4bd873609beb422913c88c4ba6711066053e93e023f146687ef5ad50dcfab4f1

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688c19ab30a9a2d5fca435a4946cb44c_JaffaCakes118.html
Size

35KB
MD5

688c19ab30a9a2d5fca435a4946cb44c
SHA1

5fda9d8650a1d56341fa93f076cfd782099d17dc
SHA256

4bd873609beb422913c88c4ba6711066053e93e023f146687ef5ad50dcfab4f1
SHA512

3bd45cb5e96ea0ffc1139f4e16f2bf52edd70e294dbf8d1164a80cba988b7fb5ffc6186eb97c4180c7cac67ec1a8a065fab73a267d5e63e7b6df4ee3b614e54e
SSDEEP

192:R2WoWtX3b5n0nQjLntQ/3nQie3n6nQOkrntJynQTbnWnQUhsKwV+wVVwVQMHnwVT:4WoE9Q/U6YMH+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CB32FE1-187B-11EF-A41C-62A1B34EBED1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f029a2f187acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572122"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002cebeac447120f4d9a58311d42eaa0150000000002000000000010660000000100002000000032c6724ae740bc2fa3a2775a246ecac1cc7b93abeed3865fe3ae53dee8111e60000000000e80000000020000200000008b1e013539ee5dbf0e0b2d54ca93f56fef6526671f51b919afbf99b9bf6aeb3990000000e01384f96fc4d6f689ffb9b88b953d12ca4b838bc5ebe26c63b398d66c8d6fd3120a85412cad25d5eae84f7eb4cb39baaf9090ba1772633b663fd66dd7e7082af1b70523b637a9de241924e6525a89ba5879cbbf4f47c5351adbcf90ab02215831b9158a7b1e12380685ce5996a26fcfa9571eb09adc70d8a8318d7488cfe848abf173191cc733e2b9d045b6e521e80b4000000096882ead449d6980e1e3fa3816e17af2544091760d0ff3a34a274e8aabc7d455be8891af8272cccf0d5bf2724d887badd826cdd72c6ab5bc302e68410868306a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002cebeac447120f4d9a58311d42eaa01500000000020000000000106600000001000020000000be2d97b871edc40303c0bd22deea310953b5c5f5bd410bcfcc232bab844e919c000000000e8000000002000020000000b557171879580ea75b60a9fb226774da4002b355174b51a554d950c3560702f42000000013644a6c859840a41edab889d0a05c68b950e3af502db489402832a8cf0f22764000000050d492c14812c687da96c3bc54c9cf20b2e0439459796e57bdb19aef205f77227939bf68248cbeef7d6b2f1435e721b8dfe6f74e43b678cb842e23364ccb8271	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2204 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2204 iexplore.exe
2204 iexplore.exe
1744 IEXPLORE.EXE
1744 IEXPLORE.EXE
1744 IEXPLORE.EXE
1744 IEXPLORE.EXE

pid	process
2204	iexplore.exe

pid	process
2204	iexplore.exe
2204	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2204 wrote to memory of 1744	2204	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 1744	2204	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 1744	2204	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 1744	2204	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688c19ab30a9a2d5fca435a4946cb44c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2f013df631b4dec641352c877853a463

SHA1
52fc5bb41fb4202b48536636b359bec8feb138e5

SHA256
aafff81e793247356aea384fd47928bfbd5555ad821f57a8dcbcd1519756cc2b

SHA512
402f5bdf74b18e683cda02d05223ce27e9356bff7127340868136384d0c9960c1136411b8cf2a3319d572b011024c8badd18a774c305caad4724eac733b575a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
833387ca8683100d0bdf2333e4747929

SHA1
3d615e7a238b970bde1cc1628bfeb3bc06ae2799

SHA256
b9d9ccbb1453b1ae27fa81aefb331e19d0ee5b7cd4c6fae36d7f0b0a3fce0582

SHA512
cbf8bd3121ac375ea7b0a868aae6802a09ce9c76712276bded52e4a819777e8a0f466ed112068d0b9777381e4b9c91a1a84581b0180253c469d3289d07351a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5bc584e7d43f4052feeb6756e77ddc67

SHA1
d669cb0679697e2bc271711671478b5549379958

SHA256
5f0f966c641ec94bb8625b8fce9d964b0de82456c5491bf646bfbb340ca56c49

SHA512
68bdc78b982810ccfd6c590f9bf8d3c6b62a071f4bd294c633cc0ae53bf1d2ea944225d65c26aba4dba0a29d6ea352ae9fe7426dfb4ad3bf0dbaca6f72bcb5a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3759fcee45cf9a1901dd61703cbb1ad1

SHA1
0b043a8727747b474e58f9308c3405f06f3d39db

SHA256
69bf17db0ae271614868c611aeb7afd768a4b308db20fbca8222c0a19f5961a1

SHA512
3ff55d23abccab75e683780465fdfd5efe9dfada609060c04a88e5ab12dd04943c3ae9746b5988bedc983e5b9446a195a5ac6374ed962bf7ef0dcb18e40f7718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7dcc1390a0788731000e4a177bfda622

SHA1
293d7fc8ee7fd7e62a7dc08e43ee5481b5360a36

SHA256
5f6c5c3a9d06fbfb06d1c8bc2f73a9fa3a7454d3c97416057c143ede0c8511fe

SHA512
4797dccf3dde2491a3e3e294e6c9ff6a5b1e0bdd19745714aae9df638aecf07b4beb67bd38cb1c66e8771dfc6c98d15cc7bba5cc335e9e30a7a63619799533ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3b5a418dcb85a752882590b162271fbe

SHA1
d226c5e8437ff122e0ee26c7b76f78da65bc8b91

SHA256
60ecd7cafdc4c18dbfa00a5813373aa7c16549708307ac4f44fc1b557b31db8f

SHA512
1ce4412f2d303e9189ef3e1d96056ce3f76625cfd8a67eea7e20e83906760cf11ec789b35847cdf0f7fbb1e6d4c84563f421cefeb5f56c9ed9eed9eb4622497a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
62f06e7ebc7ca5a23eda4ff95b9b149a

SHA1
696fe601df77a348994f2dd2c9c61c2a3c5d5a71

SHA256
2b1752e5f0c58aac1875c3b5855c7ab89701d4d6e2f7ce22fdb1d0d343901aa0

SHA512
d15440e12bf3f1f164f7509b326fcbc03ec221cca75f0e33c6802df068ebd944d037d399500aaad48cb9bfd4606a5213df4dd657a317a7f76b88854f7dcb9664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a1ca0d487757efbaae9d73527276e23f

SHA1
f95b29220fad1cfff353c921858713f43d2fe39c

SHA256
b3c398b42c3ef15320f7247df10ccf6240b1309f8705b72ad15b5b117a1006a6

SHA512
14526d657e9baef6afd27b718245ae87b2d5713f37cb43119e6a12082187377da02e4c9b04a98a8db5ece4a6cbdb161037d99a2c02930a870df09425bc37771f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
98a27681829704451c87cebada2fdde4

SHA1
428dad7dd3c27efef67cf84180c5593f272064fd

SHA256
bfdfa66fcea8e73f2079b68bc6772bb325571b01099ff0c80fa3d471fc0dbdd3

SHA512
d784d312a17a9aabbc84ee961d2fac346c56f678c79e3c23f0475f360921d19d495069b921522529db9f7fea45b5f83ccb8710944f4983b9a53e99c2c19e245a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6d6f12ed8c72c795889882f677bf37a0

SHA1
f1e6afbf22eec01172e764caebdf1dbf22bc5617

SHA256
3f99274eeb0d30a86be2cd10e14d3e06e7146ca0c9a0e1c4701e1adbef9a9305

SHA512
73fd55f56ca36866c71de0fc9407c562680c928b9b3d85f3a83220cf4b7a7a3fc3b7e861b1d23fe3506f84d582b7aefa38942539b105e1e88905a38871a08ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
310ae8d6732baa2094b10882c8d0f824

SHA1
fb98bd3859fad5af96f7ecd63a301e22deb9bdc3

SHA256
09381f56ef9f3403180bd95abd30c576326035b44d34fc98259515b5b0d57edb

SHA512
6ee6f9f49589e36c3d8a55c67f5b49c15b781b261147afbe91cdf51eac9b610c48691052056f37d7b21a7140bc93e0ddf246e67a9f9be16b44f7dafa20962d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a2b2ab5889d8689d6b36f9ec74a8e061

SHA1
f46040544ac7fc1cde2036576f80f01de80c996b

SHA256
ee13c788fe2291ff5eb16a5260720cb5da817bbd0201a23c1b1562342939083f

SHA512
0f4748eec504892dbabf461ef7fe310a64d36f6dc97936172fbab2925032ea1d25dcecf80f89e90d2426b40d3541ed446ef6ee01cb24b925edb512dc06c805d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1f4db122bb5d5a66a588658c34375376

SHA1
149e19c87c58de4db5864618b76596e31255c05b

SHA256
78bab1950c1c0dee3447ec1b4d5562030f7025009c896f2d400c2d87b405f2d4

SHA512
fad38748c66b075e19c2d887e3a295c16bc4a59dbe90dd5920faeb5f888b6b83c91661cea256e57ceff4ae6ed9de81b708d108afe231432a55021351704a0195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
84250d08a13c75d6ca8e19362d90af10

SHA1
f32e62c22cc411e6389a820fda1c7710db1d9996

SHA256
00bee5ae64a66c96992267a6d042839f4f290b3f52482c6624a665212c74c694

SHA512
1270eca8c2b7a2feea29e56cd712e38568e45f47edc11f59336735fe65ec7e7d07cd9fa3a54d1ff1af1207146b05772b16ba1953ddb0839fbfbeaa6ed004d0bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3886.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit