cee2712de1c0f84e71898c312f539e35d01dd7141708ab5131fa5f288a726707

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d1c5c66213c4adda402177c24a7b1d_JaffaCakes118.html
Size

3KB
MD5

65d1c5c66213c4adda402177c24a7b1d
SHA1

387cfd5246a89ceecb8b1cdfa718cd19f67f375f
SHA256

cee2712de1c0f84e71898c312f539e35d01dd7141708ab5131fa5f288a726707
SHA512

27c471c7fbeb79a847fa6de7e9ce7bdcea07997ae37e860430d17b7ddb048e52be54e170193e22194f54fb2b0a4c0400613c6c88c93c9b3d2e3e5fc4971856b3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8BDFBF11-17E9-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d1e73925fee8f9532d3f5e51653d6ba60d82f925d6c421ef9b978a5a0639a409000000000e8000000002000020000000c81138b9cc668508cb3aa81fe720fadb620b337df816edf2f81999120ed127f9200000008e573243e12e15df1d6c0ab33b05e9539b25b60510e6aa9842784741765f40aa40000000f0c09276db9dc5fa8681f85490c478bb2156e9467c3686ad8fe14847edaffc5f8c1c8f445a9dc675cc248c34dbdf479b8b758e5532d4c3f2ad79746962f83e68	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60469360f6abda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422509599"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007a89dae2a673d919c87c9e218bf0c9140b0d9e432ab82cb43da41dd00f9f7a88000000000e8000000002000020000000ed7c81d2847d143a4aa0bde48f286381f0d0866da7752e9f867f821c452ade939000000041008c643990c272437c31268f5d52c2fa9d06ad39dc63266e378e3ae95333a2e2f4f1072ebd2e4017ecb17d4ed60c4794a6e15e53cae381b590680646a156a37eaf787d95e88330b5230392aa91ea6c1b9b471dd5517b4228bc1e71bee7916658b15e9b77d008ead1453a54476e7d59dee1407e4055a8b453c830159d709f702983f903aba30c1163b6a358707d36e84000000012a44918eeb717f7a591ef3e4aa4ed53fa36dc65a25dd5282886f6eba63d5c6fc9ff848848ec71a9451e41863fe8c522e432807c5ae1ea2f33423c1c385d4498	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2212 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2212 iexplore.exe
2212 iexplore.exe
2204 IEXPLORE.EXE
2204 IEXPLORE.EXE
2204 IEXPLORE.EXE
2204 IEXPLORE.EXE

pid	process
2212	iexplore.exe

pid	process
2212	iexplore.exe
2212	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2212 wrote to memory of 2204	2212	iexplore.exe	IEXPLORE.EXE
PID 2212 wrote to memory of 2204	2212	iexplore.exe	IEXPLORE.EXE
PID 2212 wrote to memory of 2204	2212	iexplore.exe	IEXPLORE.EXE
PID 2212 wrote to memory of 2204	2212	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d1c5c66213c4adda402177c24a7b1d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3346c64bf4d5fff7a66b5b32d2bcd6f8

SHA1
c1b72ccdda71ff6e8e918095fa1eee79c28467e9

SHA256
23c64493a9f8b8bbb7bc22199e4a8734a0452dea790c5e1115cfe76b12c977c7

SHA512
f55ebe21b8cdeb969e370e4a7d3aa67dc1f9997c48651538e01dc180525c9fa640028d5cedf8d3404a930dcc47313c5dc5a623dcc08a0d1cc4f8d1a91add48f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2a4f08d773a94042e85e9fa234b79d5e

SHA1
220a34c1dc711cd3a23972ba36763b52d541b164

SHA256
42bd9588551b577dc12cae89c02b61b3c1e5222f8e7f31592f147760d822b467

SHA512
a5df50a5d835cf18ddd008b650deb59f9e6315c609b742629ced7a3837fab3c3530a4fdcc26830fd14cf0214dbbe8f4de81bbb0dfc22d29c264a92cd3551e297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
43308ca870a93f3b87cfa1920aff9ccb

SHA1
9a625a55ef12aaa49be687232a6086a8383d6adc

SHA256
7e712178107dcaa8e53256940b4a557ef5a2b6bb3d0a1cdfcd57b8605d8c898b

SHA512
3411c81eab43b1dd7b1c277ffbb76d6faa935fadaefa257d2a58c21f5bb47d6491444675a54f730bcd592817f960dbc80420acd4a5f60c6032c958c6372d27c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1392cdeb46af050174da1b57dc79b0cb

SHA1
db26184a5e3dd4dda0b14f0ecd885af43718fd49

SHA256
17ac063499a88ba29a8d663302fc08e520796381c71238d243eccb699f3852d1

SHA512
80b17cb79e35d94ca5c637a8f37fa928ba7c383566fbb6f90af9497307c70f6bb7eb5f71b607f3ea11fb367974c0a621d40efd7801af00318302f858657f1b10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
069b6128722578540404d8d4bf069aeb

SHA1
1ad60f84ebe9725626edde0d5025fbfb8f16e9e6

SHA256
370be6259a356ee1f429d80ee6e1a065ac304b2c28803344e5894c79fde8cf36

SHA512
ff0fa17a23e94641163d6a9ed0e9c2aa0b68b2b5847cb8245630d2a2189f1efce386662e505057cb187a2cdcff53205ad9c97d76057c3016d2d31bac61ce9829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b523a957657c6da2da37b809310f6b76

SHA1
e8d98a5fa00d7f60ef6f546df8a6d4f7354d36b4

SHA256
32e4f0e0fa0f059d76a28d4623a202dc24dc232a77488f00596a0485635b71cd

SHA512
91e8d849cedfeed2f1fb17112d2597dab10a32aeca11f80bb3c400df6be5921cbe7ef2b0fd7390d711e92dab3110140cef36c375823d258a369c2de02418a4a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6a6ae4cf60cea70d75ed547b867ca313

SHA1
c78ebfdc5ad59b03b88c2c621bfded7dc02a246b

SHA256
fc15f9ffe10f8489c401ea8d520f361ae08ecf8985f963285b73f087b845fb55

SHA512
91442ad0f15086a3abc1d12ac32dac8d9e23760e655dec1652bd65acab038999bb5c5985f1c66140ce22a1046320193c509a5688a1b31b3e566765b69b4eac21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
de2c1d69c121bd8aa792e6601d13daef

SHA1
9af59578d9c03243c0176c6ca109c2e56ec3c1e3

SHA256
f8ea8e54cce26717133b8cecfc64704227ed363e4d7eb703601929f92e276a7f

SHA512
d1ac1b86898c3e134f127fbd7e49add034ba97da592c2d7e39937dbc2da13deebb77d90fa0ed1f83a4c2a740ed41d9be01b860353b00f1ec86cfff8e614fd7bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
991402e44434248e1e262e3c9f8c96fd

SHA1
314859541c5f65a1e2479bfed31fb57f0736528a

SHA256
0e7c07807c9414ddab4bfc0c6bf1ec59651b941940097bc79c78717eb8722917

SHA512
487b0c0f426641642045a5a43ea5279ad101fe0615ff67209d0e1ae1362f76c8137b1f8449523bf813d05680aae87752fe7a87286c2a58478e173897837daa76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f39e08b8705b12b5ba28065f04ae3452

SHA1
a59934b017cf50720c74b7c96eacf78b29b35fbc

SHA256
983324f072d6cb2f62c458b09b537c2dfadb5abe809f2b2aba2a9a67b0fa1285

SHA512
6da2d462ea0c799ceacf112befea1ffd18cfeff78bcdf7e744dc3fb1e02e12adaf59d0b52fec3ec180a0c225f9e32c2c6d5c11aa4a18e1022786a5a2e188ee5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9390276bcc4e674e639d3597d0a5d95b

SHA1
7293562e958b1b2dda96e53316999b3560766176

SHA256
52d598dd835952057768cdbdc2d5295a002aa4b21cefec6917a82e44faf9d3d6

SHA512
c4ee488a91972c1e35bf2330eba1fe9aa91b47d18554835cdd7b8d045536979ea87d9164f8dcdeb44debddbf284540cb7b040067e88b5f8bd3c92d0520d13970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
90d9c11e4e7225f2722fc04a1ca7f49a

SHA1
4b2ffe660ccddb0b4fb9a4d8a716f729ebae60e5

SHA256
2fe4907ab6ee3159cf2ec0954f8b1edbdaa3b91a8f28af2589e4c70f03514c23

SHA512
872de77200d8514351bccd65404b4d960e87cec5679b28a5ad235a9cebb4656f71bde674d0eba8342d38325612a86c9f515ca039bbaa224b22e2832bc45e20aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2bcf4b956aea91f02a55b045947e7da6

SHA1
053f8267904995726a3df3395147e5be76421d4e

SHA256
bc27fcad195e1c9e72058e4b3bf37657d575f40a8fe671d8170b2818492fee7a

SHA512
b230bfb00db0ee2c407f2c143c4bc9acb02b46be8562c985b054bf3c87325cf86fb2e656abe0bc14eb12f2fdfb7a387c3b550de9976dbeba72c5655e9add7219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
38a7d8c8f67a0ebce17b01168d264ffb

SHA1
2ee77313cfd4578fb5834e0fe382edbb8608957f

SHA256
4198b842ea5114e625ff0a67ac124cddd6a4d3f40d8de5fc2b5aed049e309b80

SHA512
153e083b93d132007992299d7a09a1793777099f2217b6647169a25b8ec0c817a737138268e9d6d7f81797b5750b42c521bd3b634cb51ede611adbda1b5e9c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3f7ead3e5b4b099903ff70d352533a28

SHA1
559ca1e401acdb1a3af48f9a1c85815f93f5846a

SHA256
dbcc50e604ebfda76e83cdfcaf4ab331030e545dbeab29e01b957903885d1c75

SHA512
f3edf24b047dbd9fa019713391d72eabe5f0471cd0cf177d27ccff71c53eb88be95138b25927dda97252b39676535dda2f90593447ebcd39d3b68fc8d61cdcec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
317e32c558acb4e094f4283537f5558d

SHA1
d518bdb2ce881e2008276785b1a1196e9fdc959e

SHA256
47393f061c54f718f0aa34ce5261192d9f57371e0c315b4d5293b377c53c1f76

SHA512
eaef1010ebdaf396c2df9144f1cde637bb38391e9cd517745a16f20721dc18647bd397dcb4e44fc892333718c4e869acaf3cc3112e00d6b630e0cfee6e30a193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7aed57a756f1dd1de733990cd177f5c8

SHA1
8a2e0a9b518996bc478adcec26c07867b9442ca9

SHA256
19225cafeb81b1296ce0c1823df15c91a24cde5dcbd0d881b96d2ddb96971b16

SHA512
f5caa495a45e3db944defb98835b7369dc3a700c449b58b669ea62b0b272e3dd21d9b6300a24bad33741241cd966ced993f5f7d4829857ed957ae39de3a6e456

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34E9.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar352A.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit