04afeab0a1a530c55827492140f0bf94588d68645533830dd5b9173f74425e47

Analysis

max time kernel
117s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688e8b62e99533bb34137cafbe49b07a_JaffaCakes118.html
Size

1KB
MD5

688e8b62e99533bb34137cafbe49b07a
SHA1

c4a88359dbd6522a4b7ac213830655d66dd1d602
SHA256

04afeab0a1a530c55827492140f0bf94588d68645533830dd5b9173f74425e47
SHA512

f037b22377d9b6a99010bbd7d9785afd27c45c3af17f760ca1c4850af788dcf7a6ae8a45ba7632cf56d3618148b91e45ebb475708244905ae6a644dc47e52be3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bdfe87fe342f349956020f45af34fa700000000020000000000106600000001000020000000f2532232951d96ea3c61d6500b9a9058c352982a9ecbfbd1ab7b63b644f3d872000000000e8000000002000020000000db3c555916ed98899fd4ac8fb053a4566452d58c7c8a7db1324bb8ee251cbfa99000000012b988eee8b215566f8f64c835a77f8a67131266ee9fe584a1e4210399b238937073cb9b33894cd4750627f59e2b32fa5652a6ef52448ccf9c6aacf67ed43ca88d265ea47c39d3dc6e3fd24a526c424e0f8ebc462bd182fc1ecafc77730198ac0b3a1f136c6afef921ed2a7221bc24820d32da038b623d8324110240dc0cef6ce3536ac7abd223fb54274f0d680e2df540000000fad366ffce2ae3b0200ed489f0b3210005035f4672d7de1af7ad50ceaf53817dadfeefe03568fd52d733e9fbf88516709d1b056e5e386db3dca101d03f69b4b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9174A701-187B-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572329"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bdfe87fe342f349956020f45af34fa700000000020000000000106600000001000020000000e7f32a0c63e4b8f6c2ba835ba8a018b6c7c39d828d45cff22ee95312cd0906c9000000000e800000000200002000000017fab03c3fd55a57b9d19d73105002a004176ea210d04206b3f5107edf79e188200000006e90b8850059f214936426116b197be688cb2e920ff88546697f7b076ad0e02a40000000e3b73c8af0e37b0cc4c2492264af66667907105a97006b1fdcb8c94a8fb8a067b08321ba12f9d0e803a97e1c1e01cdbb6b340ba666eb7b34f92b285815c8a116	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1022f86988acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3048 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3048 iexplore.exe
3048 iexplore.exe
2560 IEXPLORE.EXE
2560 IEXPLORE.EXE
2560 IEXPLORE.EXE
2560 IEXPLORE.EXE

pid	process
3048	iexplore.exe

pid	process
3048	iexplore.exe
3048	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3048 wrote to memory of 2560	3048	iexplore.exe	IEXPLORE.EXE
PID 3048 wrote to memory of 2560	3048	iexplore.exe	IEXPLORE.EXE
PID 3048 wrote to memory of 2560	3048	iexplore.exe	IEXPLORE.EXE
PID 3048 wrote to memory of 2560	3048	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688e8b62e99533bb34137cafbe49b07a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
91e1a145500dc97c25ead7d22201f311

SHA1
f628f9babc3cf2e873f84ebe066256fb09cbf328

SHA256
de2a06b5c426de62230308eea2d31740fa881d0739917706b88c78e5f3984c17

SHA512
dece78f845a9056cc70cc8641fcbd5f389c8fc42f96c175625671783ee3da9143fcc05019714e1a8d453913811f3ae15d1f5133f98df941042e71bec36478ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
10ba64828b4ec3ce7793cc31996dca6b

SHA1
30ff9d7a3eaeb354bf616000a745614caecb0f88

SHA256
1b1564a89594b21b4119276880d02cf49d5c9c3a434caacaea897c1374992be7

SHA512
1da05f9c37cfbd52bae28d43e9fee986f22f0143557be7c04c5b9a19ec5ab5e8c4b73d6ffc183cc0d66384a30802053a18c72e00c6cc16ff810f646e1cb39dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
c569fb18fde43762b20f3e26ac9e8a4a

SHA1
d35f03846079f4f780db504324caef69d98c5bc5

SHA256
c0f5c01e79a3af10dadfb22de6be98fa72f94028056249a1f72688a5d9975068

SHA512
15ec09a9ce390fe6e69771107a21b1c2409892be0d02b7912ade5d984cc722b1213fe0ffd35cbc8d4d1234baf5a247a49c4290ee4e1ac66cc3dcaf4c6cd370c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
366853feb357cb8f475e4100ea4154a1

SHA1
654903d8fc780a41df43050d82f7eca64da2c655

SHA256
4237b70a7eac77c7113e3f3405e78cc36ef5209d0fe471411b26a7e1aa7452c8

SHA512
813073eba8372a9f4c3957bd38c2707d50454f8acd7a3d0598c4791d73823ed6340563c2d7495ade9a74805f65769d3f80df58c6c74dd4a5c600d3083874b7f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
60e8e8bf695d8a08613afe8f4b0f59c9

SHA1
924935cdb8464957bb7debfab0cc19df55d3871e

SHA256
2d859f83c5c82a8491d8ce4bc0ac5828a1178bf8e9d8de0e65d668735634c8c0

SHA512
2d847db0d567b393baffb2202127ad399c5df93d8b4baf53fe3b33cf7f7f37b4d193f94b2e489303281482517afa4a03ac1ca061c1f3fe7add41df6cfb4b6efe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
816d591684edca25a09a6a1ef79c9487

SHA1
9189c3bf38db1205542192567bfcef02ec4fea88

SHA256
17efb09ccaf08b4b22b38be4000acf65d4b806194abfaa8b50effe1a6aa6d445

SHA512
75245224bea9ac7761574c8c3ef3b826b3ef0372f030b863159218f2a1fb6e12f3f932c4568aeed5cea89cfac814a4dc6986c203ef12ea3e408a58c1e279bc86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
af56bec26dd0312e93373469dbb3751a

SHA1
0857db08672b66c23ed0ede677cf7d992c00b227

SHA256
d8e6e66ccdb01cf9183177a6c3c34befe2a608a40055f6fa1d546803226f03fe

SHA512
29e07af486e335b9434df2a787261e2f334db4de07ec282610650fef72a47bcc66ffa0a46ce3e1a624f843e4b08d5706ce649f696a82e3e509f9dbd649e9514d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
8ae10952ac0f64f0ef92635a837e11e1

SHA1
8d869701c035bb744ba1c5d2c5aede3288de71c4

SHA256
a56baf41410bc8d0e9fba23ad613c27436634736a903871706e2d36c99d82af4

SHA512
0c98bea56fdf9b9f84cc51e800db360a941e3af179e9b8326f49fc39d7b397826cf8360b9eb05467526b1e837040cf109b1a0d19102c1a432fe2d027c082cd14

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF29A.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF3EA.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit