79fe16cb589a1b36458b25f8cd250e8dab73f682425a5830801c4750e13001c4

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688b026d5680bb5fceb8dcc4953a86bb_JaffaCakes118.html
Size

53KB
MD5

688b026d5680bb5fceb8dcc4953a86bb
SHA1

49d7e8c3aa5c0bc823969cd4166c6585deac76b5
SHA256

79fe16cb589a1b36458b25f8cd250e8dab73f682425a5830801c4750e13001c4
SHA512

6cd59c208e9a68008ed33b4c5535b0cbf738e54871f27b1a905852aadb5f85410a985ad3922543047217dd259feff0a145e89d57924d642be82f2adcae45d4c1
SSDEEP

1536:iUpciFkPHHXUBa3Uje1IBrFw4uHK5n2TNuy3QqiL:B/MHHXUBa3P+BrFw4uHK5n2TNuygqk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5F5A541-187A-11EF-805B-F637117826CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000632196d304fa785f5b74f6fe16561b380f487095835fc7f3effb50e8e0f72f00000000000e80000000020000200000006604424842af4198fee5d6c6437a5b8f7f141c3ec700af8e1cfe70756c276880200000000b0c0694027d941bd38c25d512b593373bdec7999182c15f416211185bb709274000000036618401cb18fc0bc5e5726fed1f89585f80e401709b15a3822e91776b39f7ae29b69e4baed3ceb33425feab3a466fb1d1cb8724b25f0088294c6f57ebf910f7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ffd4dc87acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572056"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000038c844d89c586afecf87d91066c3a2efd71368911f7334b6bb2318417947ffa000000000e8000000002000020000000a2bf72b2b392e6859766d86ed13a1055ed5c80cc51faff6959a53001a824b399900000000e94a5f6de81e1e4ddfab81084a758a353c1aae194061cb293ac767d3d7c22690b97e8555d7f96c65594e74618041cc773e5f2d726de0d09ced85b3f9caa0e0d7a57d853ab2f605e5062c0215b42acb2ff59db8a6841d34c0969fbd897506683d0248a27fd2fbfc40109e6a41516305cd365d5efc197c88e7ca122480386c192aa1a7a6548f8f7967a5ab4c7cc6062b140000000e3aaceebcbf8936284e444e6014ef39dde01749d51b4574db03c89369602aecabc6d72d52551cd0b2e355c03cbfbf91b14570eebc7de02a8f5a8791a71740760	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2416 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2416 iexplore.exe
2416 iexplore.exe
2348 IEXPLORE.EXE
2348 IEXPLORE.EXE
2348 IEXPLORE.EXE
2348 IEXPLORE.EXE

pid	process
2416	iexplore.exe

pid	process
2416	iexplore.exe
2416	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2416 wrote to memory of 2348	2416	iexplore.exe	IEXPLORE.EXE
PID 2416 wrote to memory of 2348	2416	iexplore.exe	IEXPLORE.EXE
PID 2416 wrote to memory of 2348	2416	iexplore.exe	IEXPLORE.EXE
PID 2416 wrote to memory of 2348	2416	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688b026d5680bb5fceb8dcc4953a86bb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eca7f22366186954dd964cbea6ecc5b

SHA1
fe0694afce0eba78bd0208fe46e47de4288edf47

SHA256
1dad7eda29dc8eb401855b92cd77deb2053adcd1413c5791e8629475b937bb17

SHA512
844b483c9c9e28cfc9d7136c82f3bbe020eca4721aca6cedf9c067b01313cf8d17db5d24efa8fdaa917af76eccf3abb39b29d0d3d4b902478162d41730f889dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b29a3f72a153d0db4ab211067fb2c1a0

SHA1
853d1eafe5c46d4b431116990a34f567bc0d93e0

SHA256
0d7718991b57923fcd0416e335f349fcd6c8d21b4e22ea793dc77df45ebba905

SHA512
c169680ff56b58515052e8e51e1b0b62e38bdf5f41cc83a1c6ea3cdaad0a9546722727c791e9924d8a8cef7d9a9a4e91be3c7b1335270ce9bb32101e044af25b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23fe736312f736c45539bfa3e4de1f94

SHA1
a3bafc0dea00d6451db56901b08916410a7dfc38

SHA256
1e0935d0a025fbc948094f11e590c64d8685e32acf38b6d7b587483e35e454eb

SHA512
4112d1f593cda968521b45831a0e94376c4234cb21f4036574a2dd5bd1ba63ce63b1daf184f217dc01e2d187865678419431048fd4997f0a3b3ccea918503ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5238511a5c415535155d06a4f79742b7

SHA1
f8c6d176e74a00e2fc512883afe51a73d9b137df

SHA256
94428d28d11d530c5c56dd6e3a8cf69bb77ca795a07b6a66b679a890ebde3270

SHA512
c0a2d475bc33ac59006f9f427dc22f1d185707ad5d8447c3a0f0a3bff136f4a3b894916abc6041363dcc14e436cf41254268f0819b0acf593ee5754138eabe63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e09daea176c872fbab497ddcf1c536cc

SHA1
71a78e5873d7458ae78ecf0dd9923af6f33510f8

SHA256
1c64aaf5c9fc66157232349b4e9d152d36bda943394aa16a1b700a135ed3b8a5

SHA512
489256a02b1293e9e3d9e06edaaa815cab201aae0afc1a9f1656e18924e90e7d8f5f0d7d609e993472225fc042caa3731b2393741484df2b5ef171ffdf2d189e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d840f4480594364d4a4d1517ed46bd

SHA1
29b52bbfd37a6b57fce35e9093e3f13593d65a4a

SHA256
3f99c4947be266df12b7ba2bbb72bb9c1583c9aca02af226a0e8b74e199f292f

SHA512
b4de79a884653ecf10077668ccdb903129f4e80cde5f199bc7d5990c017d4697b843f1c6cc333c887aa1f3ca2c0a38cb76595391753ba795707bacf3e79da3ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85c981a6090d8fde776112889fd4da1c

SHA1
fac9109a8038ec5683d999887f2630999392deb9

SHA256
7ebefaf6282a271a16e02ab19c046ce9e8d2a1886525759b663a2b9fd2429e29

SHA512
7d1d3a1033155b6449f6f108ef7ea8f638dbcd92cdfa46ace581b12c614c97b211bb4c3eb56272978bfa86ba8bfde046575795dc687f4a684fe9c9b27543e972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e9edb0c5bc09b49372d4c3850a6b536

SHA1
123734792b694f342720ab8b7ba8a8f6c538118d

SHA256
73c9ca6ea8e989ed878df123485669b24725fd5569ff44a85a59999d9f6dfdf3

SHA512
b92ea46356b6c5eead720e34427ecb7e5f73e52796b037780ab84c8cd59cac3653690aa2a1611ea95b45f3d77dfc6cd8a87d436bd82ec9d48189e676de36b5f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3355ed34f587bc5aac74517927aad8d3

SHA1
1fca83cc0b6d5be4373181ce84ece7e9dda1ac2f

SHA256
b42298bb95391dce3706b5e2f41b086b9406825e878edbab08f0444966bc0a31

SHA512
4d75f199444c871ed06b43235087b01aed18a145986a1eb12eea454f1eca45522f90eac1ac1749dacabb60183c5639ee7de0cb60edaf4aaa997b97f2eb2b58f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fb459433e26e315bbe4d6651c40c0d3

SHA1
2a86652ef1f9732c7c0f099422bc2137ce4d7759

SHA256
f05a16110027f588687c8b71b37a5ed0a94ea53a9b8b4ff9c859cd1513d9ba65

SHA512
0d3d8a9d86aa76d8621ddb715a1f39ab13ac04ffd555322c39018af7b7c18a9d67ef919d7388da59e9497f6d8fdb38ad1c71999a5c92dcdc5efac44ac9f2af6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637dde0541fc7e504fbb19bc84f6d1a4

SHA1
f081562a50c9011f9b5d78fe8dcfec04e14c41aa

SHA256
6a7f513553de168ccc3ff755b084c88f5cbbce341da12e6660c6b7ec6cb6c7d8

SHA512
ada98d4e71657c80824e1b73380d93dc95e37538433e7d8c9a522444710ddca3c7ce34f08252aa0c103f21025e281ec6a6e178568d96c2698ca1a667ef094303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07d9c75ed83dfedaf77d02a1eca4615a

SHA1
2b4bc0bd546cda0f4e62ae6b4616c592aa25ffe5

SHA256
a8ccef050f5ad3536e7d14d63b4f2844a0b3a380e1f50f68c74281d66ecf75d7

SHA512
615432516c4c33fbb53c39e71db0b87e8bf1c0e02050b906357af94763616da5fdc9f3d32a55e41aeaba72658bb6098e08726ec9d585d21ce791f836987dd923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bf8f8b1710ea4a3511c308eef17f0f1

SHA1
3736a2e6f09fb99c31e7b9c07764953b1f1b7e0a

SHA256
38cb994430d23c561681a52ea9d5c731fa26a536338bdf2f53e305174f49a182

SHA512
fc10e1799626498a4af9c8151882ca7e1e7b09423b04c375187d13b38717630b7c534af662cd4f8504d59845a36d3c70c9ec7cb5ec001a14de6c77b4f9373a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA17F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA181.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit