661a30adf529116e349b5e462dc1ece8921c905b2179ef9680166eebb43aaca3

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68686496ba9d58879a2797fc299672d2_JaffaCakes118.html
Size

59KB
MD5

68686496ba9d58879a2797fc299672d2
SHA1

483a241fbdcc74bb2d701a18b1eae3632375ca48
SHA256

661a30adf529116e349b5e462dc1ece8921c905b2179ef9680166eebb43aaca3
SHA512

ef8d60cc7c8d2a248c9cbea2acb5868a889001928118551525139ad9588ed4b337d88b93526edee9699cd0916c9abf8c1e8478c685284e7f420f0eda67f2c7f2
SSDEEP

1536:ZpF4SuDqtClpjIhEWmyP84yi/e8aoa6q0Z24rx8lFI:F4SuDqtClpmaoa6q0Z24rxgm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CDFBD51-1874-11EF-931A-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000008dbcf47db8a5791bdacdf4495d2c4b7b955b61c92c38d6970bf2e225ae6c37000000000e8000000002000020000000e397be258ab8aeb56ae20d5cca4e78f30b505de9cae6f3af25a57205c5d1c63390000000e0231dd9ebcaa2f011960d10480f53254bd8d44f4a3b0ac6f4fdbf61a8858a2c831356c33d3f218c3721ec0e59e1ebdad66124f717f23a2f7944642516f9010c2376fc425e262018bf2fc5f4ec5b35d8e3f94af2fd44870f85e1df473f69922cbd757e13bc2994276253a3a4550778a1af3b74563ceb36447f0baaf2a66ed7f8edbe72925c294d19e0aa49d57c05976f40000000e9c68d032dacb1b9f3d6065534f206f504d2df590a6e080c4d447d6bce7f87fa6d62e5cceaac2d9b39c8e55a09979d0fd013a6e1c4597f7e00780ee661ff6e21	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000085ab8f19e0c118a91c2aa842f808a981f43781bcfcf971b00fbd0ac33cc402b8000000000e8000000002000020000000db5f915ee8f492011e4ee171847119093b9e2d97cd2be611093c073fbf27a71720000000974d3887fc9acb64fb6fc9c9b26a4869a72ba193eaa88f337cbc710d800acb2140000000799a7e42ea1229ff81fd506eef5c5850827df50b1c9111c26f36a23c0f28563419f61c73db35e73bb810c26aa65838c70a620eea6260d811bd92404d4dadd621	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d035084781acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422569251"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2184 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2184 iexplore.exe
2184 iexplore.exe
1836 IEXPLORE.EXE
1836 IEXPLORE.EXE
1836 IEXPLORE.EXE
1836 IEXPLORE.EXE

pid	process
2184	iexplore.exe

pid	process
2184	iexplore.exe
2184	iexplore.exe
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2184 wrote to memory of 1836	2184	iexplore.exe	IEXPLORE.EXE
PID 2184 wrote to memory of 1836	2184	iexplore.exe	IEXPLORE.EXE
PID 2184 wrote to memory of 1836	2184	iexplore.exe	IEXPLORE.EXE
PID 2184 wrote to memory of 1836	2184	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68686496ba9d58879a2797fc299672d2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eb066cbebcd5b8f183bf031dcc9c8b1

SHA1
ccf2ad4313ff16598985e2f4ace9acef3bbb67db

SHA256
dc8381b3bbe7ce9566634d5b0d8cc37270f8171bf1a6057705a5e5e2d2aa6e71

SHA512
d985aca500781deede2004f6cc33e8f1ed45cbf1f2d2db0ea0c2ff4574938e7fe0b5b3890cc54f84c45c67a8471c9e1e0f54d6c278a261d54815ee3b5ae4d8d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88dab95d299a641b50fc642004135b79

SHA1
17539344c4df237ccdff3f15af89812fd0c8090e

SHA256
cfc60d26bfef88f2ae9cc84311da06335cb809c938ce3138e201bc3175278711

SHA512
438f31d85591a0f051cc36b58a7a4e846f07232140418b423a568ebfbb2ac393d1dc813d95de8c565631beef79a51a175cd662e84d4a4b2c07fba4b0c7cf4195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
139082a4fadeab93f115654930175aa5

SHA1
3ab2e657af3f9eb022c7437519b7cf36e5793003

SHA256
271f712751efb485088b8bc0a9ff7d8f4e9d859a90d0bb92668afa8e1c08411e

SHA512
aa196997946ce1e7da1c265b3dc0f958b63795170202ce0488dc7a71f37c037ceba746add84a975d3140bba793c02b2e936ab81c455687e2ed456bda1a34ab0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36f19c0f463036cec8ecbf5f7485dcb7

SHA1
7b0b0045dfe5562a6e7bb21d1d7f752b243063dc

SHA256
bef991c588893395c4a68d5898a71c584a8ae2fe261f4980e9832056eecfb762

SHA512
35a3a1436dc909cb454c6c94554be98928d7757939315cd8c181fb5f5367f3025a8ea3269e1304361586fa02c944ce26d696ee2bc8f3b12769da6b442c8fd9f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc4c4abb596f883d25f75e5f65632880

SHA1
2cd8dfe1c8e34af2844a5044980ec05d3fc68a54

SHA256
d6d6a89db3ba399648dec435e07371f3b0652fe7f5a31df08ec0ae5ecdd9eab9

SHA512
59abf74f4d83e309427f12ac69e6ca0907970b3c5e400b4745fe689af8789f80a5dd1fcd50e58f64d760ce6b1d59615af524e32d923a28b990e840273223ad80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c9f2d3490e86d3118d358191aa97e5b

SHA1
4ebfdc47bdf16e64f7b744520cf2a3cba8cff4a2

SHA256
9ea310b7381f26c6eea7459cc6dfda75d0dea883ba34a11e7cca2d900c1999dc

SHA512
211131bbc895592af44c08d15aff6203cdbff13a348dccc37ce3801c994c779e60455c77273549d6c08c7611a93918c717cfaea278eea901db79a3270c2b64fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e448a9f83142a08546242b884c293e9

SHA1
254736dd66321fd9dacc03e74f254b70c4318ad8

SHA256
213aaea3b067219dbadf2edf136d9785d0763306230465a7069fad51c3480814

SHA512
2100985e966421b69f289bbbda0b252a193ae31bb7984e3bf368c5a331ee7331fd14cd4f3dad28e1f2bdb219960c7d09a6ba00934f7a667717dd7b15dfe6b48b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8d7572249294a8fc54b2dc377742d35

SHA1
bcddd9de062cc313c66c0ddaef2977ea5da943fa

SHA256
03ca49b66f6f3032aabc3e2323bbba78477d51222fbea554609fa95072bfeec5

SHA512
f33038d3f23f4f54f79135b110c34748b60889481f0defc187fa06d4e98ba50b070356af53faae0c7f5dd39fa541830c939f352946896a17594d87468752ad2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
260ba5d52b6125c79cfbea54e17eb881

SHA1
1e8821b6f373dc1141863841bd9a72a4101c850b

SHA256
53ef530b1e88353c479173694d15bc09ee98a43994225729cdd23efd9014be25

SHA512
fa38f6325d4e35e5ed9b56d3b59af69c715101da49447d6894d404b71d4f989f9565698ec961e0f8de1276f64eb0c29f9294f8c476a8e8e76faffb82e1e66cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dfdd6ec675d7d1c2d92deeb56ec06f2

SHA1
3625accd45ab34f088b86bad524ab73e457dfb29

SHA256
5edf8d2f6bc2b3c862abf1c149143300328eb62125f1a9b18be5b29ac9d912b3

SHA512
6c56e376d11225cfdc6d3a3915543e6d5e680404fa86c6638e2c4ebbe25185b0a956e56aa6788d19b886cc84cb2e83e5119c1ba1915fbdd9ab7916465b631421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fec3492410194794c56bd6cd4e94beb

SHA1
d9374e9ecb4c0bccc5f4321a73490e12f3625b59

SHA256
4438a907b21790e36bbca148480e3012b44a58258f4608ead3a16944ed35770e

SHA512
8f12a02e27034cc3302b119b1f8a77af38b6c92055d7320008f0e04de82f2a396a73e3c7d02787c89022ef65f0587692ea14104d744d370ab00facbcb0f0dde0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2ea02b91758f22e006901138d16ef42

SHA1
ec7db57529ab9c648b3f170cc94ec994643981dc

SHA256
96873f8a5965d4a322916b1e31c569a20c58db9d73f7dfb63b27db82887bdb12

SHA512
7be32fef1d2d16e46daeb06b6dbe72051edef8a38e55882dd5d84295addf64f8afcf31edbeb6e7f5970f8250543b0bd4aaebe8a495788e754a95ffc888d0626b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f560ef7c68d430aa928386266217f04

SHA1
1649f722c06d34acb1600d12ed3b97f2ce124178

SHA256
3d568c6b7e36baf4df908f9503649776282a2255e0c55d59fd5e68e8e6fc6bd1

SHA512
73f7dfe61f85de63df094bbfb68f1a4f9f73c935d17ec4b68e51b1ae36937b239d2ee965403de7cf4ed0c19e2d90a2390a1db16a2e932b92b810f702cbab5435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5820.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5822.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit