7eb1138a2b978fc303688369549de44241904b12773284d33cef2013486a2d24

Analysis

max time kernel
143s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688b005e3a9464f44f348ddd419bc509_JaffaCakes118.html
Size

218KB
MD5

688b005e3a9464f44f348ddd419bc509
SHA1

a6918977416c8afdd8828c09ea6dda9437260016
SHA256

7eb1138a2b978fc303688369549de44241904b12773284d33cef2013486a2d24
SHA512

9593777c99f7d481dcc839f010fae0d8a1fc6e174a312193b898415ea47266fbf2b9d7b494d7d83efc2c333f9624d799b65ec0e962aa6c6ad447b3cf32557d69
SSDEEP

3072:SSUTcSOzodyfkMY+BES09JXAnyrZalI+YQ:SSUTDOMosMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572056"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000032b6dbdd2b9cae48abbc188c339f6e500000000002000000000010660000000100002000000092836dbbf8f346de1460d497b013bbd674111a82ad45071531ec396165894b6a000000000e8000000002000020000000e43733bc65be02388528dc717a5eb4168d67b6ebb55976aef89b9f6b98242ae12000000047326998553bb46a76b7d40e3bc59a7e8ebd7d137e5b3c7643415cbfb7f35c4e40000000defeedd162b9c752c84b350f1d2b191fd2a4d433d23a11e280709f0f5a120bbf0d0b8257af6e57b137e8d2ea6ab53985310daf7d1cab86b715acc12108b47586	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000032b6dbdd2b9cae48abbc188c339f6e5000000000020000000000106600000001000020000000d8b9a52b2376ec14f61bd8f1de9d78a75c6c5e91c20e9fbbd8fb2b842fe0e1aa000000000e8000000002000020000000ede9da3b18b0da6cf931b8b605f26af27e5b199178a0f1bfbbdf428de9ef96d190000000a0c4033cae29aa68fc0c324f3483dbd360a107c324aeaf7fe1d9463124532af9c5eb1a9e79b3ee815569bd216e6abaa48bab9c46486ca680cf4bf8f032021e4964a52b3acbecd6b25aeb0574cc443c5d85500c4caecbde5dead7e62c57cafeed5eb7f429d3fa3e704a8130e3e0b1662690abc0b2edcf74bfda6a6899912469d8d4ae91fddb52ca27dcdb0e56d7bb34964000000027dedf616090334c3c08ed103c0f6a0c19d395aa034a1821afc45d2d36abdd10708a267d8f4e44ccddb7c8a0fe8e939221b7656ea040b31329bbca0681b3e684	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F39798D1-187A-11EF-A965-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8035150b88acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2880 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2880 iexplore.exe
2880 iexplore.exe
2096 IEXPLORE.EXE
2096 IEXPLORE.EXE
2096 IEXPLORE.EXE
2096 IEXPLORE.EXE

pid	process
2880	iexplore.exe

pid	process
2880	iexplore.exe
2880	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2880 wrote to memory of 2096	2880	iexplore.exe	IEXPLORE.EXE
PID 2880 wrote to memory of 2096	2880	iexplore.exe	IEXPLORE.EXE
PID 2880 wrote to memory of 2096	2880	iexplore.exe	IEXPLORE.EXE
PID 2880 wrote to memory of 2096	2880	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688b005e3a9464f44f348ddd419bc509_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2096

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7138d3dc59b697c7d527db1dea731c85

SHA1
3667b966ad3f87e58cbd60e1bc0ef0309877ec83

SHA256
c11529db1962b45d753220f1f8a4c9c26210f75bdefb31000e72056173a9b6f4

SHA512
80446d678f6d3c9f380ea558bb9da679989f944e4a95bc1457ec58933115f9fddbf8b353cadcfe1c6448e1066e1856d04548144b06fae7302b238b7d2055ea09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1fb7e7bbd5910378334f9e394609697c

SHA1
ed3ff198f1984550810cfa188f6fc8a8dc8b4eb5

SHA256
c618fb52942b70baa02a8323df8ffde34402c0f644526bb8d30d9d05d8682433

SHA512
a861a6419a819cd18c1316c468e01f6109e519ce17fc83267b1091b5d25bafd045ec6d90fd47de2160ef4241992dfc81377d15bc6aec5770c5b4ad41df4c6f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3b081dad6f2c6e5c4ef726aa29559874

SHA1
9b2f19a34e2b4de948d06d7a74ef15c68506f553

SHA256
818dd92a2e91d96caf51b76cae790b274f42fdd1bd9b9b80a64de83d08b22788

SHA512
a32f1cc645c6b6de0dd47776ad8aa728d61c503768706557911a831359bfe3a29c97c34729307408e51cf90c6c8c184754c4a52cb6ac15683a46b3197e0425aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
24a6a1ff0fcef2b5202a5a58abbace59

SHA1
377a9324e1cfa446f493377f8b69b35b78c586a1

SHA256
e1f3a330de5334016e7d483e7598bb479e7fd916c7aaecc885d769b8f19c8a9e

SHA512
ed423bd74037ef470cb8bbd877409e126218cb6510f7350ec94ce6ec1532de89769185ef57247b9d3c46cbdacff88933da10ea8d004ba923e00b2e31aff0f469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8a52542689df8ab23a7891f16377124d

SHA1
30eba19df118fa5ca785cdda6c1acd4bb82e9637

SHA256
ef865622bf93c641cfdc7311c670bf02de6d661c65e19c6c47cab501ca4d2278

SHA512
aa4423bbf6bcfaa48d08487bb7468022df769480fe446db9bf6b4ce88c04ff147589ea6bbe5255f3d7c26a13d140b24a2aea87326b0db2a2744c880a84990b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7e2eeefd3b042f16c57c88673e6ee012

SHA1
e6fa85217cdf54043f412d21327525f01430d100

SHA256
dc361e698ea0dce2fb4847d91244c48311399b849d1e2e6dfacda91758c00e11

SHA512
2039546f2fb429b9d788a85130ac3b16319abca34ff3601d12752fb31a9ce6f2c173d5ec43785cba6b44d652e4d96c6601f7fb767e35e1c508007e09e511bb5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6745d80d7499201a1cc077f99965f707

SHA1
c54e89a8e36b82e44639db736dfefdb7a1b1f7d9

SHA256
060a82ad5366ea5d0d03dc0abbe3ab9f5d25b0821a91592f9c59034a73d811e8

SHA512
b76de89e283fc29cc142695051c4879ab195c96383864f0b736a2e5fcc279b876a6ce758457d6248e21132bd3d2353b18e471efd4bccd27d1eee63430b722aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b0808e98b43b12cabc441b87e43a8e4a

SHA1
1893f73f9c299cfd10a04c382b7126cdba2da0e9

SHA256
fe901d5df2c627b99274e4bab8b9c523a5471c839dd5e87efa96ba3ea87d6edf

SHA512
333d4091564e1e1e2897fd8dd69c071c0f8a541ac6eb5ae7981fcc01c67f58d61c9808535ebac5648c497e776c9c82499571edff037dc3eccb6f0cde98020ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1eadb507e582b59072e2709c26b07403

SHA1
d68f47e7fb1427319e168a28242e64c98c657c4a

SHA256
f282781dad79daca68ce5578872d75d1cb872a5c97be5f224b4041bdb9632443

SHA512
8793fbffe54b543468844f8d1d84272b782281f2882e09cd971766fde1d691fba6d8f55693cc431f2d0dd430cf37820b6774121070d1ab60f528c4650d7c32a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab232C.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar248A.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit