b7d86c9fd99ccca152ac031858e656886a0e3093806b712fc99763bca593828e

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687101d9c1a8a26b25a71950400d52ea_JaffaCakes118.html
Size

21KB
MD5

687101d9c1a8a26b25a71950400d52ea
SHA1

6252c1ca53eeca3aece365465435b240d404c0f4
SHA256

b7d86c9fd99ccca152ac031858e656886a0e3093806b712fc99763bca593828e
SHA512

a2254f638555e7c5eccbd741e01ccd90657e8c98a94ee79c208c43a9c83186fd5420e234ede812a5ca780b755d482d7c32e41e8d8afc293b6746d0e8b60b8d95
SSDEEP

384:zieKcRAa5r9DIiXbWVBD8c03RYAhN7040Wi07cmEfP4ycbp5g0vzVcrzDJZTO4ul:ziVa5r9DFygc03e+Qrc7cmGP4y0byJZu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422569966"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402627ee82acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000afd5e03d58a8a04b99f8b4cf08b4e8800000000002000000000010660000000100002000000042abd7b670f3c4049eda5bd977baacb801e89b83a4c7c646613667e45772baa0000000000e8000000002000020000000b829b925c3f64abd1b25bfc678cd68127bb29b2aa0501b1043829d149ce621759000000043aac3ae696032d74a0005f51b22ccf7d77a62d48e7666c32a2821489407c3b50d387b9bdfe3a95fa67e2d0cca91e21ea83224b4e9e362bcc25daf8e8905b1f3482d73a81062147401b2d403c5b9b6eb12c129f2e26d0a9bb5a4afb8bcd64ec63b56274fda331143ffa266ea7f93853a25ca055776bc17b5af459351192c185b8b4e4525b4da9e9337cbe89c9b952e68400000004ef5fd1b6fd5d27dd0d8a09a081b82256a1a6c3211c3c8b983e5b1403088acf543e19dbe053def5e098659d676df9bf44e2f7636b3dbb60f7c301dbcf38aa82b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1964A301-1876-11EF-A293-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000afd5e03d58a8a04b99f8b4cf08b4e88000000000020000000000106600000001000020000000de85dc9eaff4a7557d1d4f6eb18478bd0d02b18f756563d5e4833dedda12ea50000000000e80000000020000200000009ce2a3e07e119185a432ccfe195fb1a66262d942b6994444ca62a6764b2c19082000000000b9b1934de4985216ae6a84cbc7bf6f366a788f21bb07f4db7416bce4fd00d540000000cd0d6e4fb9275662b1ede72ce4b7e177585a7bf86897dd844da92515565e83312131bbcedbf8a2c79dc103a0d72e8d4e15a626ec792ed0deef7ed3adfd93d4d0	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2156 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2156 iexplore.exe
2156 iexplore.exe
3008 IEXPLORE.EXE
3008 IEXPLORE.EXE
3008 IEXPLORE.EXE
3008 IEXPLORE.EXE

pid	process
2156	iexplore.exe

pid	process
2156	iexplore.exe
2156	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2156 wrote to memory of 3008	2156	iexplore.exe	IEXPLORE.EXE
PID 2156 wrote to memory of 3008	2156	iexplore.exe	IEXPLORE.EXE
PID 2156 wrote to memory of 3008	2156	iexplore.exe	IEXPLORE.EXE
PID 2156 wrote to memory of 3008	2156	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687101d9c1a8a26b25a71950400d52ea_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3008

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6b6809789ef81f1c9c333a1f9b18c1a9

SHA1
0417fa2c93855a5e45e18b932286386121d4f69e

SHA256
a5155c26182995f9e520ef8450cbc65954276778610d267116078cdac56d8ce7

SHA512
0d8ba463c04f8b9d04bfc6348ec2ca51b8ec1d56198d23c28de43a208fb0d44057e0a1b25cc7f23f872f703740f8d721f8823e1f5e6b6e56d588ad9956b4fc63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
be0734a81e79303ef31e7542dccfc957

SHA1
c7e34f84ba16e0570fbf9c2e845baf5e0ad3822c

SHA256
940fa52966d44e5335d646d6dc11e30ccc4c84dbadd96c92f663138e695196ea

SHA512
bf5b4cb817aaa94234f2b8a8b940ff7749d3c68b57b47b9932508a83dea023c9de824342d730a1b1baab610ce95c219257b005b616a4204c32622e4fa144ee34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b77b322805aa9038252138915ff6b544

SHA1
b367afac948f60c40074bdb3975b48a87ef6965c

SHA256
582f6570ee8bec5faaf3f5664c1163adaa2e740fe1d091866c719f36b7db33b3

SHA512
29edfd0dde37a1d79bbc39523f916e0fc5c906248305d6a0df864ac09f5f5b91f4df16e5082ef2eea249246c5bb37c26fec8dc1ce7f79d56dfb62423adf4c6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
833a31224afa3b14d2121cd884f324e3

SHA1
a0146d4982d3ef4af5fed9ef4198efa331205606

SHA256
089a19fb8817881058a752bce9494f00bc004d7a75f400a6e5a0efdadda34dee

SHA512
40fd97161783da0b0628ce4f3d650a7117eed2876c03ee204aa08a42f17340bd7e889c8448565098623174606a0a3af4794a6e0c6a04aad8f9b2340e2aabdeb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
127fdf0df31c1eb4951e5e01d003d7a0

SHA1
74c0872d6671a28ac56e20a4246b3eaabb6aa429

SHA256
a8569baeb45dcb6c0215f13543ba27c5453d8aac628263deac55adcc7645e9aa

SHA512
40c99fbb09e322a86fbd523dad95b4eba60e53f7cd29d502bc0ee4017ca304a78879ffa453e22357b91e30df084193477aecea084d2146996a0e5485603a0630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cfd73fae7ea27af7a1179f5b792de31b

SHA1
a60ddf847e7be955e7227e947dfeff0eda896f8b

SHA256
1fe9c32f4630730bac72ea9aec3b99be506d0c439bd86c785809f7e771a2c81f

SHA512
a64eb965856202f44a38463dd5ae3a8062730207817d86ec4f5b7400c52dc2c4f9c638cbdd7b66219eeef24423bd7dd60015b8445170a8afe2b57ec4dc7770e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5594a62b337b2410878a937efc657084

SHA1
33347da69c354a705886e528df02c8c6157d822e

SHA256
e7a60af325c91ddcae1a0e82f63fd40a5da4015b1d2790ea0f5f7b2aa730346a

SHA512
9bf0db199ff14ce9a60dfeb39d29302315e31265318c8f0d44d52a22112a8c18667f1750370d84c50c808d6e3416c1ce7783f54ee5b389edf786937f7a5b6008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
601b00ca5cf1cc4852dcfe0f997d49df

SHA1
488cc3695e2cb2f97302cd93f7026da1e35f325f

SHA256
3e2edbf77d24753c7e8a67594d5d85415ea90f9a2a968574589177e14e832f66

SHA512
46eb79c04b9b5e5df9a3b64f66cb74b833a34192f37053134d4601e61ac11d8d6660d168258f70846176528872ba26e3e21d2f1cb03317bee377dc903ddde992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bea7bfbb043440637118a59a2b64589a

SHA1
11e58345b9bf39a84ede1b73d0f1c7c5a7395c66

SHA256
995b9768964915a7ca25d4d5d8bf683ef78bac1105c144b3379934abdfc2e1f4

SHA512
6137b0f5537978975fe4a60766d5ff70ea4753f905d4d45fe5a96d74ef26f196921a369cc87be690451fbf4b3143a812cf7ca39c374a28eb732f76c96ea8e07c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
023e0abe100b1acc856962f56867ccee

SHA1
c6605b32b55133903d85dea0693ee4ab0ac57dc8

SHA256
b55538577248a3c0876fd27478a62fb94f1ef86dfd8e6039ca073f9b13f801b3

SHA512
c99d38040645ab8a68a5f37dae04edd8d14a6c38cf92ca7d54b6c4a1f46255d179999f934719d9e53cd0ba2bb60c5303fb197eac6b649180ae2b98fd71252cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
85ddbde6a876201d343c6c2f93ecb7db

SHA1
43fb6e882fdc85260760a56e4024c7f0417918a6

SHA256
238e6341d45dae018b8049712ce69c8e609dc4079477aaff4461acb015170832

SHA512
068734ad4eb6d436dbec9ebd867a06c48fb7e933d163e83aa1f5c74d0c62cf026ba7052a46b8838b23be98da49d7eae1866ee765017b07ad6a2f9470111d2db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c146ec52288ccc7b8ee84aa6dc268850

SHA1
d56e99ea3bcf6ac76207dba093c0dd9c3098af3b

SHA256
c13cdbec086f8814a56970f0f326afd9dff14b43f84e30472d19b84127972fef

SHA512
88f73606dd921828d0c8c1d921b49ec1e190a47d20101d1366af756d14864f0b35fb022e2d0d63988643bb27a468631f4505edca6c631d07effca093e86016ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c1eabf948e2bcbecca9886cc6544dac5

SHA1
fffa7cc8f5f4f3732931812583e453f7c69a34c4

SHA256
d0e5893e68de8bdd3ef94918b4801743c4ce87d308ace02ab4f17b78110de5ee

SHA512
0d2693b48bfcd45b42db063936d462c10e31fb81e5c5afd8cd1c656e86059cf53f0546099d90b0e4eb0c0b4016c2c9da07c95c398e3a51a581f13aa97a3cb63d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f37beab773e75c02d7db76d8a89fdcb4

SHA1
925d15b304cb40cb75bc5b8e10d6727cd901f8ce

SHA256
6b858e869f4776049e6858f7d85be337a3a785ecb629758a0b3da9e0631125c8

SHA512
eb407ec0eb8f1d1ca09fe06e73e67e5a127e8ef52f7f07b047c1b0d3aa9a1127449bf8aec484c476d22f71aad6168bb7397403fa21f293b6af7e82e8523c74b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar308A.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit