ce2af469b24c48b9e0f999d93843fdd55ae6646e2887021eb7b27a726c8570f7

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688aa9d6cd99e8e6a37c51651bb717c1_JaffaCakes118.html
Size

114KB
MD5

688aa9d6cd99e8e6a37c51651bb717c1
SHA1

64c6e454f624b0868a6c47ee4ab08aa02aca8576
SHA256

ce2af469b24c48b9e0f999d93843fdd55ae6646e2887021eb7b27a726c8570f7
SHA512

5cd34ee6448c16eabdaed85066e4edca27b7505b76df62bb8e841adef0df25244036bbe627873018f8504de321edbdb90d70284ad78c16310de9221d76e9ec36
SSDEEP

1536:kkclJQvH8l0v4hTO3nOUkOuOcOrOJOwi+Gg1r7Grg9OytJgUKxMu:kkclW/w0v4ha+UzFcT4Xy0UKxMu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E418DC71-187A-11EF-A9A6-4658C477BD5D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000176292a6635f2ec00972f608bea8a0109231e19000c0c8ca288975a18e8b5b3000000000e8000000002000020000000e264a8e6ab5675fd35c10b8b235a77d84f48b6db514c7952c422a035dbbcfa3c90000000305056ddf95eacb4721cdb9bba9471c086c8672656f4e05e2ac05baedb3a0588bb65459877206c019617a127a96ed455c645a182fc954ffb1e86145b59c325ee35de5eedf23178fa7d01187ad703e298f6a990d2b457388a5d75bedd4baafeafbc354b61ca61c445000762cbd6590714f3bca3bc768d8cb7c75b0fab4bc8e1d8963951175987f7e844695e77a4e2ea80400000006ce6ff7d38f1cbad1d76976dfc076979884178b4a763097b45833fbd4ab49505b80170787cfcf4c7d1ddfb33a03f40410ba9b690c3072c7599c8f76b33512f1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572031"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b16cc887acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000044d73f1b6040e390a0706567c8c08e0dc7aea515bc93590283bac8a999cf0192000000000e8000000002000020000000bbf9abfae60fc5bf811dd67b3d6dd5960b3ad80f5870d80373feac2755af7e4a20000000990b84fc5e8514578a156e62a5784ff1b8d5571152d0a464234c991b5369b6c34000000041df434065b4f2546a8ec6256cd6404c9712cee7dad6fc83cb63467cab206e897f8066e30545abc49348e941606661b61e355fd40596a18d24745f472783c425	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1956 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1956 iexplore.exe
1956 iexplore.exe
1260 IEXPLORE.EXE
1260 IEXPLORE.EXE
1260 IEXPLORE.EXE
1260 IEXPLORE.EXE

pid	process
1956	iexplore.exe

pid	process
1956	iexplore.exe
1956	iexplore.exe
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1956 wrote to memory of 1260	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 1260	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 1260	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 1260	1956	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688aa9d6cd99e8e6a37c51651bb717c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1260

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_146E1E094E96F2D77E1CDA597BE74F14
Filesize
471B

MD5
3d5c2b3b5dd478dc8f4e2789dff7c99c

SHA1
008e7e14a7d81bc1251f3ce1a5500edd410cfb11

SHA256
106d92f8028b647d63d24104d616c4705c2fd1a5fe48829990013435d31b4e53

SHA512
52de16edb1d69dbf8ee0bc7dd09e766da0b9ca13a05bea90cc8f9bc5096faf2526e6a3fcd9d1e8a36c678007bb7680578a809f48222456a58a1e2496081219e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
de06a27562100d67e692b6ef8fab68c0

SHA1
ef8f1fb0eee8152472aa1f5f11e8e7153de12294

SHA256
374758ad43dbb782081f0879bfae4fca400805deb85d064593eb4199d76e62c9

SHA512
dc6c91039acb0202a8ef1cefbb8c4fc1f08bcc3aaf53d7af14fda9744714667ea253f67f4c0a5c9595b32e0d4c5860c6c46ab49149cff7c88c31679b154d1380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f67a75ba37350c449236364bf4384a85

SHA1
8a24f67036da9268fe8540200659a76f6b2fa644

SHA256
24bb3fcdc0156a71c238917d2b544647ddd7370a295f5bbda535a32d6272f826

SHA512
472be2114ad513e2b2b100594755eaa2a551d3e383aa60b588045ebe3a874a6dbe261655171b7136375c2eafd74110b5e1473b5a904e5d6b3a52a84f71237b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
758f731b93e01a50454929d32e40bbbd

SHA1
8b12ad2585a05b771990dc653888e1730012e382

SHA256
984e9ef9442e2e81a7aa7fbee9db50f4e0011589fbae866e61812c08ebb99f1f

SHA512
b7e9fa7fcaf4ec3462ceb3286de4ec53a933c5af2ea6c2cd5b45cbd7d36bdb9c22c18b183b55318472cead880a93b429d3aff2a29c28adfc07b6bb1ad6f0397e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b70a8e3ba7cdf61c8ea6bb04229bd3b4

SHA1
c12a3269b646ad146d6d915962c44bb86684aba6

SHA256
462c9d95d78346bb78f01c6fab2022d96591d2e869461db43d10467a91183a68

SHA512
8978a93439a391c7e4de505b5a9c9d28c6b79dd0415ea8ed68b156acb7afad60194a493c0fc513636a9519f2f8ef6de1c39cd56a8247a80a127d41ad05676409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a9801bec893c04a2291dc5da51dbcec2

SHA1
bcbb6177769bda375c6a26a3bb18c26ddc3958b8

SHA256
8c1cb25262a34b91b668e80cd454ffc729406b0542030fa2ec9fd902bd710033

SHA512
2eb37dc921379b9c7eb44dd5003ed759b00ceb634d1fee6175ac77aad11a14c54255efd42a355f796c1ca2a47f7dd2f68b6cbe36249545f57e94580a908186cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f2a8f19b9f7353c4c70afe9357603f0b

SHA1
c864bac3a45a81575ccc5cb00410335fa1efb853

SHA256
e209810fe994fa8559885a0208272e5123c96dc149507754603eae3a32e05daa

SHA512
35e89a5b615c76f3e71547dfd2fad65cc08de4dbfbba4c138482ebd31a4ca99ae557ff3e490be52872a1e018a7d77c17969065d6c389561fc74ed02e923bf98f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
dc2c7563bf362f9031983a089399b265

SHA1
61462ba1d34b70aae91369da3af40a835d52df94

SHA256
424b1c927ee5a7949aabb4ab2dd5b85bff124f68f20a1fbd99103c4d6f59d579

SHA512
b290cea32f5b65821020672aebf8a3205b63ad92d2b379a42c15104079d797de8deb40e648e96f423771470f438fa4ea4d0a5a56d894594cf6d0c6f9a01bbd13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c5df419fad50d94da284f02ae50e6238

SHA1
0856d7ac5e937d773961c619622d8e4be67cd85f

SHA256
14defeec2f384f88f7eb1b611aaa7d1a33b0c2dfa8cd8886c4da81b026a02789

SHA512
8b89b47f8de792dd09547b9842981a1c86be14f6e8279c7577e6ede51dd9b6a5faaa98cb752e924b1f12d369d95f7659ab3b127acc5519efd6472f9127ad1f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ebf55a180c6b3a82bbd55ecdd14ad78c

SHA1
881734f08c86fd427a7feb176419da750a73da76

SHA256
12dab6c3966c0ca19a93c6ab72520c9fb03ec3c891e1e7f9d24470c424b855b5

SHA512
2d103fea1f5313c14ba2630775b850a56db153c50e84eaafb7f64f143bdc44279a3232766aba1fde3574e8c887429ae6a688a2ee255ae149dc75718a219eaa4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bf95ee275f1d0324b65535c905dcbd1e

SHA1
71f4e43c4913955c1d2ff3af52845544453a428d

SHA256
77c70c6af5a8615906fb6ddd804291e589397a0b6daeeea85e4ae9d40954c2d0

SHA512
78d24aac60bd565c0afae892485ff193168cd75adce743e1fa74b404b6d13760f4da194d39c06383e22c5f6e3af30e85664e7bae087b0b7affdd31cef6917f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d0715fb0dfe5866526ac0ac6070c6098

SHA1
0e3cb3b56f209bcd44bacbef5d05904e0fab4b3c

SHA256
b9d262b9c980601dec8523658b6203fd9da203cdb146e26724ab2e888bf75d72

SHA512
14686737d197a43c86db2febd5ef3b37fe8d4289f3f9c093dc5811ee048ec074fa530e62282d88cf7510e01b6de8102af65849ee23711434afb84cd2d8d9d8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\plusone[1].js
Filesize
54KB

MD5
fb86282646c76d835cd2e6c49b8625f7

SHA1
d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0

SHA256
638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109

SHA512
07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B64.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8616.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit