4f8def0985d64093676a00822d4dd1a00d3c382542f1f7b76b8cb04d5547c7cd

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687ee03b8eb9f300c00e7d218c95077f_JaffaCakes118.html
Size

58KB
MD5

687ee03b8eb9f300c00e7d218c95077f
SHA1

c6851c32ac93c05d5ee28ebcafc27cabf2ad24e6
SHA256

4f8def0985d64093676a00822d4dd1a00d3c382542f1f7b76b8cb04d5547c7cd
SHA512

aae4f62622501fbfd4b6f19eed8948e51d7c154ace714c9fed70b694be8dfb53265f9b2f0822c3a4f8a08ed0c3806e8f24c84fcf4e786b1e54efa49a838981ac
SSDEEP

1536:arBIICnb+nPB3rY2uc76KJkJeDc3ql1nw/Qw:aWIEb+Rgx3ql1n0Qw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cc677785acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D295AD1-1878-11EF-BAE0-E64BF8A7A69F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000006aff778ba4f8777d9db96508fed9ebd108ab0fcd8e0e797917c1f8dc355166cb000000000e800000000200002000000095a6b901db4d7235264f9aebd461c32ab5fb2965e9ebf6b0a376b38bbc04121e90000000eb9ab42d047cab17eebdcd4a811fb5b07a38c22191d4c3654e6f413abf483dbfcd0a2ceb2111a239ef48ff5876f44a756a84754f1ea173b57606f99d630647938f86d2383d0bca4dfa6289e8811d64c00c798088b59ec4afac9bca26d17d32645192ccb48fa391d2fcc063d7677e8eb88033ae3dbbf142cf6cce5fd35610b4fd0afc980f3c2f283b8e90eacc39efab5540000000f7a29fe98a71eb08059881e9d1e107e48eb553f7d95a48001c30bf1fe09dacfb5d230c08f9c72b0c666b5e475e93ad41ecb441954f621e37a78a7f2bba37c9e8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571087"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000bbd0183e9e922727c05a62a1afc62e5d7b0d55387784c3858791da7145585f7a000000000e8000000002000020000000721f3e24115cdd99470b0300c1000b372ec5d9b799466abf1a2ff92f112b56da200000005230df66f2e10b44b12b59b27f084bad6a8a451cce1d4ef47066e14afa6f1fa340000000019e35bcae9a5035fb2846c34bf2b781bdd03091ecd5bf8b7701effda7f6c83e1a7c627d257360493ecb472a35c72b2cac9a2cd56757c690bc7dd8c79541daaf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1616 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1616 iexplore.exe
1616 iexplore.exe
3068 IEXPLORE.EXE
3068 IEXPLORE.EXE
3068 IEXPLORE.EXE
3068 IEXPLORE.EXE

pid	process
1616	iexplore.exe

pid	process
1616	iexplore.exe
1616	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1616 wrote to memory of 3068	1616	iexplore.exe	IEXPLORE.EXE
PID 1616 wrote to memory of 3068	1616	iexplore.exe	IEXPLORE.EXE
PID 1616 wrote to memory of 3068	1616	iexplore.exe	IEXPLORE.EXE
PID 1616 wrote to memory of 3068	1616	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687ee03b8eb9f300c00e7d218c95077f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c42ad9b039f238faf005371b67f8b21

SHA1
58bb1a8c3c53412b8b53a9645445625ccc34393a

SHA256
42a59294b762494bf96073a09e30de74e2e2dd536379657a035886425e0bd50b

SHA512
ef9b6e0864d112f6b6e92fbdbdd23970a34b85c14466c1f6e9e2c1bcca02bade02a889e746ba305e9282b46d344425abcc51ac6c9be2fcbcc58c9937b7f71098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32008b05b82285f296d99abecb557afa

SHA1
09aeef711ad3dfdfe76706aaade33b05a7f5a531

SHA256
325dbf5013a96c3023f963a80c85e7eedf376b4f074768c3463118d119a582e3

SHA512
acdc49616be94a01412fabdcad01f82e288f6c4c2783d2bcfda7686aa094d544cf87b76aa7e1ccdd4786a1e86e6a27319506a9a85d42bea7cc8b51d37fa98373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bef4fac7e186b79649dcdb8e2ea7fe6c

SHA1
927a9247da44c084141c2a7be1108358d8415030

SHA256
e1dcda773bd8290105218a06d847018fd9ee5cb4bbc50192b23cdbb949bbc9e9

SHA512
402938a8ead70149e212be5366867ae27e52785ab999fdea4179fb8993318f3fd7b2666b6698348e6b38c9d6f3c17dc77ce62a9def047e29ea1d669e7f46cf7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b48357e07f1ae8d4c0dc19e90d0e76c9

SHA1
3eebc98b1bf8c573aefeacbbedda8b13131c0081

SHA256
c9fb56107035659e672f560453f813b4b2fbc66ffd514a6a4598561e30e3f9bb

SHA512
028a9569559bd1a854163b835f149ee20ba2105a9028e77090a88585a1afcd3413eddea22c3321c91a0a67b8a00be4781d7a63adc6183c13a06df4c623915fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76c2a16ccd7fa9f768b5f18b6eaef4ef

SHA1
495e0fd273d401f6a2a2d700490e1121ce3a226c

SHA256
a0cee9d939a194ac3a457ebf420b605d9e5277771843d22d90a6ad4ff576174f

SHA512
605cb97d10a61c526009dda91f0ec1403edf389ce6321b947c2820fdc487e424e37426a39436114e8f32af705308102588ade18e93cad3a259de5a0507eb81aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9df8210030a99e7f0dffed683a9630ff

SHA1
583246c0fcb14a01a3d61f4e49a33e98bb9322b4

SHA256
7695db9b6ba6d311b64ce92abf038da0f766783dffb613af19b85384bd1f9599

SHA512
79d5c6c182593528b463ff869bee313c5596fa7a62dd4028df725b702435af38779adb9a26a1711a3a2673f341e7123ce21eabffa7bbdba751f028464f6d5d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e408b5ec6c1cfd27a61f75fd319994f

SHA1
6c3e7f40e1d4f3d4370e560841b6cb3d206529ff

SHA256
474cab158fe4da92c16e3e28c08e8c739f46e7bdeaf8f3616a3e79b567add1c5

SHA512
91fbdef78e822144201b3b453b3bfe04d8081ba50021bca702a7cbbee661bc74770317f2c47daef96030873160df576e322a7a3f530aa9c8685bbd14d58c533d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17bca273c814aac965c87fbf8add36d9

SHA1
2da8345abf48e8fc0e6c2f304316f26455727ac6

SHA256
e5bfd30b631b5e60917c6fe80089b751588e03174300e11ec5ec33ee90027924

SHA512
6f816dcede47b9995566d1f92c5e1e25ab1796619b06cf2e5148faabad675b9ae0ec098d73b564bd93151768e742472f6e1280e8d101832410a79ef5bf502618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fea6140758b63f6e629a6d83f83d5792

SHA1
558773ab1cab45ffc9dcb96067a148d7b52188c8

SHA256
a65b343270e145da07c97e3510ba2198e3b1a225b49f06b6f34dd059656dbb73

SHA512
a6eda6f49151dd0e3c961b8a59c751dbc032a2ba8d761c6a79665726939ca4c1a98ad7b24c2a9c94a089886c7fd3c9220667c7aee72c71af1b99016f1a0247ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3884acf849c825c2cd889805eb62b493

SHA1
57476ae1ac5e8af16a25ec0fcf26f21709bbb7d3

SHA256
2eca05cb70c733df74f784c731ff6b3c33a50b7997ba017e1ddc444ae4867985

SHA512
d29fb72bdcb10eacbc4f76ba4dd0464298b89b81237eaafbf3c2b384f1d0718aba266efa83c4d2737223b1931ede210c41680e0c026f459ce5b859394570742a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cea59e7f1524170be674b1e92a197ab6

SHA1
7c749197ea0aae8ae4f2d7597be4e38110ff5655

SHA256
500ad6d94f154edc18839c92ef77333011a95fd7602bce2fdc7367cc0db25d1a

SHA512
3126b9e97620d9a76808d4ac37509afba4269d7a540cb1728fb9813ab88dbaf837114a2a8a2234587b8591a480e9e1456f5c219e19581538addd62c8940c1782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b93dfb11863124e5e72ee11722d9c3

SHA1
97018b0b27c9bed7cc21a74847410d3273e6d1fc

SHA256
5104e631c63b7dd091aefa571f43dbab6ba8df9d53a7ec49a6c346474061bc6a

SHA512
11ac4f31ca86e5f8e13b163a3de32391f8d61ab44d7e272474694385c01e414c219392af641ec87e3be20ff9b82b237c3b13b1f3632f7f1224809ff46d4a4c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
983bfbe2a0f3b61ad776dcd290705fb8

SHA1
06f810fa40a85f163c44f73edc13523e0954d6fa

SHA256
8e29feb4d240d76835062ed05baa02cb0a485737a77df6395a1275968fe9fa1e

SHA512
c51a016cc36bd4b378313f36f4403960461c19570396296581292b2a55d76d852c0b4e54bb5c8f4b574e333eb846428c74a8528e67c99e8616120ea9ad101f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\jquery-migrate.min[1].htm

Filesize
807B

MD5
db46a719c72a3f5c71960f7e175c89fb

SHA1
1612c889151412883107197adf93e8e460e42b87

SHA256
6ab3da3ed1fdee5c35692a85d6640a45286cbc3f33a1470f6490d7344c312067

SHA512
25bd5e047e1cbc454ce23e436eef723f307b87d0fd863cbd9cb8406d41f21b5f20be6a4ec6b4a49731aacbbafded455fe47b9c74179e714a207192a7c0b35788

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC71.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit