5e4c559a38e60e250287749f54b93a1bb7ed8843aaafa6f791950f5863e990b5

Analysis

max time kernel
136s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

684adf36d1138d03c3f778eb757d12ae_JaffaCakes118.html
Size

139KB
MD5

684adf36d1138d03c3f778eb757d12ae
SHA1

2cd8c47bcd0e709ab34e2147b3dcd407ddeb37a0
SHA256

5e4c559a38e60e250287749f54b93a1bb7ed8843aaafa6f791950f5863e990b5
SHA512

b32f780f89626132d3e9d654235df3598650606dab0641c425896b9f2f787b1cd88a8319d960377a1d3cd1e9cd88c13aa11da200ec78b942421ad39d0e7e7aef
SSDEEP

1536:ShNdCli5lWnyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:ShOkSyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5848581-186D-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000010740b6c3a31c8b7e7c476b7e86a02d2dc396a1345aac0f3939e444dc0147c0c000000000e8000000002000020000000a5a5ae75bc3c85fdf1041d65012ee059bce1aed9824d0833b7d5597b540a04f7200000008d5d235f842fc0769182e8950acbd1d45417fbc8289f0a6879059c26adba97754000000002f1426ca4bdb6d3086a549c7f5fa46cfdba0787e01c21d4ef8c432b03b7bdefb50641b2474362efc3d7e0e94a0a2975149ae7f5e88161002344e8eda43e39d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422566445"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04063f97aacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000023f6544fdead3b30095779b88b73d7502e17f989edfce64c41a01aac9f3cbe0c000000000e800000000200002000000017a4ceeb0d52c7956c7970fa7120289a70996d22cc052493713e640ec43d5cd29000000070ca3ba1b7f0c1e2be3756ebd8213710a17cfa4fc59133240fd45cc121c8cbc08670ff895894fdf397f8081d3e99240253918887dc5ca0d6b3a8a43b18e2a91e28610b7889ee7fec96797a5564fdf94e6382985e0dcf8113dab08d3122f0dd546ba5b64f4ecf1ff5ff2d4487ba0ea959a301f82645fef8f81cdd9642f03999063a957be1a3b9dd319bf51c0a64f9853b400000006582808d2a1eb7272ea25e3fa31ff067fdd211b7cd793e198e6078b0b2e8334f415967398400ebe215022a753cb9809a2c8e92b4113f1aec50546a754d623284	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2480 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2480 iexplore.exe
2480 iexplore.exe
2456 IEXPLORE.EXE
2456 IEXPLORE.EXE
2456 IEXPLORE.EXE
2456 IEXPLORE.EXE

pid	process
2480	iexplore.exe

pid	process
2480	iexplore.exe
2480	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2480 wrote to memory of 2456	2480	iexplore.exe	IEXPLORE.EXE
PID 2480 wrote to memory of 2456	2480	iexplore.exe	IEXPLORE.EXE
PID 2480 wrote to memory of 2456	2480	iexplore.exe	IEXPLORE.EXE
PID 2480 wrote to memory of 2456	2480	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\684adf36d1138d03c3f778eb757d12ae_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
283d24cde04528878eadb7c08b26be45

SHA1
697f9f19c01002aab06a2f422a4d7d62dae7878e

SHA256
c0e47b0ac13e96730c8eb938e142a4ffbafffa6b0a181ac42efe9fb7f9108ceb

SHA512
fe1b5951a99e6d09e376f94ca05bb9ee832de542e0497f3acefebab423e92ae41319c1cbcbe5da0fdcb1d1e3ec2d67aee91fe085fcf667cafafbd6972cd0b9e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b71881739e3e2565ac8b343c6b607fa6

SHA1
61f83efac986574f00ad9f2e0f57811c85e2d37b

SHA256
e5b4e7a30d19977f8439efdef0a7037d4b109167e582417e67fb59568569ae90

SHA512
bb4defa5566d0ef4cdbb3b537f7f222d9320a25eb537fdcc24d75f47505fba6aa1ad156501aa0afc47bc27fc2d70373017889185d94297a26821e7223f13b666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
952a328dd6aa3455042dfddec2d73917

SHA1
7fc57e75cecc58495f0c23a15be46fdac37fc9a3

SHA256
18ef7051623c6548b203061614ce54c90d08eeae03a50e5309289e802d922863

SHA512
4a57d54595cb13d1591f3231f322358e0b67f822952d52372607a7c3322f65a58e61e520aabf3d78aa8c64ae812b97d622fdc3447f137e35e3ad5b811d61ac5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cae7b6065ba7ab58e00d4c9b40829a0

SHA1
95bd804a6e98df16a740ce4b13bef4746ae88c87

SHA256
75d4d063b72f092af3458e5ca3836f3a86d6c7fae05a1439413e1e5fc9dc2b99

SHA512
4497cdab8bb42adb824d6c3891c2b2f39ed9e7d8bdaa072ecacc8daa8dede94c0b71d30922e75865727f74812747dfc7f57b9dae1b0039bf10d54dcddba64a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e97f96764adf8ae1f6cf74c3ad8b0b51

SHA1
98a8a8905dab48628119e238637a75b2061cdc31

SHA256
8ca9bc14fe2c8de80862f06c3be881888355e1bad89001cbbfaf0903c0a598ec

SHA512
0c426fd6728fa30ced3445b84537c68620a873c745ea357037d7d2df4ac991d48dce2a0bdf449773f3c7c415cd7441a297fe3006b13657e0a2a62b0dbea244e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae2ee5ab3b59ccc1a343c8b7bf60ce0a

SHA1
f1db253aad3c02669ce4868a90fd6f738437f6de

SHA256
98ef03aac045080bf9569d9f6f3724aff29dd905d6e0f93721cd6bd7a7650e57

SHA512
36a749076e731c1de9c84c23e591393cf8cbff1b3d76dc5210de5ee60cb2f1bcf4742c43d3aad32540f223cd2dc61f14577da3a49abf4c8f7382f4696641507a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19a93d5d07fa28f4400293e342eb4a8d

SHA1
050c1bb10f0c3e59e4993cc7c125073928c6461d

SHA256
2301cc56e95e5c7182ca042f48a679210eab030f56436490a14809f6508e8eb0

SHA512
7ca608e2bef932d9af3f3fa402a1bbfe9b61657c52fea2a80f83a2f44491abc58b31124c0dfa092e9423ab19aa1e4382d5bb92e36354ba9ae1a179e5b5a5880e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be1ccd65de3b299b404437d341e365b7

SHA1
18e3f20cb69ed2a019bcb03baebdad29d2c33d3a

SHA256
56c9524c2e556a0333f1e8acd5bc0ab3dbb9ed3797aabf5d2e06c9b00f90dee8

SHA512
4bfe75c11fad8cbc240bd73e6e6d752a14066bb4380293808c88d07f96e27a77d36d771f348be5a7d6e6313dd9b361e7f884df2946718602ad9e0295f4209b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a849f3ef6bd61c22d22a8aedf6d99972

SHA1
eb55143447bd7e2e0df37557941905eb6ff50d20

SHA256
888b4b15abd445c1a7ccd33d58b41801a815e4de6e2a81cd217ac966e816240a

SHA512
43e99b22594eae38bc49874d50de208b690dd5ac619200374a59e29b24b10aae40ad2cc5bf06ef0facc65fbd60590c929c0b3e1e42f85a0d16d6c2fe1b7342f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2da2067ee3d0d0e605dfd407059babdf

SHA1
da0c362cffb1b8257dc0be39e89633e89a11a898

SHA256
72a6c938d49129b903d1feb5483fec3599bf1add2fe288ab6a821e96a4f8b9ca

SHA512
d55b24c1b7fe40c9b4243859cdb0bdb648236d0071b53830039103c56ea1fd15b654b822ab2efacb7e65c86ed098964dbb6054b718752afbd5c8226b1fe5950f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6f1d64821b64602f23a9e96b3241407

SHA1
2fee6a7174f6a2a2aa2fe536d6893caa56db4043

SHA256
713811559f4b5fce6a1c040e1769732264452199bc3dd772a09eb2bb574287fd

SHA512
c0f1f4871e0185e30eff7e0b07e6a2daa7f9cb608c8e1d6acfcca41e1d0bca6201886ae99f43b79ca5c6e3e1daa4ae77eea52d8550d8d5912aa60e63ca2874c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20AC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar212C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit