3695209640a23a4912d90298bce9b474529ed6165fd8a1f7e4272d665d5499db

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688aa6194951cc9fba92fc8df0a09a89_JaffaCakes118.html
Size

9KB
MD5

688aa6194951cc9fba92fc8df0a09a89
SHA1

0a276f3e213cb5d8ecb25c0254bdacaccd40d0b3
SHA256

3695209640a23a4912d90298bce9b474529ed6165fd8a1f7e4272d665d5499db
SHA512

be8c37d5f009b0c4ff503c96506021f4343650fe00fad66b18afe80791611c89de9e6351964481f392716f70085303d440a6279b7c07e005fc5a6706578c5b88
SSDEEP

192:P2c7F7SPyrsSPy0SPygOjIhRSCrqk+N7pmw1msCb7mcxcw1msCb7m9OnR/cC0lE6:P2qHsQHlk+jmwCJewCUOJcC0/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1B1E6C1-187A-11EF-A48B-4635F953E0C8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c67784eb0d5ac59036e9f55362ced4e8698e53ec6b092f8b3865794cccc053f1000000000e8000000002000020000000c839b19a1a37e83aece87e2ca96457430596fa0080c44f17a1f39d786c55b43090000000427cdbcd53a8faf1d15cd970e8989e1e4db757de937ed057f44e25d6b530018b0b74ffbd0a428d4162768bed07200d1ca75c61c037114b8e8f35dcc0c01af474304285b62f58677ecaca2bc72f5b2bbc740d3b46170fd6c747288cd8df8e5dbc22e15341a60da99ad768b5bceffc094425eaec61f69f61b92d2cbe7c9a355733b308b2d112fd6b90d6df2f3c56e6b3bd40000000ad7df4dbae99e4f5df270dc9b24b2de0fb66e4a20ac6e5b35382af7c79b7c6ca3c91170e9d43f29e6b184b2ed8b40c15a61bc75e045c9089478871ccc6ca60bb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b9a0b687acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000420afd72aaaacb8456aaac4a56baeca1fb1a577eb7881ccb80cfae799c821576000000000e8000000002000020000000dafe82caff3ddff8bc5c87aff7be86e4f1369a8b547c52c14a28492b2df0e638200000005cfd91228120f3b6afef1182fc1c8695317705f9a2c22ea6298e716ce6466854400000008da2c7f91543b0cdb0039d7d2273d56adf657c10fab6a3fa2a02c3060c63271bf324decb28276a0b4f766ccf275803307cbd4d7ed159cfcca7567bc5db6fac8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2884 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2884 iexplore.exe
2884 iexplore.exe
3040 IEXPLORE.EXE
3040 IEXPLORE.EXE
3040 IEXPLORE.EXE
3040 IEXPLORE.EXE

pid	process
2884	iexplore.exe

pid	process
2884	iexplore.exe
2884	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2884 wrote to memory of 3040	2884	iexplore.exe	IEXPLORE.EXE
PID 2884 wrote to memory of 3040	2884	iexplore.exe	IEXPLORE.EXE
PID 2884 wrote to memory of 3040	2884	iexplore.exe	IEXPLORE.EXE
PID 2884 wrote to memory of 3040	2884	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688aa6194951cc9fba92fc8df0a09a89_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3040

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8b3f114eda101a0692782bf3976022ec

SHA1
ef7680f5d8adcdb2f879b476654980661b62c65c

SHA256
00a7f7c398065b8acdc213b7b0ba156ee3846f6d16eb42db474b15f57be6115c

SHA512
494e38863934fedd0d694f0439a57327619176be4f6cc6930f506067494c1e6e9f720237d557c7ca8e76e34a7dd8412c10e8e41fd62a5b6ba1d9c69aa32308b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
aca1bea07249a530dc487863bca48712

SHA1
fe3791535dc3b770057b34a03e7aa264e92aa317

SHA256
0d3a0b0912b91737a2241ed2f33aff6c154d80fffa544b2773e80c934e1f4122

SHA512
bf2f84f1eb5ef32065e1396a781e02649c3c617150656f62e5238e44bdf77e36ba5358fb192c76daa67755293bfc6ff9eccd63beec02d851e2110f75c024fe5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7715fd71baf6866e9272e9bbb88448f3

SHA1
ecb1b030796cb2afac5581ddf1404ee35ab3cdf3

SHA256
d7c312d339eb1dab2b1d11a0c827d1279dba375f1e19eaaebe1c5053f187790a

SHA512
c888938e4b47accae83703715dc5e854aa3d915d2c150b59ee47b9072d4be3f741e1b8745484b4bfb1febce687cb63b1db1b6fdaed19822a515d0ee14a11648f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e17bcbf32bfc8ed8ae29c7670c0b4d07

SHA1
7915aad56f3dc140454111ddc9d24f47c0bcdf3e

SHA256
fbfb762fee208de9dc42bec20bfe82f49080ff8b02d97e61122ebfb3717779a8

SHA512
b351cfeef784cbdaaa3f199ba391f0790474ca71c00401bd7718a8b8742b04eab2d35fd6d4624b073d99b5c6194938561601790fee3c24eefafcba4e32f6ceff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1fde943ba6f0cc8a191bbbb5165f6646

SHA1
f2c05f815c3cba8db5a631858f26e83cc2e2a8ac

SHA256
48d814c2e4e1d4ef40cc79c4f439b2210462d16f22c4ff43f34fb4c0f5cc183f

SHA512
ead6b6fd73f27a4176a3027985b312e0ed93a7c260775d4d11ad62198c59461f11ba0c9063b44a5b24a5e2082cedb9b2fb53a51e9db8ab162410a4231d9c4502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
af6d6ad44e1ae628fd275d9300e4bf56

SHA1
79ab01626af0de317be5c19a2692bf76efed383f

SHA256
eee25e4f3e24e0ace241b56816faaa8fb40c56bb1462e7508127410df7acc8db

SHA512
f973f2447e47149d109d798f9303c7bb86213a1d86066cd82e8a23d13cee2f13d52c5f53426d1948bff69a46670481a67f4e99d6eba42486d057ae7c448eb1ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
90d4f12cd548f1e7d6614d9384dfd95f

SHA1
8bf13692e39f38e2115b8fcc452428cf42284143

SHA256
076481af42bf01fbfa07ed365955b0bd96ccd4f86eaeda42573f6b3ad7c9949a

SHA512
eb40d0f4f02949f3127cb013165bf2f51fac920caae355970d86d5b1ad8aae10f7aa7817c8a47ce0e0165b91955a172b2901586a9fdbb84eac23cb7deb64c4ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
92d82503ec8566e4c505adad0d940f3c

SHA1
5a812d7c35c7d4e886349376728229ba5aca0541

SHA256
5c61ae3a978b92957a2bf0b6afb6d3481ac324032faa47819dc3f37022b7d209

SHA512
e499ceaf2a3fd7b39f2866010cf684f018dfaddd9a695ddfa91b751d93777ff239de0bc1aad2e587b681e00a1ca389fb10ad333672e9687035cd2224b64a2986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6d5cf374135012a647b639894f5216fe

SHA1
c818303a99c029e1a2178bbc1c7657cf21874014

SHA256
7a7844308a31b58306e0c3487fbdb87d4a83b45328799bab2d27c84b23a59201

SHA512
deead93184bd87ce442a8b8bae8c980bcee96e4aea6bc2492eb086c78c3aeef221e6ac8d297a09e391540bfe0b05b5b1c4b36f1b01c678f6353a63e7b67053f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f047665e1c8f0fdc09896d5dce2ff710

SHA1
b85a1d850c7705ac3339e36d940f6652697e8370

SHA256
5ef0bad60f487f69a787439e27d9ae3f5d17897059680a0ebd319009fad0db0c

SHA512
9836be6f76290a64303b776609d505ae6e93f3662f6cf890bf61d80124cd08bd435940a6a4a47e862d60725f19bfd9f8b5c716c4f66fbb9aace262ef8f6eb97f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
47440eb992e92f4b5dd413cb0b441df2

SHA1
279062b93d5a64a8705dd532403a1477367391da

SHA256
d6e7a25c8f06b53bbe17091c9bb750ad81093c79e6ff785c5f85a464fd5a6374

SHA512
86d565c94d8ca633b98ba9e0d16699e26fe7773c8cb8fbb80226772357bf13a2e80f13e03524bdfa9a0868196c78127119596be03b9b3ba0c4fc22b36b9cbc6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2924.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2927.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit