c25b4fb340f5650fd7a158fceeebb3038d0c854b235d52a0afe4e7f0df113453

Analysis

max time kernel
135s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6876668510648eb925990f277baf8130_JaffaCakes118.html
Size

36KB
MD5

6876668510648eb925990f277baf8130
SHA1

2b15184a70ea5145e14c0a54739a2cd5a73cc082
SHA256

c25b4fb340f5650fd7a158fceeebb3038d0c854b235d52a0afe4e7f0df113453
SHA512

6c05667ede0a79604ea1c48da582b9ee4c9d617abf16d47839965e94d6def851683a9499d5188cc1ab015b655f28e908363437551c30340178e68271258d45b6
SSDEEP

768:zwx/MDTHCE88hAR7ZPXaE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T9ZOf6DJtxo6qLR:Q/DbJxNV9uCS+/Q8gK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e83fdc83acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570353"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F988D321-1876-11EF-9BF1-5630532AF2EE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000cbbed9494381ea3895722d1a5156f682eb464bf0a3837d7b4c39892ae989ac0f000000000e8000000002000020000000ba2328cd66a9c59207e57ad796e9101a473a2da8b3e19b7749d2491d6456c1c6200000001c782486c307964c2ad2efb7b564a9655218a700a489668556904b98494805ba40000000a528027e61b8a153e3355f9f2578a80667dcc6e772e4eec2ad7e3030e5024e3f1a9d934945d8408e76720b5eee7aa7836867bacc7e6906d36b61f6abbb216095	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ec452b4810169f4ab2d7222c1fea0957272bc9e9f7005a855273b8a6ab441fe1000000000e8000000002000020000000fd5ac030f7a7bc30783760f8ab14395fb31e8b6da35870856472744cb3aadfa990000000f2b0b1a12224414da728c6f888c0aa5292a6185c05f85b6e8647006f81ce971bdab7ae051a01982991c8e0c2333e572bc9eb1caec3bc5c5f89ecc09b7102f481c5cf54cf87f5164f1fee84c55369af1df0478504661d814612bc42dc45e316a4048262f2e82aa6ff3b791965fb968f21915fb441aad2f74e09cac50897cc3eac0bff7ea34d040c6b5c6d9cb47870c64d400000006617ef2944672bce39ae691bc3b16ddb72f4150b4bf14417cfd14e3399d5f38f30ee3696f01b39ab430dbb3de772eb1e71464bfd82e9b143384c2d151821815d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2108 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2108 iexplore.exe
2108 iexplore.exe
2588 IEXPLORE.EXE
2588 IEXPLORE.EXE
2588 IEXPLORE.EXE
2588 IEXPLORE.EXE

pid	process
2108	iexplore.exe

pid	process
2108	iexplore.exe
2108	iexplore.exe
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2108 wrote to memory of 2588	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2588	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2588	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2588	2108	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6876668510648eb925990f277baf8130_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
6728aea2631b86a76c237508d8ba9b55

SHA1
7a670f95cac088313f7558869162fe01c6dc0ec9

SHA256
e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b

SHA512
533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
3c9f03f2c4e9a652351bfa92404a9078

SHA1
8660d5637c458ddcca1531da6c9773a937743291

SHA256
5ef83b357426d2bedbf25438243081c7e2ac2f68dd5b02c6825a0ac884d22bf3

SHA512
49586474794170b399ee73f6951c7b1d9057789ce892208075127daff4f4eda0775190110583fda8f0b8dd714570bd206c9808f13e18138712c1ed7accb35b76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02df29791ef1ff8fc1fc13fc7b507d83

SHA1
168e1ed483c4bb728d554a9ecc67ba006a605724

SHA256
a054f0245fda864d66a761a1609f71b98b4bf2b6735cb4b0aba9d99569065c74

SHA512
43df73856c4f57f98c7129124bea05e609b51128430405f7988a953fd57271fc265cbc9a48c1bc38fc8c09b75bd41e5fc5e99b0877abf8733034f118df0ace7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b039c2501a679f8bcd852e660945467e

SHA1
285d8f6d5ef455213d49304197d35e5c08f144ce

SHA256
c88399465884c0a03fe81c1c723c95a72238e3b8eb44e1397854fdfd14008896

SHA512
1b87b0c8e07039fb676c1c048f204613c10d8fdd985ba54f264236f06e339cb624459af6b93fee4f8f19a2df9b616ed1abc8dd473e159b3dc363dc1dcd8bac29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e3022441474fe59446035495818857

SHA1
cdc414ca68dc8bd121f76799afb56cfe99609a17

SHA256
65ab4ae2e516e4045951cc706491f856071dd8901b810959612f7c39f8a10bae

SHA512
9d5919aca26c4ac6dd517b2867c9eea09c552451a408ca1b581cd702ce1f592a555cd3fea93ca27687ed69dcaa90cc861c5c0ef965099ac5500ed46394846119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf107fc5932ad11f87ba488a4696e2f7

SHA1
4f918fd7c5ea653b001dbd98baf09c61de1950dd

SHA256
e5cc4057a96e7054f4f3cf9484ddba877bd4a7488d27b026c06e63bf09d46bb6

SHA512
e3ffe9046c9f97a570959faffb892a7be490082b598e93beef44b2da1d94728759bf84749aa95f19854bed1654fd7f7e1edab527ddd814407ef88d254ad21a77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f77f2400917d99da2695e0f24a985de9

SHA1
89bffc7257d91670ec7d4d835623dd48586c21a9

SHA256
8ca76e737c26f9a8abd3569451eed545f7694909064a6c21f9e746e456064bb4

SHA512
628c845ef86d3612ebe45ed059a63756e773835322d0def00fddffe605eeb2f918395b7b4745283c1952472eedb27bb04e6a0ba131c2b690b63aa8e583f8a081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94c392ac57324e9d7cf626accf53aad0

SHA1
c2cf17af752a6a9afa1dca2ce791682d64817034

SHA256
204aca7a1afc19f3d9f6f35356a3a1e46277bcd5ac19a06f30f25952eb795cc2

SHA512
632ec40551de2e8f046064d3b5dad9592ec8ca7fa9f892b59336e315d3601ad183a0020d51b9dd56cac94f2165f80ccc59dfe722d7ae4066c2412f982997136b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
476af35227ada5a09327d7b19a8c66ef

SHA1
91bd1d5c2e1a8954c352d566609d2276915ece1a

SHA256
18b10068c75b1fa4cc36067159d3086705d0e4e2ca2bf0446c9dccad90dc2b11

SHA512
12886f75e6af5791ce2a67f100c54487715d759b5f1397425c64431ccbe8416d60dc5f120e1edbf391de1a15c517393aa1c6fd2ef0f6b0b3149eaac132940556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efd5f5820ab59397279549eeb906911f

SHA1
cd13541f7ab44d0086b4ed1376863e462a6bc6de

SHA256
41dec06e8e57fb004699a5ddc64044ab57b54df61df5d0bf6ddd04d6c29bc4a2

SHA512
50fee3ce2f15e0b84d46a32a6cf3199be7de6a556df6c05bfc8393b0f26993a9d2e17902aec422e58e98cc409f5fe632242e5a3904b85b3f471404b2e2321739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a85e9a96e4eb4de2b35b76b83ed6d6a

SHA1
cffb3ff2231ced6451357bd2051774721836540a

SHA256
31c764720a54e2cfcabae809a0da33c2358bc4c5c63dbcba70a46434cdf48930

SHA512
50fb097cd6a006e16543a9524e403741252431da3466c8e7cf197bb646add3cb4d6b57d98beb4728f41829ac512c14f4a5aebdc0680b1c7decb885124869acd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1948b5d4b606fd4f97141ed737480fc

SHA1
41fbb15e2861c6127f3c962bbc24571bdf6131f4

SHA256
af330d576888c0bc039162c9d5f1f3232198e6c13580e6ba6e4406b1591c9f2b

SHA512
d48a6adfb27130dab7dcfbc66eb5ecfd592055f25a7e89db9fc9cc5ab75975879d5d407f507db11ef26b5dec6223e0e03ff4d2501bdac0d4c9175bc5f05e4324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
fd529bf8d322e08a066ea90f7cfdcfd8

SHA1
f8ce3769c20c7c36ddba5b92168fb238c7155b55

SHA256
dbe5473b7c3edfea0b9a4b0a292d72021a3f5bbede3243b779d77db49a99c5c7

SHA512
1c2bed2ae70995b3809d3146c442a73ffbac308ab9fa554bd5e905593aca0161f17862107371f825d45e4b7b839707c3656cc290f2253852c752ac8f6a38624e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab175A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar175D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit