de6060aff08c311b904aab90973214905b08c8b11508b9fc11897a2d77712471

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68811ef2227ad74ec842fbefd6cc096a_JaffaCakes118.html
Size

3KB
MD5

68811ef2227ad74ec842fbefd6cc096a
SHA1

cba05ccc766fbef358f8bc23951c4057e81d25f7
SHA256

de6060aff08c311b904aab90973214905b08c8b11508b9fc11897a2d77712471
SHA512

8a0ab7f818d465df5cc3d5b86b2689012954e2d50e603efea5fc27fb816189f6b255c124037071b88168d0d78b11e3f9b8a9b6c471b7875436b529d9e5eea4ae

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9019c6ea85acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571249"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14527381-1879-11EF-A4F7-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e42c697f5707b8b69f09ffe89ce451d5b19eadb0a9d66948517d4934e0fb352e000000000e8000000002000020000000654751aa6c8990df50ab627d342ea959e60f0764df04b194e4bb4ceec697b67a900000009304a5bb6d15513caedc3bca85c65fbe846c0e7e373dd08940a275eb282f2820ed13d327cba8b54feba1e0daff4a06f6ced5df8a6e7150c3bf863b9c17d24fb22d11f04972f91f4a09d0d1301c653513e98ca71e7edb0391985d1ee12a8e57d0483f3b9e26045d9e46ef96d5c4f34f77ac084b103f86ae8c81bf1b13b0b081552983e76586e2dbb290ec1a941fa30ac5400000007c1efeec79e58551388a46c70f34cce5408d875c017898276ba4ac890d16d0b7a997c0d70f1c94b9460fcbe631d1cce6ac2575b99d354ea496632c67343b69c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000006d8be0ccc64ab9160af87da6059e5bb0b12f4ef06409f0f54db070931fab07a6000000000e8000000002000020000000da969cbf51d0c4b95558d9923fa33d7f26bcd64b4e142452e8e83e60223fc044200000005db8deadd50a3e48a192f877ab5987fb7b6f9efce3ffd20a0bd91d57d13e707e4000000023c99f6989df869019f7d12a667bab9d099b536ff818f4317bd1b8060083a38a1bffb45e29b7bf01f0cbb09952a12852509ab5b7558566fff381f1d52f90d37e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2156 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2156 iexplore.exe
2156 iexplore.exe
2836 IEXPLORE.EXE
2836 IEXPLORE.EXE
2836 IEXPLORE.EXE
2836 IEXPLORE.EXE

pid	process
2156	iexplore.exe

pid	process
2156	iexplore.exe
2156	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2156 wrote to memory of 2836	2156	iexplore.exe	IEXPLORE.EXE
PID 2156 wrote to memory of 2836	2156	iexplore.exe	IEXPLORE.EXE
PID 2156 wrote to memory of 2836	2156	iexplore.exe	IEXPLORE.EXE
PID 2156 wrote to memory of 2836	2156	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68811ef2227ad74ec842fbefd6cc096a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af278c240845147fe81f69ca9dd93d91

SHA1
ed66fa5852cd55afbba658b85c51d945d83dd03f

SHA256
3effad9e84ca97a7a9eb9b24ed75089f2c8649a49661d6b2c727d30eb303a602

SHA512
f890485dc9280cbc28a083246224fb63ddd67e7149177f4d8400b678e917f2396c657d93b9e8b5fd857d2bf825fffa53b9e88af7da04dfa8bf7b25106165aee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0cfbfa49b99351525d4eb709bfd9e15

SHA1
7495e134da84b22dd49f66598906f8a4d20b5536

SHA256
e630bcaed0834c02e86959b26014e6aa919fdb6a1ecc37b3799e93762d2dcf31

SHA512
f5792b558b78a3ce78c78dceef75658b4efb5db1c0c85207a1bd831be38660efe71d498ca85eb18890c8449a6a973a292d3647bfe533777a418eccea4c436639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eabab771d71b9a84a91f05d8eebcdf9

SHA1
dd0fcb1bd5041e475306948a6f50433d716198cb

SHA256
a77a5aaeacc7f6228f41997118bfd52f378daebdeee3775069cd9390fcec96ce

SHA512
0e1ec06482c4abe92a6143fac99f5de98a9bec235ff86e8b5526d0bfa349f3239f22cc525034b6ac113a4af55f073ea05ddedf87270f4601f1aa243abbb6ca8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6869a03899b9e5e227eefd72a02b713

SHA1
884146c319912bef4ac18760fab5004307079abe

SHA256
67095c37ede6923284daf26bdee7f6566f915c107d807f7666f781594068d3bd

SHA512
5401802c15b0f8ea1adf6d5f43efb3df90cfeb7a14cb4dd5fe3ba036f83b6fc7cf2e4d2321bfc91694702186b0694f5059b1a4e2836edc124b7da6cd8b7129e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3037ab2817055faa34d089c83820a0f

SHA1
b94524561aa4e31fbfe6971b8b532df527b8340c

SHA256
e80f1e6beeb61520060d636188a46d0972adc8c9ba8791f0e25ef8871707a33e

SHA512
c474e17b817fe52c0c4d5426754b5fb4b804ef1d607661e9c911191f085963e847bf0525bcb23c05dad55115d72785efdcc2451360ea79878b71f7c32fea9309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da67cbfaa888aaad16c35795007bf2be

SHA1
8790393edba566606cee6be663d3a1a9108333ea

SHA256
1bb84a3b5af4d51632c13bb7e500648b8bfd1564b48d08b87485b5d18cc351a3

SHA512
8f351fed9976f01456a649ff7dfb071f023b277f3b8baff836187eda21c5c75ef0794c969178c2a02ab7593510a6899196822d98fa343bfe3092146845de28f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e8e3fafd94b93f7ec55cb8c97a9b004

SHA1
b4b79ce326116a3c59f601f88a576d39b79d5f45

SHA256
ebdc41e1a128861c5795b3deed38e51a8ff7101e7da82456ae4a341a7cd878a2

SHA512
44f068489347d5533e3c218dc6cae4b79d1c5597e28a84722d2dc327d8f2df5c0917286a03d4e3f69e6d99f2dc0bea7956744aa1a52288328337f09faa9537b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae6fb899bf4bcf0e0f6da6228672acf6

SHA1
0bd1f4d89d56580e139aefd8a29124a781a58a45

SHA256
16b0ea442b5daff8ece22ad6e9311363feb2a7265600de3ff203538c362c9637

SHA512
f083df42d98dce888f975bd98fa6b06c41237f13af51d844d99c2e69e6dfd2e7a29fcce1d92270d6a88a15af88e60b90f7c35c95fe83805c6d53e697b7ae06d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bd011f7189999765fba95fa17d13564

SHA1
1b280c85464cb4bb5b180c3bcb51c9551809eb3f

SHA256
1c77d6c54c94d63faa920c8c69707ba715051f1b3fc84b356214054ff4a50142

SHA512
353eb73570a68e947f4d8efded21d142cfbc0b1abccd38953e0d78dcb03161ad1af3da1a7d657beae714adc2927fc754bda627d2539bf9a4eb08d2d834f4ef66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3cb444903b989fb2d59e743a3bdc9f7

SHA1
e0aa2fd0952c7b38310078f6ae90e479b067aa00

SHA256
b0d53db25d41126bbd1a17d4bd2a8b8281c6ebf0b5530ed9d0f1676f4b7e3d62

SHA512
476b571625b0759dc6327597cbbc4dedd4b5e47ba482d8848918d3a8f3ffc6852fa7bb63320f3ef964c272d4b3f19221085c023020cf013b79d887854a0d8da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b0f50ca79a0837a6f04e1a315edb2d1

SHA1
5cd7baccb7b395564f8ab92152e76bf8590c11b7

SHA256
6913e8aaf5501454f09d54f80dbf2e85f17c755ec8c7d5dc79e90ecc7a6bff9c

SHA512
2510f016f328a2d848b340fd530fb3d5aaf98874f716c47d3343f3fa3c5fe915ff6cc818d1ea13f4c14e380be9c445468c950d25d7dab9da521431d63ebde5da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6117.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6129.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit