96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
621865e4b7b91e358f821354f1ead658

SHA1
76616fe63287952bf07381eda41c64233e9cbe48

SHA256
55a249f814b0e61447e1ade3c15dde1c0fa132042f5f270ddb269f1886864aec

SHA512
92b6cf9ac6632af659e1ad85084245f5104988f7b4a0768958a131754b0e1f089f9465afe3f2a18e10a5a8fc636f9ddd2d2bc71cf35e443b276d6b59d0fb8371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4923a3332e92e0f044c4619a060308de

SHA1
c4bdddb91d1b6daf9926db69dbac2d12aeb8025e

SHA256
acb280879e0b403cf22dc56816ec75c1294d85ef90a2845c9460c23c03214ef0

SHA512
d3c113f8850f6a4917bba56ebf493dd012e16f38137fec85f4b3965f47acf7ef6dcd878c5fe815864f17ae7a403dbfec54dc108c117cbafe8492a9d0f693de41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
310351766924ef2ccf4284f96beb5054

SHA1
dfc8b19a3ead645b2f4fe95f561813757c1b2362

SHA256
8d110ba665dc1bba0aebb7b846cd2274d01df48e40f7f840f21d6c9d927a0b53

SHA512
d34acd872942796ac9035b43201e2fc654877076f85049640aa75e48dbb1c0796244f0f9c75bd1b10fca2b0625edb99b0a0831197546852cc2d32706988892ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1736476192fa34dd90e3182e7423b14c

SHA1
5a7b9702334a03e5e2b9c653078dc8379bf62124

SHA256
ac2bddbe872e76454bd1be23b7ba86e7ff36d39ad38c705ade6fb77f9160149d

SHA512
94c2c45b53c9515b3c7c450c198f1f5c804b48de0566f60fb7c5e5a455f055447d9282b8bee4127e65b0923260c62a93ee0e7b93597aeecb7685ee4a44a243e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b08f210c336bdbb6b852cfbbdaf15334

SHA1
d4e7eb5f928e1c6bbd7173241572ed68cc7de216

SHA256
af43071f026ee2ea79c620baf46ebfb6ee92b9a70c4cfba479170a965fe1eb4f

SHA512
5b1924c1d235b58b9acfd7e1e553bec8a98c3a56f037bab7c024116cbcb877b28398be0d1196f95bc337a10ac25d65ed75ff3da56fcc0851e08dac73da3e45fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea771a9089a70cc4cf7e4cec16739826

SHA1
5e605411e55da469838824f00bb553bec65aabde

SHA256
bf5b127049e55ad72ce01f92e022052417b3f72cfff49c98c889f6c61ae1d4fe

SHA512
048df03dd417036d316c2b02537d9515b201f947eb57487d629a7bc236e5a86bd4a2cd7bb631aefbc57a3e22db645c5cc89cc4a443eb2f4cf35f2aa370bc0ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c90b21df7087b67b81c0e4bdb1f78c29

SHA1
83adcab475d0f49d385d4d83201cabf038bf4268

SHA256
6189c7879f75ee2e3d721b7785c24fca6de7dbb1985e85297804908fc80b5ad0

SHA512
bde2b45464b2a4253a8535849d442106fc3018ed8cb7f98471dc63c894abffc52962c4d31c0acdee819e627b0153860a1bd929927891591821e566b2e775e74f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072caec5bda8322e7c39b3cdcf1aecad

SHA1
3a7bc1fa6823c9c338b6116965b3d8418e6bfaf7

SHA256
6c24f19ac52214c6c2e2077c12182ba580aa33b9612ca7b8984d1d63675d936e

SHA512
f133eace7e934c9f4023f048e710b3d21ebe9c40113501561d5d1d2dd5b54ffa1e6521344502347fb9b53a5f395b932e909d6e72be62f81cac2018ff18c3da25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab31CD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar321E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit