f248c84016da6cb1265fb442a8949241e51b486cf6e4e87ccd46d8760d60ec32

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688e6c28b789d6d34581c6c7b0d13ac5_JaffaCakes118.html
Size

60KB
MD5

688e6c28b789d6d34581c6c7b0d13ac5
SHA1

9b1e59560c5b15f19e46f225125a149d822960c6
SHA256

f248c84016da6cb1265fb442a8949241e51b486cf6e4e87ccd46d8760d60ec32
SHA512

76d113882a7cf01f78b6f3c2a8e70987201916e4481adf87236f19321387e6e84a7c16a6c8c12b5cd3e74b1a2e4512725e20e5a918ab85b86b17e986bce94988
SSDEEP

768:JitgcMwUc9GeCSXuhvdPkTxKIoTyWhCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/Ij7:JTiRm8wFTRgec0tbrgamchNnWC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000007f6b7fdf904f9817fe4fa58035709d806c44acd2574fc028683f03492c12290c000000000e800000000200002000000078a6d6b6c4c7a73f505500624cbf45e0891026e5de689166c3eb7047bc4f3bb49000000097d9d79d4f70533486beca2365b31455d1fa5c5391b4257c3f2c0ad2ffe856d1bb36372d6380ae61479cf80b013fae43d0b768a2f94672e33c6a5a30bf9be6f5b01f2b720de317a2f9fc66939f8b3eee09a70b822e722e648ba76fb17edd5fa13fdbda824d41bfb76bf61715cc9c4c6327ee5be1806948b5411a683c7e5bf12dc63b81ce4c2d759451e309d5f4e662d7400000000c43bec3f3f3150d09492dcf8faa758104a4b92ae144409f7d7bd11fc8a572ac8fc9d7ded11fd06c2b42fe6df09bbcf1bab495e7cb31f84361270642c16a467d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000036ae61822f806f081c55cb805d342a0f1c709337728f29027fb7a31db89301b7000000000e80000000020000200000007ec703a3260a1525b530b7a2b233cfb623f102d806975f0fd0171e43e4db8ea3200000003c36255f3cb682b33dda97f4ccb355037c4753193d62d73e3322bee6eb650d6640000000e5e4b7ef7d765abcfcee8f6bfedf36510ad56331f8268897d8a12a7f2a4dd3962f906d13883004d5c6a4cfc002e920e33f792a282922dbb76ee7d4262fcecf02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88937581-187B-11EF-8B04-EAF6CDD7B231} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e030305d88acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2368 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2368 iexplore.exe
2368 iexplore.exe
2424 IEXPLORE.EXE
2424 IEXPLORE.EXE
2424 IEXPLORE.EXE
2424 IEXPLORE.EXE

pid	process
2368	iexplore.exe

pid	process
2368	iexplore.exe
2368	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2368 wrote to memory of 2424	2368	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 2424	2368	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 2424	2368	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 2424	2368	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688e6c28b789d6d34581c6c7b0d13ac5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
916cd701ad805dcae5451577c64e2fd7

SHA1
8583e0b0d68b447da586168a2fdf7305c29e82b3

SHA256
aaa2119ed78d01c1af1e4790f44ae43860dbb6785674ff841f823714d16c9348

SHA512
1b2be4abdfef893a449fff66b81a05ed0f6dbd27de38952ddfc45aefc8de7d439df1f99ad04aede58bd99c155ecff0679b8840e1a7f4b87ef94e94999003df91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8c067b0177fc61ab1df52077982e39b2

SHA1
393509f1104104173a354f30895cd087482bb986

SHA256
7b0a041ec201e11b708fe1e25c8f9e19bd0716d795f57541707f7e45b35ac1a9

SHA512
b9eae8b44b201355588ac8a5fe12edd1b462d2e523951fa5e47a0b4a1c44ca30c3eba33f58c12ef757a44590ee846a62672f3bc5e9f8ab9ea644d7d9cecc83b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fc6167b4c1eee92929f147f6c881cf3e

SHA1
5303e4c3de8ba37f75de4b1196d7b28ff7d6b318

SHA256
aef76cdcc26b1e4bb26a1e68a8fe2cef7ce74343394749c5f7fe81c41a286286

SHA512
e15d1c6d799d0d1de2e83175df51af6d48f08937df3a141d812e8d2f75974d1212125c76f10f13d72f5ed6c0ac6c5e9a61362bf1109d7c32d5c4e21eb1cea2ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a9f73eb0a7cc6a2264a8b2100bdc79df

SHA1
83c0840dbf4bd61248dc2d9f1886fa5edf427eb9

SHA256
e245e00ebd75533300d40b9424cb45b6576c37d028a9fa286dbd9af879a6d8ae

SHA512
5ae9fc8639e6cd60c814cb7ec5a1a356dd3fc155bc47bfade4ee8d2d89ee74ae258705088e2d5d30b5e8ad19e09303daebcfd9aee241595a8a213c4a5c161701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3f494e4857ca1a78a99126b31f526240

SHA1
01db9024d63c8e136a51313e575ecc57b7e2969f

SHA256
c149fd56be9ad7399f9f1c23551d8ba01bda914673885cfc3771b7a8a82a101a

SHA512
43f6635d4ba13b4ed86dbb132bf1f29cf7fbdf9c649ea40556b84cbc10d1edac22e275c772d0f9140ccff831f49e4b02f09d33ae9f19fc414ab691a8e98d32ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5dcd04fec09c811956637ded18797acf

SHA1
d4ed1eee41ce29b53d359987e03bd04d3f7fbbcf

SHA256
ddbcfba3654cacdc1d796e5ede730bd548da58a4db4aa4a6799641b7947b4b02

SHA512
0a3d4b7a373fa28ff4c5b59ee11d773d1cc16d5939374cf253735b85ae61dae5188f05e1a3bae5163efd6dd8e7f9405107818be987c8a251a393ba4c27da7878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
95c28f385101a660ce0a87120ecfd94f

SHA1
6f4b5feb71456cf95d79571850afedb0f54f4158

SHA256
ff991adfc22f8a7385cdf731c8b2873a556f9092da9920dcb12e863d54162b17

SHA512
42fa1c2e44d94d7759d3f8a36a798a90d3301a6a96a41c421ef5fd0cda542814c502ec65ec033776576fe7a128b1dd5a0af0295cd943887cded15c91bd1d9c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
179489925b28c0af80b1f677a4dbfadf

SHA1
12b2b2175c9d0228af05946c119aba88639a216d

SHA256
5bfd32dcf0b861cb1e570b9e2368cf2fd198a1e891401f9d0d7b3166e8dfb1cf

SHA512
c9448a84e19d51e204bf1a3dda71e6915b49e01c8ed84cdbeeb8a4eb00d7c74ef1f9e670e8971b67a2bedcc374bc53584541fd8f471000fc9c97935a0a6259c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5a2739962fb3b0d7c39a0db97a636ea3

SHA1
bf94c0a133688f284c6073b691a416abb2eaf554

SHA256
0a1c922615cdc97d39a02c4f3f6887ef1f8db8d16147b9ae0fb955ed389e6ac3

SHA512
9bd4e02ee3af06495955d844452d352bd7a83c7ad84661f8fd0aa440ca5f8b25bc67c46f1763f827158754176c6b2377604c0e450930372e7bd781fcae1719c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
70419c04f02ae4ca786ca80073a57f07

SHA1
3694cd193f5fa1e8a91796d2fdc4997ca73afb3b

SHA256
fe58a350ce080502d9c21a47e18432bd142e15200ff326fcf42bfbee47a5d4e3

SHA512
6f08d9cf5be0844f59cbc812020a54d5fe440880f2dcf21bfe44595ba5fcf3cebdd4631c0defc05edfc4917f40069991305dac4e45513e2148e4e7d76c7fa84a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4D29.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D9A.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit