601f0acf6b192899f31614be32eb19e6f4bc8c944a0730bacf604b438f8aed31

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688d11009f3effbc9bdb71fbe8913e16_JaffaCakes118.html
Size

1008B
MD5

688d11009f3effbc9bdb71fbe8913e16
SHA1

eeddd73cad67efa247aa9aba0eb84ead711d224a
SHA256

601f0acf6b192899f31614be32eb19e6f4bc8c944a0730bacf604b438f8aed31
SHA512

e26221a09817d83b1f615197f6d40f99122c83437d1ff752de265c80d7cb20b5ce68167c541af948c72a091a36333ad55a2619f941a372bd1bfb92d6ed5e940b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000804391b4808bfb4056967289efded0794bba76c96762a83e140cfee5b267a266000000000e8000000002000020000000e0caba78dfc782c001cc3575717b4f57c68b6b19759e2756bb5e8f08853282f39000000023ed2888f20b6bdbaa37d639cc7b978c23b5b861b153acfd274a0da7a9393c94601e3fe1c33a6947372a558c0c33412ba56f2ab035a763f921dc15801313ceb5c5a4d000162fa276f0d499b253104079860c70f35335932320078c56ea8da2fa44bd427aeddd37b4a07307322dc47984c08d23a6cb140d87d5c55d9c079a93af20a88070b091ee06f506cf637df0bc9140000000ec4015b13daf94bf2f228403ab94ed64d0a354ffca4c6eb17d05073037a005f117bd6fff0b7b6babe062934e6bf5d5a80b0865a4913f373b8ce0d0a055fe5193	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572184"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000735f0485839628901c15466a260e36de8686260cd5480bf0bae64b3969d9c452000000000e8000000002000020000000468a5bda884f625c9bae25b0c67c107738d88aba459a608b61de36772d5ad33d2000000009e83ea56bf004c26cedfdbc15a8de4a9b2091f03f96da246fd9ee3cac19e5db40000000d5b8bd3682fdb83864a8e3ffc69f390c3df4e0eee9adbade6d756502204fdd602b829978741aff24b2a48db447e8e90020f0542336afb0829b998b22ba7718e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08a8d1888acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{436C0761-187B-11EF-B3A2-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2576 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2576 iexplore.exe
2576 iexplore.exe
1632 IEXPLORE.EXE
1632 IEXPLORE.EXE
1632 IEXPLORE.EXE
1632 IEXPLORE.EXE

pid	process
2576	iexplore.exe

pid	process
2576	iexplore.exe
2576	iexplore.exe
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2576 wrote to memory of 1632	2576	iexplore.exe	IEXPLORE.EXE
PID 2576 wrote to memory of 1632	2576	iexplore.exe	IEXPLORE.EXE
PID 2576 wrote to memory of 1632	2576	iexplore.exe	IEXPLORE.EXE
PID 2576 wrote to memory of 1632	2576	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688d11009f3effbc9bdb71fbe8913e16_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f97b9969c0b0bd2bdc2f3662d9fabb2

SHA1
1dc05f612535aef972317ec8b5ac10fcd0847ba9

SHA256
16ece02e0f34e22cdf43ec52903620da08b34ab0a5c7d0e1999e3861e18d4116

SHA512
4e13a246207a5559dcfc8434687e8e8a0e5aaca1d95f195a1d45110da80d050332ffb28fbfed0f1a45dec0f98bcc2519212a4ec16ccc1ff02acd9e1680509473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5455bf18634d16c008e3ac89d2ef210c

SHA1
723c9d9ce8ad64d74962f6f89c2e3d50662ff16f

SHA256
1a8537d119bb4abac696f8fd055ea1553ce6f1ed01a15d56c634585856f6b2c5

SHA512
22f4e283cc081a9ee61a0806bf29007b10168ae1602cea06fbca7204047fed72a299da679b3a7be05d6831b496c7b5954ec91531ad13b9ecfca29c7ad230e1ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4be2e18b5cb8f5adfad8eb85781cb51c

SHA1
411f0bbfa8d4fbf7610eb30848871b94f2c90551

SHA256
42ed995a9e3cd44dbadcbfb9a2c0a8fdf81c85cff13b6425704ee6be8eee8664

SHA512
7bfccd5365b40e445ba49ee2be0bc7203bb72b3970d6725a553afcb7b34de477faef456ff980d08dda235775b089538adf1c7116b6abb54c09f4e513d352bd67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d17ec686d48b5d39fa412d09e6edb272

SHA1
3b6df28814a5ebb56d5b6dbc57ee77d05e29233a

SHA256
de69107f1c2c0f384caac2d3725b30e03c5f368d64572736f8203b3af0b9af50

SHA512
bcaaf3c6118cd27c018ba96fe0a171b6a80415c629973cb9234ea15f3586fbcba59197eda82b8889b83f15efa32bfd5f347e9d8e9e92fe0b73951337fa1869f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f965ff6e52975da3282c5d1f15ba734

SHA1
179a3adff64088ca9bf8781e2942c9e173ccabf8

SHA256
a28e5f237ae2b66b0194e84810eac496ea4f12e3f8702a2fbcaa3b80fd821ecb

SHA512
1168470dff99e9b138fe6a7c53f117abe0eddc23652553b49e013b6720eff98313584ea8e3650ab3ef4adbc13c70b0792e26400f2c617a8750031775cd8a34cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac3a7059937ed3c4b6e181d06441dbe6

SHA1
7a59a78aad47ca811d6cabc786743c4a20ca23c3

SHA256
95f406d3ea63862238cf3bc74e3534d9bb8f60ebddad29f9dd8a856862e689c0

SHA512
09bb7c58d0d136d2096d668f0c2778fdfafce3656d251e51c61f56427f6ce6efa79166bb4b4fc276816c85800372d0194ec7a2da61649ca32b7a08b04d3c7b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8127bfef3c156923516887fad9e890fc

SHA1
8edf6166fb31e9cc418f772ee7fe7445ee0a321b

SHA256
956efedbef691c5664771d5acfac73aac642f4c593660e3bc6e7536ac9959c64

SHA512
c3278df7c97112233df213a5a0223f20b03828c1063ac075d01d9f54a8ce2de1ee47f47992260a71cc69fc32971e219e488ceafb0581b5e51c01219bdf63d4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6369376239385ecdca7a16033471970

SHA1
f2b021843bc0546ed17042896bc01a48135e1152

SHA256
37dab2a478d4bd1479a797caf75818a0c4b9775a583fa5f33a01f302a6c6a01e

SHA512
933125a884c58ffbfba4aaf068d29ab27ae2ee936ceed2cbad2e43ef9b0c0c57af0b196de66bb9441126a204ccaf502dd8a54254f4189c9095c49b6ebb77ebe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4930e4afdc9845ca1568d8a49a77ceff

SHA1
cf1a78772976ee556532f166af25ff627b0616b6

SHA256
bc4dc3a10a0cd9320093c66110c47324e97e31f45c95a4b9329275aeeaef6ec2

SHA512
dfefa3d14031e98016cb5b7e1236faf2524f0e1b7185b7f1f96787c5161f611d435fcc6493e21900b3d5acc13fc250f1d5e1935c4500a8ded275e456761ef1c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3507.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3578.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit