bd76b401857eb031c8aa38dd301501a99438d9e44b9a09c255d8796413b1ac76

Analysis

max time kernel
143s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687fe3481600eea7665a90d85776cb33_JaffaCakes118.html
Size

8KB
MD5

687fe3481600eea7665a90d85776cb33
SHA1

f1636c924c2eaad5c750d26370b8e4a76995ecc8
SHA256

bd76b401857eb031c8aa38dd301501a99438d9e44b9a09c255d8796413b1ac76
SHA512

3cb9f16236edaee9c83e8cd2f930bd168debcd49842a67689f903200b8e69eaaf8e85a36c6cae8167d28de6c40dcbe7f94a83984e8a79e7943ee53928289e89d
SSDEEP

192:SI7du3MtvcbhnEn9kYbX28xLx0Gm8QCJNUq1XNxEJgs:SI7klE9kCHsGJLNUq1Xgas

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6D76611-1878-11EF-8D12-66A5A0AB388F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000fac94b022c11273467bd17b4a35ecd1092df786e5d0c24c6ca4ef6be448defa2000000000e800000000200002000000047435e6fbe5d1cf0082018a2b01101c7622f41018856772a2c52983b43dca7b0900000002e9ecee43cc9fe40bc0cede37dd1c79ee28481a63382b1b0f28b32e6d1e74fecdcec391773686cdd0494f99a651f99debc78781e11dad3ab25aac7c7ffb6945662a74f04acd71ef4672f9e2490833ccc383fcc1563014ab91a55a01f4ed19843820a9221b7bce254271ba21c07cd9d1f3a36139e995d75d73c1877ea48858e9dfcf644357155592cb57da80a5d9dcfef4000000035f5c0f53fef4463ba364744131e6595e52e3130eeb85baeb09f1ddfbbf790537afa8d86effb3d83913f8e06011e0a42bc96e61a5d40055e533f797e43c34254	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000071acedda6802e10cbd74a9e6e03b326a9412639ed22943b74f4f328d0bb1e6c9000000000e8000000002000020000000b54e9cf5c81bdfbd0003fd398c429602bbfdc00bd09e65ecc3b8d5b88d0f4b5a20000000ccbb7e4e99fcbf378401fbb4542e00e9d76ee97506652493e57d20013a1a3ccc40000000ca439e63ed730d22f02f6516a85ee7713d9e0f92cd182170aee597b01af24a1e1a12fb9e88de912d091f9a594efe990cceb8eb409d670fa8f3d42373eb2e4fd2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b4459d85acda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

836 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

836 iexplore.exe
836 iexplore.exe
2372 IEXPLORE.EXE
2372 IEXPLORE.EXE
2372 IEXPLORE.EXE
2372 IEXPLORE.EXE

pid	process
836	iexplore.exe

pid	process
836	iexplore.exe
836	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 836 wrote to memory of 2372	836	iexplore.exe	IEXPLORE.EXE
PID 836 wrote to memory of 2372	836	iexplore.exe	IEXPLORE.EXE
PID 836 wrote to memory of 2372	836	iexplore.exe	IEXPLORE.EXE
PID 836 wrote to memory of 2372	836	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687fe3481600eea7665a90d85776cb33_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f6b99d7a0598b64cf8f8fd6df12600c

SHA1
1d9f1cfbb27e6c5fd250aa9c14f07e016a9c1b94

SHA256
968e298deb6b1ea1b1110ab4edfcff3b7a952ac5d045ab13cef06248ce18a4a1

SHA512
cea4cbdcfb038d39ae8bac7f2ddca734e16c6a45530110f543fe084e308b3376d36bd583cfa4e13d623df8e43ab6189043ec85fd778971dc4177430a3b5301ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eaa20d8675accc4d8fac4ae29c62cd2

SHA1
2fe25ae4fac5853b0742564653f0013522f60501

SHA256
571611fdbed5fb9059b2426ff46d147165524857973cca757951e5fbc56bef11

SHA512
d8b0c239f8725f7f68a046b0bccfeb28d3681941051248c115c690eaa64ecb1b760a1ba6fab1782db18df7cc65bd90f3944b3de6787ebfde262216ffe016cc0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1b1d91fa9be631aada50a9234ae0f72

SHA1
253cba1b5d797a1c0904910fdf448b2b6c9e45ab

SHA256
5f57eb48a7e21741f33f9558a0a2fcba122626616b4ae29e53f67e89ffdd6211

SHA512
7d9b7d4b0df2fc50114de673dd9dffc8b80c4e709c3be80f3516071e48d6bca1fb41762e38b2a19f7450580074abf2bd8e80e9da3abe64cacfed1c8a7859cce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f29025a2e1b2df0cf2ca7873e63da9d1

SHA1
339ab16ee784fc4f93b9efee39bb7b4e523a9c5f

SHA256
461f72a6539dff08019db49a5098d9d9073ecc8ace636823ee769233308b0881

SHA512
56f48e7ab012ceead332535ae4b0ed6278bcf674e74d2cf87bc0f060241291fe964cb32838c3a36ad136535d686baf7f9efd96c1dca5366d732ca3b7ff37abc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd62a409eed4813af1cb65ba0fbfed5a

SHA1
b894c566bd6e497c1f6121366e8d9bf5535b6375

SHA256
85f7f6c8443f3e0555dd6e87a7a652787dfad9931725d773a0b8b71443380d60

SHA512
80cf768e36755e3b652f53212dd98b9fd1fb51a4da235049afd1a9e3635292eeccd4895f60a75138b6e64b175b766e7d96445d287a08885f954e2a20f3b9ccd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c789684541b43f89587aa1affea79a70

SHA1
01e836ca84a04835463b6658cc5e7a67037daa2c

SHA256
4e886a551b65153857f3a71a2646d3ec37248707d11bd9536816a24720fc6caf

SHA512
f2fcf9023342b3b9daeb4651b7df076cfcdcd3996e154c03afec98b455e881f134926b28e3dfce18e7fa496b57a2f91ba676b1214db71f256e2c566245eeb86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9597c175cb160109590499d31c4ebafb

SHA1
1d83498645f702d6037d161d5521a39990021515

SHA256
c492b5b4529194953299f500e0f1599a58b2bc87192737ad6cde382d857779d2

SHA512
0d86d471b1a9813138929e77264d66786d8936bb45a0e27bb6029714a5acc8f1f044271f36a6c77867b7a42824fb20b90c2db30886e5fe284f85f159710e747c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6df574d58661ac58d49e7f75a05fc8c9

SHA1
91b69af1f4bc0488d31fad2653a33016e24bdc31

SHA256
151cc947e38ae2d2e01eb24ef9e361d1bb91ebb3ec111b8fcdb22d8ff7060462

SHA512
fc728a5085abc00a065f8d4bd13f3aa615876b851152a8061538e13093266e7f59ee8714b3ffebf3c60ec956de95924c444d4fd4f717871d63bcf1ff822366f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05e2f1f16a7e0115cd864c00a0c127f3

SHA1
9bd5a7f8a2f6959264e76673819d52b1d247f7c9

SHA256
08aa93a44f43d2f3812cd9e958b590cb6fef22d12e450857b3b468a66e48a776

SHA512
e167719ddcaf35cefad4bc8979cae7488d1af3dd26f6862c0a79c4773958992981399c03cdafeb7bf66123eb323bd6bec412de75eec48e59521147092cd7c382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c075ce0a313efde387ce314f1e7d2430

SHA1
eac850736b72fd7e69083b5d3de1c78be3f67261

SHA256
fcf95d9fc5979a34eb2fa81e5a4d79c5d749976c473ad232a22b2ed46c1d7bbc

SHA512
c07ed6ce6d8ddcbf2a246d053fcae0958752809e6899190c2fd87a624c78ccfccc89538d6d8af89595c2ab7854bd44aebf9c6dc342d7e2e50ddcc4a8ac142247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d35cdc06e41b827c63e840bbf5c6e7d

SHA1
af8f4382664515a0e40dd23bcc3c2d065719401f

SHA256
086adb201301098c4ef94a083614796286f049e88d1d6ba1ff5a2e7c0541b213

SHA512
1939d85bcbf37d27cacdeadc21c20263ad8cf5fd86b036fba017a830544d6bda35840c5d1452cf7479a86cf780ab8789d39ff3e65ac22c2bd8fba2e791b770d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d2c91fd966d20c14435d2b10e5805ad

SHA1
dadf4c10ac67bcdd2b79ea9435c6885047a7148d

SHA256
8c829f25e11839e93e68a7a06430f31ecd740d7c3e528d96f9d906fc2c97ad34

SHA512
276690b2049458027a632060df1c44a91a0e6f3548375799551a54d637c3c0db25f99c4c40900630425aaedd89e46ca0a575b2ce657bf33954ebeb2b0ec461a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c379f3dd440b7206efd1f55791f2e5d

SHA1
63b32e2cf5ae5275086475581b83e0dd0c61c6d0

SHA256
0ea5357c7cbf536a9c5a43728a705ab62e52d9e323bf727393215fdd868cbf26

SHA512
6051832ed9653537152f9d4ff7b139a750ad06554ccc924cb278d564ac4c4f12abbccf0b88cd5cd258499006b80498cf1f728897b0696d1958bc903a843703e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4675.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46D6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit