2f784fdb396284c4456a8ed7b8f5fb46a3cf00dcaba23f5c538fef43b9e8ad75

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6887ba51cc9df2a9e4db4fdc9ddc66f5_JaffaCakes118.html
Size

69KB
MD5

6887ba51cc9df2a9e4db4fdc9ddc66f5
SHA1

70b155d967ebcb0cfeffeec146000206631ba600
SHA256

2f784fdb396284c4456a8ed7b8f5fb46a3cf00dcaba23f5c538fef43b9e8ad75
SHA512

58c0c95c6e06881c1834f2f5e16fb0e57da49f0f4f849b99d551829a6365518aff1c1153b57f605de4fe488cc97410f155a35e392392f9e9bd9449632c16bf51
SSDEEP

768:JizgcMWR3sI2PDDnd0g6KLJxy+oT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVGQ:JFz/yvTTNen0tbrga90hc+NnhVJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003005bdcc2c7f9f4a9246b01561fc3d9000000000020000000000106600000001000020000000c85faec076f61998af95cd04192f035265d07100cf552337a1416584114edf7f000000000e8000000002000020000000bd56ccd02d5faa44d8c6153a5af471e2de571eb6e850985a06a7d1ae2c406c2490000000c3d4f3b8a7372cdf880ab62cfaed2c0f859aff310a9527c6bf5a3a71e58953231d49f9364a52b1149b87343649538314602703732de870fee5ab1af99e4abe108ba20b7d7f16e4793407542e6ba79c9ce58f554f743fa5f3e706a265bc95d65afe14ea6af145262312ba521f66e1e03d5807ddda09ffe0cbceb19763d1c824a5a5a29535ff75c04ef0b83c3f1382bc52400000005a94a1cb13cf66093aa557072616a03564c81ef55c59c36c1b3344bc6a7580333873d9dc8fd68a77a7488eba81e7aa873d12d5e2b456c1f3927c469d07ac7f11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003005bdcc2c7f9f4a9246b01561fc3d9000000000020000000000106600000001000020000000f970df2cbb9cd254be5b66102360e0c7d94d37baeef539231b47482389d66096000000000e8000000002000020000000684259b943e9e0d185e74a911a64f2f8aa7989c75d0c256c3841eda565f85cf9200000005efb59b0a04a56ff89b4aea3147f159970c32975b4914553357cd15842b9b9f740000000e23080d5af93f282504a98a3350b6370cf07268021ad8e8b5bbe9124f2dc634066d0647f2144d8d1c7bc5e4f50af33ea9186fcd35204f7f80255f7ddb7693251	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30035f1287acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DC11EF1-187A-11EF-B826-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571747"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2872 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2872 iexplore.exe
2872 iexplore.exe
2800 IEXPLORE.EXE
2800 IEXPLORE.EXE
2800 IEXPLORE.EXE
2800 IEXPLORE.EXE

pid	process
2872	iexplore.exe

pid	process
2872	iexplore.exe
2872	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2872 wrote to memory of 2800	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2800	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2800	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2800	2872	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6887ba51cc9df2a9e4db4fdc9ddc66f5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b762ed854ad07f85bdee1e452b87900

SHA1
4a25d173d577a0262b5f1b2d36ffc9f87114479a

SHA256
069d4987100c49c6f70ce2e4c63994bd612f699867fb598f4a9fb0035fd0288e

SHA512
69ebdec2f928e1abb09f431d2d579669d30e541b4c84a8ac072fdcd5a1ec5f3924d10aa4fd8f8eee454a988a4950be66865f125b8131b42310da9452718ffb89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bb033ee3d8cb4a419c0c116ac07196c

SHA1
1ba028318ed2e64022a7f05a50d8bca3796d9e44

SHA256
8db873e4771c613136666525addda241237b047fe843166230d9a0ed6a52dfe1

SHA512
ec02d27dbab9c657500ab12ead2d6d111fa212ad6a8cd3001188ea20b5fd3aa43e41871852e04f5dcfe23e24e4dd436c4150371e9213476797275a2f31ed2f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
666e2b1eba41b38fbdbf518911153cda

SHA1
b77d188738b4e8e99070ee83548a8063595f1516

SHA256
03490cbe89ca54c742278d9e6457dd700eb933bda59cae9bdaceb5a1a25cbf7b

SHA512
c0f98b5728b01174265a38637a229cb5668f2ec2bbedd028b382a0c692e5458fa27f5003beadd28397a6ce4064a5ffb1a860e732a5e42cc3ecd89c3119844a5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3144e44e25c3de137dc0920b3c329f2

SHA1
e94f1f6fdf06c19c05eeb926068b5bc5a8fb996f

SHA256
e31c4dbcc254779257b5a748f8d9d2f17ce4e7bfa2b1558aca8572b4da905c64

SHA512
c50c18f413a138605e7654b019a05d6fc6ebf776a64f9ed633181d45ea12acb50423b9b7171e9fe2526a768e0dfa4d781c21baf97b91a10014d51c6d80a50e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3abb52d268b330320ad4053694496b10

SHA1
f4099be0386f1a8038528077bb24574ad512631e

SHA256
93f71b66d53ea0a92086a8043eb33c9607f3c98098f122bba7f95967da7a171b

SHA512
06ea2dff368d09efaba92e5c28eddbf8bf2c63fd616583e908be43b30489293a00a33e869887c4a70b32454ed035d17ffb81b95119374089e3f7c5739754aa22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df129b69c46dce046221615d46dfec86

SHA1
31b3864e9ae576d091550eaf09ecf1b58b049643

SHA256
c5b8df6f7c431e11ccfc708adee34d4131cf101c6ce72bf9d7d83690aa5b0324

SHA512
4ebee5fb91d4dba00765d621d7282a4a057f86df483c1dfacfde6c4678bc57eece2338da79e53af2a6ea419301e07e2bf1f419dc0d667899442fb7fdd56a71f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41426f254e1961bfaeb0bdc24fd7058a

SHA1
6a4cd4a66ab20dd7965e824a2cd5fd7d2dd45a81

SHA256
916dc4730a1192814019be7a0de051acb5997b8d09ffd607385199ed4ee64a2e

SHA512
2b3a79eb363df0e68e460bf1a5280dfca50223aaa0ef26f34fcadc169abd05e8029668ee8afa57ad5aea8bd628a0996cff04c4602662be8133ffee9c09bb5e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5a16ea7cfc79648f03a1f2e27554117

SHA1
dea18cc4e6ebaf41fe3228bca24eefd172a246dd

SHA256
b3e8a7721519a36d096f1c36b4477ecba63ffad105ec2cc59ecdb6a2bf8dc6eb

SHA512
bcdae276a05ee31ce57cc251cff0e7b5b000535411efdcf1fde3f3d20eb97e9c25667bb75abfc25775f9e63780e47c3296ccee3bcad182484e2052494bcb9a50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188fe20a74c89ef22033323b99943bbd

SHA1
eb403bdfe6bb1da5f2a9430d9329d4789abcb237

SHA256
af0559d2f92974255a367c327a9a5aae7372819bfe01cf09bfe2b9945a6683ff

SHA512
c35d4bf0ac71f08090d5f82435141257aaa19b2cc02529968724a59a5bc9fd731f15bb9081150e1d98ecb73573ec15fd87105b634195bb527c118d568f5aced1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f46029cd216f4e393720b0e4217a0311

SHA1
880355ba9aae30c32a506a27092eb7087650450a

SHA256
68eac882730bf4657daa8c0274dd9000eeb0bdcaf5af451015ebb1465c31e858

SHA512
a71b699652ea066782ec719664ab28d770f99d6cb6e107a0677adb99aaec50a44e7df4865730af73958686b4dfeb841d78629f174922707751c0d257ec9eecd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
507222de24cbad0b351d206ca307647b

SHA1
4bf264250b78f78e447788ba7482942a5cf64a4d

SHA256
1a1df3aba6e56cc017e2927d5edb2a7cad9ca1423569289219b450746b8baeb9

SHA512
7a334ca1b3475049f11106c5add9292498f8ec5315d897794140386b2eda3fc416ebf046d961dae78dd5cac47570304cf0ec2e64f26f54c76e1ce03d4dc33b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b6d68f88609838484ec596ff35e7598

SHA1
63ccd636942b7433df24a5c1c6638cb69c5a106c

SHA256
e077b3ec2125f10e9e1cfd651c53925f5723f6a1355809195daab6b297a052d8

SHA512
305aee211d94efe3e050dbabaf928c10b3b2edd0ec2dc4c20a3943b35688f9a37231a43a2495e69bb619f6952f9702d114bc81dfbf9ede380760939382c57a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A35.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3BC3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit