a612e06cb330d2a15a9b07337d177758ba28d749b54ff123637c065cc28053d9

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65aa4094682aadf6e8b7600d669bb33c_JaffaCakes118.html
Size

22KB
MD5

65aa4094682aadf6e8b7600d669bb33c
SHA1

a8fc2e6bef850d06e9c475a5a1a73104a547647b
SHA256

a612e06cb330d2a15a9b07337d177758ba28d749b54ff123637c065cc28053d9
SHA512

025938bc2b2fc85037dddd497555a513fb5898920299ae473d6ddb5f1c15ded8f215f66d893498f83395b61117c0a077530f0285d4f8cce7e8063c3cc79d8fd5
SSDEEP

384:BYmTjD8DsD/DtDaCyUOqS4zje3C8Q/qhkOZThAM2Kxfhi9f7Ox9GoGM0Lw:BYmTjwoDBOCyUOqS4zje3CwhkOZThADa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422506197"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b460ad32e47fa84f816f2f68d586c081000000000200000000001066000000010000200000004186f16813a7f009fd9f0a8ab4d5dba1289a46dae27841997152de64c739d810000000000e800000000200002000000088923e83482d9653fb6dd68d1402f7e59182ff2874464d9b9e9325588d8dd7ec9000000065684167fde28c0bf999433aa2c93c293b6e877baf5a2bed03306285ca06a7812ded63ca9586ce036c62f3aa8146914f5ba0d44412cc8a710d7792c61e11d31e02fdf8959e4155f596c3aa9de77b372df76785e86322f43f5346940247ba6e3eb0e89766e451dadebbff23b3ef3bc945ff4e2fb49ce6b3df30158067567f06f2b7515dcc06a6ce6e0351c2a49252b3ce4000000098c3e47b0ee88837fa048cf205b2d8fbd295998c14c919209eaf2b82399c4a40a3dbec2f21bd8e4632f7f0b2674ca7bb1987e7d7c2484017f62fe4a1531844a3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0188281-17E1-11EF-815A-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b460ad32e47fa84f816f2f68d586c08100000000020000000000106600000001000020000000d1644162f165938ee841195c2a48d16e76ab5ad98a62fd3087377152c1fc6f50000000000e80000000020000200000001f303d12da7ba8f31dba0a9483d3885f8b51c92a52eb8eb86698c518e16e2f6f200000008e927340eb76c57f58b0f6889f6bf9234e8feb87326640d1050ffb453b2f5f4c400000006a70268c8e476712a3def5a103756b08a4804f18a4b054c0a1c19d37f37385149d2a502e08b95869e5fbbb0199a8c7282ce758a243f9d3af42567dbec25b9865	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02bf775eeabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1132 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1132 iexplore.exe
1132 iexplore.exe
1952 IEXPLORE.EXE
1952 IEXPLORE.EXE
1952 IEXPLORE.EXE
1952 IEXPLORE.EXE

pid	process
1132	iexplore.exe

pid	process
1132	iexplore.exe
1132	iexplore.exe
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1132 wrote to memory of 1952	1132	iexplore.exe	IEXPLORE.EXE
PID 1132 wrote to memory of 1952	1132	iexplore.exe	IEXPLORE.EXE
PID 1132 wrote to memory of 1952	1132	iexplore.exe	IEXPLORE.EXE
PID 1132 wrote to memory of 1952	1132	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65aa4094682aadf6e8b7600d669bb33c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1132 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1952

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
88aaa4c2453cc281826eeea2b2fe1881

SHA1
1e5564abcf02a719f9dd4cac227be34f30be7c89

SHA256
6208c3f77ba66f3cada723df98d2bdded47cf5fef998242904f26522f966c54f

SHA512
e9028fb58311191b6eaa4345e226a0727ba9c05e3cc989fa38e4052658a13278d8cd6ab319ea4ffd2e7e28cb8ce18ba5fa7adc9608c032a64fbe3c14bef02aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7e1a812eef0929933e673255ec9ae47a

SHA1
0cb2a5330635b2b407e883a2b282e8f1fe93c2c5

SHA256
bbb9889fe3a45463c3dd3e96b38d5ddda0106660cebafdc700bab89ceb3d7dac

SHA512
c3df11cbcfca63c3e40fa3d6345d81af8856cfede33a1e1666bfbe6b06464fdf03eec98e5010412dfacb8df7b573a0d829b4239fbb9f8203064afe0f26668f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
95a5fe9740bc935330ca8c3a57b58a57

SHA1
9bdb0f2633bc3f49299afc81578ad143da0c1409

SHA256
03e0b9968e9e3ad9128d3ca123a3575094b4dbaa23e6719a48ac646cdb9901b7

SHA512
f8610bd3ad720a8a7ce76db530ac2771aaab3815cff3ceef7c439e2633a11775b3faa572b058434ac68bdbf263e243d02f9d667d221c987ff3ad1565427736e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8785578322ce46c29c4dbda17f89756a

SHA1
28fd2afc53f57ce77a3a8ab29cadf2956da0fdb6

SHA256
0a46c7776893b7b9a3d4d9cd5ee9ceca84c91168e16d22cf936970aff41000ff

SHA512
e25b12e2d43e8e9c302e61ee70fc31044e6f6879ef775fbe4b1c43f3d88de0676a035d3fa289367736a2a87c0a458178bcec6042b1ebdcd553286bd43e64dc77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
864e67b505ace9cf396833af1906eb7f

SHA1
bc67bf1f5bcde63d51f61a20dc1e6e8262c7b133

SHA256
dee7536f2c137300a7218cf15359f8b17a2b497e0e16ee3977ac4fda37f1ba5f

SHA512
df5c0a9be435b1858cbdd7fd82bb5977dbddae34edcc850f8c657d04b83c85a6bbdde49c565623cf2d6d0c102eee90349533eeb161bf0734fcd9582703c1e44f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3c50f29b034af2e0e0f1c509272fa178

SHA1
dfd6bc82d7a9dbf945436880fee11e06b1fe9c44

SHA256
d3774845ae17785c0f46053ab282d3ce6de513fa757c4bbe4a82f9ba2be1174f

SHA512
2ef169ea94efac9be845b5a3afe9629ff97c1d2541a60004f01e27433bc9db4084b744dc2d2da28fbd7561b6e782c69085ad6ac49f5fae10672b69b67f20f5ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
74d267a26b01c8d8e30b58e6457376c5

SHA1
bcdccfd8ff7a854798848e2a1363e99b23df393f

SHA256
1217f42894cf8a4a27850e33662fd7e74b3465c1ccf3b7a21cbf877264914f48

SHA512
dde54f5cb504d7027421ffe61d27cbfa6f052c8dcca55da813bcca185a5456bad5e2c01d12784657d69e82617d16a5cac7b46bfb6d4b969886b0335ead544f8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a63bc0a40be6bff37c9165121ab595d6

SHA1
3b2c48b5ea35aafe1621739a2703c33af2e6c62e

SHA256
053a1bb6bd53e06df33fa172dd64a52b4dc6a633096506e8d3d558e128b45a2c

SHA512
92eb741c3db070045f0fc767441574b6e52baf26ef4a57dd28060cae6aae0138bfae1c50a2e080108f258699c66dcf8468922f044356071413b2eaaabf0b7be5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5eb8bd9b2aa907aa10a5414e50731f6e

SHA1
afed0345590be3cf7e399c77c0efb65ce1958ba5

SHA256
26cf789797480fd8b4ca7ab260a2a103d91f2f43d89eb2b5cccdaeaa5c50a89e

SHA512
cde31d58e5308c15b530fe3697ac75c7a31ef4e48cfe655bea5b1934be93c5994590ad5d5d3ad5cdb5350187e14f60348617e0bd585e98537d78d294b9c4645a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
400380486ec65b3285a7fc462fe62d0e

SHA1
806307490edfec860802c30898bb14726724da37

SHA256
d4a935bcbe176c682d795e450c466178d140324c2acef80e0a251a2d33c8f3af

SHA512
5cdd0a87bf7ed279cb54b6238fdad68202b1bfdff3a8400f2845b3cf5c31f7c2d04057c62195bc98755ea4e88f8f64fb057d8b83b549cc5184a91c761d1c1d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3198d36c19e035c52e00cc4a66afe66d

SHA1
7887a51d240f702d96ac887480ecc0574002f851

SHA256
57087ea9c58abb65ea9a706f9e3a7788711387ed90b3d33f4ea9b23640e4e63b

SHA512
ba98e76b03baab71e81fdcd6e408a9b53233323bf66ef1badcea068302ff99c0a3f7eae1bc43ddf1da39393c8e7853e5325d743c0176fa3d28acf14a878514b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fd5b549740146968423a36bfd55d3e4a

SHA1
f86fcfc67a4f1c7b334d78896a4f30d8a1ae6f15

SHA256
555293674b09b79d4f798b32f7788cafe72787aa5dd10a3fda2b0577f0944872

SHA512
af6ceb8ccddcbcaefba9fd43cfbeb261df7ea1d00e7cfc1c561ba77467304bdfe415c6a244a7424082b46b487b846b8bef94424f6e2dfa2c0aca558c9d83b8d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
51848a4148b2d6faea9f064054d1da24

SHA1
b66c6933dc69b84d80bd31602ea8d906805009a2

SHA256
b40108887a4380509319d37e620fb56cfae18b1498bd556b110cd9c6202e3ef3

SHA512
f0195d0a8363067b90a5812ddf440350559934c6626e859b7e5a796920efba4a5336eb17e82c190d1c66608457a0e37bea2660cc048f2cdd72becdec029748ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e92846b705d0f9e0e072e5728cd111a3

SHA1
3dc85e9770575697d6e9385fc2f106d5e5bbbcc2

SHA256
c1db24483fda5f7d36e1e9d13465066e27ba6c1de96a97ce11ba8affe0a0119e

SHA512
9b39c823b0232ead847973eb4fa502024ac4115fae06723a98b9967caf3e6328bcadc83458cc9c27a8422d0588cb271a38c03133d1171fac0bff76d093bd26f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar415C.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit