b67f1179fd39df082206d1553c05ea4b68e920634bb6ba2e1cfd8c9209372782

Analysis

max time kernel
117s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68846b89f7b6f682b00d6a889e1afa6c_JaffaCakes118.html
Size

3KB
MD5

68846b89f7b6f682b00d6a889e1afa6c
SHA1

aa2e2cfeae34c559e0b192c62d5da0258c05ca2e
SHA256

b67f1179fd39df082206d1553c05ea4b68e920634bb6ba2e1cfd8c9209372782
SHA512

f9e96d2f321c3c4496e209aa1c8e0583fa5b80f0c669dbd82a64a1110f9c489655f0917552ae813cbbc9b152b168e9c4af8e8a3bc43e1bd56785a2bd84f16f59

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5E630B1-1879-11EF-8D15-FA7CD17678B7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0bcb38e86acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571521"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000199c3ee7b066454ea10df8f58518cfea000000000200000000001066000000010000200000006d66d5d8df9d1b50d80ed27ef744f8f3ad12b0d4fa8773c9e90c20e0ce16ef61000000000e8000000002000020000000a9bbbd47413ed9f0e48c466944ec9545b5f9d49b92918078cd076549e8f5ed3320000000a3b3ce0cda04fa99efd4a0aabc6b00f3ecb0a5adec8e984d4615c7ac6d59dea4400000009e9558d1f327432382d3a4ccbefd4908e6db2cb1f14d5f9b90eaba805d19ef674cff2c6f0c97908214081159ce3813c702cfe10fe376625f8d3624ace9e9ae6c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000199c3ee7b066454ea10df8f58518cfea000000000200000000001066000000010000200000007f82aea60be52ff938f86419b201916c1a98e0ca80713b8b653551ed8ba23777000000000e8000000002000020000000d1a844445ee25daf657813a18ff2e133d1c31eeb47f9bfa770d69d3185a2772c90000000dd5c76a58e3c1cdc267607e50e4e4b5f34b5575c8f324fca7f13502ef1d31b4232017c1e9686a116dea45cb8b1ba56b9ce51c81ccd4ef213f4cc9501de6266d7a5c45adbb066af6610eb84f350801ff62b5cb245ca9165cd64482ea47db7c96e6f668fcc4e3d7079fe76cb6372924f678fd7d7308c204e55dab3bde7f33cd103736a20b432465be7e0c51a3626d03eee40000000dc1923d03aa1b22548b16c81c6b0e15c16f129852f0e5c748bb0329ecf03b4b319148756bee101a794ad87176c2f8a2d9b945b10cb0688ed2299ab5aaa1308af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1736 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1736 iexplore.exe
1736 iexplore.exe
2164 IEXPLORE.EXE
2164 IEXPLORE.EXE
2164 IEXPLORE.EXE
2164 IEXPLORE.EXE

pid	process
1736	iexplore.exe

pid	process
1736	iexplore.exe
1736	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1736 wrote to memory of 2164	1736	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 2164	1736	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 2164	1736	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 2164	1736	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68846b89f7b6f682b00d6a889e1afa6c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
3d3ada40914557853af0c324efbbdca3

SHA1
56f783e6e840cd80f897a09f92dbf09071c932c0

SHA256
a4e23eff3257aeaa6b9ef9a7567f7dbaff7561102451dfded0ac067f26759fb3

SHA512
d88ac33f5a0cfda4bd00a44c07f5741e1d6e54ac513cf0dab8c3cbca44ff79582297988c34a52156a4aaf755a87535699aac17d6b29c1199dcdfbba4eb7e7c9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c17e80550651fef7ec556219576576a0

SHA1
f55ca8d6479fa506bc2c1588d64666971402088f

SHA256
14192f9288d04fd81de0046102e93f6f9bdd256749e243698beeadeb7bb35474

SHA512
8f58802c17dd0f848941e193c803477339f3e1f98d100fe6c0a6b112a6c9e380468e2ab91b2b79343ac7fad314362d850cda963f6d15d6d83f279c2e485629fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac4aee2da9f298026e82d92cf8399e78

SHA1
130d3f57d59a4e42dbccad9980d1c86b09774425

SHA256
8df207c9af1612b57046969520ee3164ce0a1001f3986dd228ace44f7866cd9e

SHA512
f4136553e171f48b448e0ec79ba92090ae23c56ce3ebc39163a968ccda3a1fe24fe225fbe55ce2d0cc8576f9a0ab6e19e190d1b759daeb421f7231e6be61d68f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
523958ce06a83746a7b63ca0ecf553e2

SHA1
2bc827efc1b696565c348da56d8d297f9c514654

SHA256
9f6e457b29a787feb35eb03027959c87e6b732b6d4456519796feee0c7b7eb28

SHA512
085991c953f60b1d262266654ab287159125990a56b8ada510c324fb69dafdaaf2289dbfc3e17b15ffa516dfb815cf3024dc04f5411684a75e651301aceaf715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d8b0495bd387a6919e39f99ba8952b7

SHA1
77611f66c2db867828e675bdd289bc2841477d45

SHA256
f33495673e248feab7d10b31ede469fe06a96259b1c2e739811c4162ef604244

SHA512
09eec38d0b8ff51d4b51cc0ededc58e2404e67e113c4b0141cb8a5e5ab87551da4c9fc1717f7767a6ba621ec33196c1bfaff8fddc3743c7a6dc5a726b28b02c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3d07767ba3db86ee60589a4e85d7a5e

SHA1
5a4a5ff662ab56e9f167779a359605bf0ce1b470

SHA256
79f8a94e036dee927300306deb26135f6086b8a098ab9053a7aa7d226a4166da

SHA512
a23f940aafa82829947b97ed32829411b3c46cc076bd4531192e9b09d90806dd363771ad621f9f427004adcb9f160d4346718f7e50d39643e9be011851ceb198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06f7267fd0b3b3513d86085630752ac9

SHA1
292e7a53d6eac5634fea5a07e9ad4f0227a1bb6c

SHA256
cc3a23f157759e8893d52a4e66b9c02a47e9e9a042d1a1c43279a6d19a5ebcbc

SHA512
8ba44128bca674bc0b81c9d0721ca34e4b020861abf93c50d75537a9b1ab153e4ce36b20edcf663a995ea176d9c2200fd1e384c2cfcc840d077c6ebe163343c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3fe5dbef66c9111038d74dd657c6fac

SHA1
d65763f885aeb0ac322fb67021b29afc638de32c

SHA256
8296cc7e2d8801a4a35dd26db4d6940c310d76344110ec5cffa85e8ce69f5060

SHA512
3d4968b7b6b1591fec1ccff153d37448a3abe498958e9fcfcbaa2d4249dc500e70388c641de6ec954e20d336744b967a525dea7d9a759c3e0b216650b4442e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3cffea0ca294dd9df41b7f14884a0c3

SHA1
00eade6f93adcf42c0a82d2bb1374c37fc7d1d16

SHA256
e609339ebcfeb86b06a3b0774f5b86bb8be6bb335f1aa914d4724b7bda1ecbcb

SHA512
8a0bb0c8c9fe5f85c9b6b85db276b6bd3b077244e3a4bc68f210e5b9fc9bd78d2f2364e9f0740b3c0ede7866e891da269c131fd2896ff4e00e958836d9dc474e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d5791116f352b5c757dbf014faf2c0

SHA1
228ef0ab11cf84a5a660bcc90d70b29cc6ee7346

SHA256
4c98b4c1426c0d67dd3055599dc97d369c9811bb02fe4efcc0490c51f48715fa

SHA512
1ca4e173f84a6b51b40cc0a9b9ec01cd2e159a09d257b844c1f229448c1969fd62e846a8bbf82f640336b89dd0207f9914a99398249321d6230a5b90c9b8fd94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c27e7d38fb14cb052e7ef32762d7787

SHA1
f33174419a17c6e6b10479e0ae8e1fb1ebb32a7a

SHA256
e8f0f00d9be66da0c1d37bceb6c715a4f2d09226d17718801cb6318499b5f111

SHA512
417e08e28c6c9df3aef405ef3e3a2466b6e018b52b59dbb418b8bb2b1d99be6d8bcb38ca40cdc72d143215505082d2b1bc0e16f66660fd9483571aa39c0b5581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
795e835282d114aed7035430bdf7e05f

SHA1
2ab0d8685302074fb26119d24fa636881ae17dff

SHA256
1a90cfcfae1a90a549a3909335a38e8f4e644afb1ec18c4a3a3e8fcef5041ac6

SHA512
c7c7e40eac839c0aabc4fd0583a0f98c71f2818f8bfdd240b3447886c371b81631ca9184c7bb822cf87283a5335d0dbd99aa8c37472099f03e5002af9459f4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89AF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit