07e55190b69cb50fc6f1524481441213104c79e321b9700b456275deb02466c3

Analysis

max time kernel
143s
max time network
137s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688b55f9dbce06f4e9d71fa99bca63c8_JaffaCakes118.html
Size

29KB
MD5

688b55f9dbce06f4e9d71fa99bca63c8
SHA1

2ed18dfaa7c73b8b73f63229c1a9d7792c65cbc2
SHA256

07e55190b69cb50fc6f1524481441213104c79e321b9700b456275deb02466c3
SHA512

798e82533676b2fb784823a34007fde063f78956c4f5562fd43e8812942f908134045d8abfab0fe9bb25709e64e9a15d01f3d578732e68194db467f34c2ab4e4
SSDEEP

768:SgVxSSyChziJshJqLk6MbcZNy2T11qrLawkpLgnBdxKf8rIMj:SgVxSSyo2JshYLk6Mbcfyi1SLawkpLwH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301e7de787acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{043E9121-187B-11EF-8B04-EAF6CDD7B231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a7d10e2c967741552f4eed43eb4d17a344170a61326429bdffb74d24a0b530b2000000000e800000000200002000000068cadf13a72bd7dca706906e6c9f8a28f8a6f2551474852a309c2b6ee6c43f402000000011aeff54e45884cdcf6c0f056336c68cd69f17124269839e0d63c60202c88d51400000003fb6fefb9725c63f4acdb98453231776b51c56e0e1384e6c541cbc9351acdea04453dfad9b65266043e9000a73e214b73058c76e8851f9883f079de04aebdcab	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572087"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000950a44dde7f3561582da7b3d716015c6dfd704b63fe5e4e6807cef895f6f66c000000000e8000000002000020000000a8c6bea3cdf48341d3869d31bd469da2c57639d0a72e38b9ce06202e0d60163b90000000eb8de05e3b4d2e81eae0a6b14f85d12c42c7e29753a605137fc084475dc563f31124ea33d896a140c8e4969951814cf8d3f2682f3a5abd0538efda424a302341a69710aca8b395d54ae7b79810f59807f40dc444d67fa5fd564f5ef05399871ff9ea87ed7c1e22e97700baebe998e20425524a3ae9f8348b8b259a0d6c37bfb6688f1dcf27459b3a3d78a712491b0a6840000000f8dac53261cf4d992fd1f7b74037c699ddafeccff9ed0c77af161ab561aea57a86f40680d1bcae9c6073e13fd7725fd2e239e6a67c1b5235299eea063a7636c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2364 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2364 iexplore.exe
2364 iexplore.exe
2064 IEXPLORE.EXE
2064 IEXPLORE.EXE
2064 IEXPLORE.EXE
2064 IEXPLORE.EXE

pid	process
2364	iexplore.exe

pid	process
2364	iexplore.exe
2364	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2364 wrote to memory of 2064	2364	iexplore.exe	IEXPLORE.EXE
PID 2364 wrote to memory of 2064	2364	iexplore.exe	IEXPLORE.EXE
PID 2364 wrote to memory of 2064	2364	iexplore.exe	IEXPLORE.EXE
PID 2364 wrote to memory of 2064	2364	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688b55f9dbce06f4e9d71fa99bca63c8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e6a23db883d3765d6b23fa84e84709db

SHA1
3903aff96640c489f8da326fee24e83cf3844319

SHA256
7e7845ccea0fb5d8bd16bf365a84f1c704c17509b5f94798a4d7b8c45ed0526d

SHA512
2e871dfb0db2bc2da4f86a6b9460213478463236c3eb8c27fd3d328d92f6b9d64ed1cbe47d94f3743b9d990f3cff079e1df974bc9e1fac32f56aac131a94e9ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bae3e995d302ff663b5c007c468b2e90

SHA1
9dd2f0f3c8c81fbe193c88223cae9406a1d005aa

SHA256
bda57351200db7c7cd8438fca746e006c9543587f72ff3af229cdd88c30cc498

SHA512
046d536bf2af909dadceffab7a0fc2d21612fe83129276c2b784346e7c298eab0143968259c498c8b498fa8f2e983e56fde945dde6ec5c68bacbf8ba11beb126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f34cd44cb98c54bde6835c4972e97c70

SHA1
9da93210c35e68498f4f44f0e2b85278f91798a4

SHA256
4398b4eb136d79643a3c560e4aa54170261326e2ff3ae1aade686e324f6c92db

SHA512
e85463ae1ae82b2547fe7541010ba82cfe125f7e5ae4dfc77d8f8402a66d629c8e3680d5775c07fb9feb85c68a6ac3905509f21cdb5fdab70fe07b4d4919af38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f784898985e9131699bee597cfd9a250

SHA1
6204dd809d3ff8452610e1c8728c0bb177a04f18

SHA256
e003e6b35a99e7f37c2475b8dc1511e62fcbab625beb8bd4eb3ce6c8a5170aa9

SHA512
9f8e62041339e25316ccc71054c51390fceed85e9d76040fe6ace1a5461fd7e221dcb164ec0d2e3829acf973aec41d54ee1c1eeea299a7c158a5cdb90192620b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e469f3bfe897687a9889ad650b0df1e2

SHA1
c71dcfe69c42d874b2eeb413ade8e520dc7b3a54

SHA256
7378fa936f4bbb4c8ebbcf79d25f4647aec65d7ab0e15e85f8663b70dfa3e9d5

SHA512
8aef69aa0b020c411f55bb03e04bbde082a9c3a0df63e0339c7fd9a652cb36932f62274eec174db5dc9f83afc782c1421cc2b41d62ed791bf725d38a22e8f6d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7d5eac460437326f490d4e3b67339df2

SHA1
79fa606c8f7ba018262e6cdee65a48de7f1d7517

SHA256
73178dd1e8bb130b804fbd93b05f9871f270d8367dae606c65583694e5f5c6d4

SHA512
4303f64fbd01bd5c47d215311d89ddbaf97f1bf83e85f7463f17ff90e062feeec813bc2dac3579ee2b04a66a974ac8734f0bf82548a562cea1f910416777366b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1946ede7a1f6997098ad7d111f9b3fc3

SHA1
9e6fae9715aa0ed2798fa5709330ad95463b05c1

SHA256
81dcdad0ff1c44d4d8a08cae89427f10426b8a0f884a49b2cb80aa10e273af2b

SHA512
2fec5931d381a739b6c66606df92b66b1d2b94a257bdcb0eee18417ea3332c117ab3de3653b4030a067d40bbf340e408705eb96a425898997ab373075c7258c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c5d07e7a38a2b3e4def86c0caf7c8d47

SHA1
c38ff9528df20f8e46599ef5844e382efb06997f

SHA256
01512d6a2f1370e49288c3898d6fea85cd67a70858a905b5dbfd968c26fd095f

SHA512
b20ce5cbfbb8a99fe600bd1047ede04f0c6cf80e751edaaee33daa342ab2f2140bd804f44350065c6695d8a06eeb02e4895ab53cf5b939cb93f04920dbde3598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
def53783c8050c2a00f4653f099125f5

SHA1
271ffdb7efb7d67396cc21b41ad82758cce2c745

SHA256
b6c8baff5ce1865e1553439fd9fceb8d2fd354b424f1b789e03a645301a09bf0

SHA512
c8f6b28cac0ea5f8e3dbd96993da4556f10cdb7757169e75c2a083b7fbe803100ad31172d3e59daa7b872376dd3236e5b2ca52bb513911aff6ecbcdf5dfa5c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f65115007408bb398384917be3f614ec

SHA1
6fae058ab5e74e410891274c3600254c08d62074

SHA256
c1a10d5c8f0beb60a0d6c7eb59fd0d5b330a9f6dff4a0c655a08fd47378dec16

SHA512
ab00b108bd5d0ee2c0b91f2204b6d1690dc1f9ea8c8635fd493d10f376a35fd70e35fe1e8c65826a8f152a31deeffa47770259062c0a4661f2a6ad951b1804c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA870.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA872.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit