368f8ad23181af0899ce9673786170f697f39cb4281fb59a28d51173e1af1520

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687c3b6efbc814c696cb77dd311fcec4_JaffaCakes118.html
Size

27KB
MD5

687c3b6efbc814c696cb77dd311fcec4
SHA1

b7e0f5fd3a39c929b3ea43744234bd719f501303
SHA256

368f8ad23181af0899ce9673786170f697f39cb4281fb59a28d51173e1af1520
SHA512

50e7b4629e197c08a57c07b6883e8f4ea306bbb40f75aaf88f29106669a08538e74bfc08628a7cb579e167cacb5ed7510964743c2d74aca98a76116f5055ff10
SSDEEP

192:uwfIb5n/OnQjxn5Q/enQietNnXnQOkEntWUnQTbnhnQ9eRZm60TLlQl7MBNqnYna:GQ/j8T4LkSXgh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f9e2f384acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EC7AFC1-1878-11EF-AB41-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c58d0af811fef4baea79c05ce837a6f00000000020000000000106600000001000020000000487529dcc72ae206ea8556ebf65eb1fc90d9b1be44afddebaca057cb773e1546000000000e8000000002000020000000e517ee703f973273b412bbb194c0602a2fb27dde804bcb62726e1a3ba1a04c0d90000000f4f740011fa5a5230eee02c3234ffbc3bad36739c0de01454812e8db52c35595baacd6f1a06ebd94682f8bf69ef9d96c04fc25e9500739482463c4d2be8eb842a5858568b235d4f71267edef35a986b68d12e7d32208fa59cce5e780f230160d137c55ed56c0f4e9e353e9044c1c76676fe59da23cf2bc14309f8dc5f9c5e8f98d66ae97cc0bc1efcabc02ee5de738ce40000000279d82679bb1575da8f4727ac94b43ca57484bd289c2269751027d0bf71302e1ad10c0a87c3e8424e1b68b8f5215dd15f74a36931ebedc8cdcc3d77f4d372bec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570837"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c58d0af811fef4baea79c05ce837a6f00000000020000000000106600000001000020000000733cd972d1d0d919285aa35ad11b810c5c4dec42b1155da8ba34dfeefdbc72e3000000000e80000000020000200000002bfb64c4f6d6c13cd61aa1ead9ed9adf1a286ce4cdd69d89abf59a41cd91424520000000dcfd15ab2e7b2182cd99671753a9775287515c6e01691516432bac9336d285e84000000073409d0a1f8cd39fc0a01811bc5115719e9734030452239318e93fd40eba57cca4b3c1f7d6214906fff5cda1bffdd79b9fca13faa222b5c926abe97b8db222b5	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1664 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2240 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2240 iexplore.exe
2240 iexplore.exe
1664 IEXPLORE.EXE
1664 IEXPLORE.EXE
1664 IEXPLORE.EXE
1664 IEXPLORE.EXE

pid	process
1664	IEXPLORE.EXE

pid	process
2240	iexplore.exe

pid	process
2240	iexplore.exe
2240	iexplore.exe
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2240 wrote to memory of 1664	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 1664	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 1664	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 1664	2240	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687c3b6efbc814c696cb77dd311fcec4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04c4f9f7ac31a94bb6d44151ab695c96

SHA1
faa5ff0da0b8d793a69981fe7a52ef6fe20b5ea7

SHA256
fd91345e21f032b8938064f82a2ed1a303972e98cfc3047948f274d59ea2d88c

SHA512
a1c8a28df2147745b40b83d568fafc4ed2c70dfc5b416acca8ab44027dd4a56d6ed9a96119bf142c214c9b8d831791d3fb48aa6c97d681b1a6e779b96052c516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af3ac31e3070353d01cd248a56920ffb

SHA1
acc80d8ab2b3ff0a4974626770258ab695095dcf

SHA256
65b7414a89f95c600c97f2f1b21d1d87b1b36e68d9115cbb936a6d787be48d5e

SHA512
3608c39fec1e46b00398ef63823ca951f6efb75379da83cc7597e0d32fdbd0963add2d2f7252da69b6bda4e60afcf32019643acae7cb0157c75b1b193752eab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
304395d42a4bc68e836d94bdd6653bfd

SHA1
269566c44768bd675f96b006da765611d6863d3e

SHA256
0b2fa35170d71ab7bbeb277440a6d590ef9ad74040189408cc16716e5f32bb11

SHA512
9f6b62bd34099d5808e74bc70ebac58f7f7c57899e68397d343d1a7bc4371d40e5aca635335cf8fc25ec95d935981614f077c39d10ed8ae6cb49f64f405fbe91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28cbf04e3107ffa87ee4f4032eac9cdc

SHA1
ace9c5e0c47a62ca42881210f786ee446a79695b

SHA256
22736a351cf5d2a17394393efd0d239aa5ddd45a3c46e17737bf50b4e976e85d

SHA512
44baec8bf27c7c3c2d35b58cb056a97b842d06101ca787b395165a83aa7cb1554933e9a6fb0c23a101953677dac92efe2404adf3f0d07b7f610c8cba375af117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8baff9d78d531f93287a7715c6ee953

SHA1
c8299192e4870239b7da911b8f012adbb67639de

SHA256
c48264366a92bf338bf1ba3925be9b9f60d677f7d39b65d4e423f21122267aa2

SHA512
d816dfd2af318f70ebcf7a67f7d6877243ac0f2930ff5f6f32b9cde299548d571446f3bf798c4bf0884aad34b17d26af33de51c2fa3e0e16b0bfdc025313177f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7066f809abf62aa75b424f4dc1d3ce8a

SHA1
62aba6bad05948734e5b3ad23254507a66d09860

SHA256
7697b3533744e07c438dbc156b31b300a2cad4340350b411d44e4de7cf3d0710

SHA512
b1fd716158a2b7454b3ca6159200ae532c5ebf325115ebbcf8671ff96534fd4d21f253428e8f0622bc58d31743ff8fca32bef5f51ce1c75d795caa9a80058b7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ead6cb6a7011f6f7307e84986167f35d

SHA1
14057b7f5f92cba3d98c5b6d456be3b8b1336770

SHA256
e534fa70abfda3dfa0a0036fc3363dbef8a713df5764bf507c49e6f4bb047d88

SHA512
6dd5bd3d3d5f57f78294ca1edab8a7b67a770eebd8b322698e126845b4aabfc0a3faef3691e767f5c918385aaf071d5f67219d922fd1ed60a87f708297d2bb8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
984b871d38f3c8b0be9be20144bc6c15

SHA1
94cf43ffd55ba8d34bcd43ea365497b8cd416175

SHA256
65313a7c7861b63726cce4beff0726398faad83af5c1cf670adb0bfda79964ba

SHA512
967bebc9928f7f567964030c52331685fdfe4e84caaa5b89c7b0f74ea2db1bc902232b53fcc358be559ee2c7f7d12fc191fa5a26269a1ccd1c03f122560a96e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a940734c65f229ab4ff7c6c174578c54

SHA1
ef9ad4c7366824b1c8592230c7fc5cc7a9930c22

SHA256
ac3d3b8805e0ee16f778f88bc446a871b7cfbf9ae896c1552f7bba7e30bcf15d

SHA512
6b3390b6cbd79edb783f3c9e88d14a3e40be5c6c53872ca74f1fa3b15e78571263de592f1eddb9df47165f8f8c6f4ad9e7b9728186d3951e87ee7d27716f89c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28AE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit