9699d530ba826a1b248b6f24c1a216d1f904ca3760166155d8a2bfb944261338

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688dde441cfec22006c288f201820563_JaffaCakes118.html
Size

462KB
MD5

688dde441cfec22006c288f201820563
SHA1

425a8827146cf3ad80155c3faf1a7750d9eba1e9
SHA256

9699d530ba826a1b248b6f24c1a216d1f904ca3760166155d8a2bfb944261338
SHA512

1453c0124ac72e35964174dc6175c767c8076c03987a0b062503c8f2f4981dd7c1b56c5f7a197ed27f90f27fd772c66b0759387884aa23c131c484dd3509bf3c
SSDEEP

6144:SJsMYod+X3oI+YN1sMYod+X3oI+YUsMYod+X3oI+YLsMYod+X3oI+YQ:c5d+X3F5d+X3c5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e7f9a728c8654ad797dbbe5a98041ee49c0c8cfb021eab07aae293e09bc0bdc0000000000e8000000002000020000000d66333434d79c45442e60ae5ae9a1b99e89fa9e3be9125c3f6edfe44adc08c4d2000000076424bc48bd4f8b33cd868ef234fd7501a413bf9c5651658301d441096993307400000006c76d3778458ac47d19eda60d9f119c02e70bceea7193f8ca333d0aa124834bbb932947431adbe107992e16bc35d936e4281d51434eb24d1273f8433185cb94b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b4a03e88acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66026DF1-187B-11EF-AE27-76C100907C10} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000818fe00a15bf86a6806619ebf6ed192f076956b8fb19f54412eef9f31ac47518000000000e800000000200002000000041df2eb4fb230f76b305c454483ce57f3cd6042b37e5bf323e0b61a0f26a5498900000007639247622f05e69c7741d665253bc3f990e4a7e4679733bdc905fb9963bd2c746378e6fcc6adbdb6bb449b808faf21d59d8db12937a005d668f079b90a9643d9ba017c6a1e6eb477045030395ec84e098ab571b5e426449faa30ffc97f615fbb5acf5de786b13c939459c1cdeb335bbe6f6651a874192944d201b5e3289ee5de884a6729f8db6a5db06443ba918c15140000000efdb9b676160ff505b3a6abdd4339a02bcd742ebb96994bf870a1f01545479d4fdbda34cbaab3e8a424db6c2a437285b9f2a1fd180176edcfc048f37e4897489	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572244"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2460 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2460 iexplore.exe
2460 iexplore.exe
2752 IEXPLORE.EXE
2752 IEXPLORE.EXE
2752 IEXPLORE.EXE
2752 IEXPLORE.EXE

pid	process
2460	iexplore.exe

pid	process
2460	iexplore.exe
2460	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2460 wrote to memory of 2752	2460	iexplore.exe	IEXPLORE.EXE
PID 2460 wrote to memory of 2752	2460	iexplore.exe	IEXPLORE.EXE
PID 2460 wrote to memory of 2752	2460	iexplore.exe	IEXPLORE.EXE
PID 2460 wrote to memory of 2752	2460	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688dde441cfec22006c288f201820563_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2752

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7630c42672b5723f54e86120a3bf2551

SHA1
a57ee8e18efa0e6fcaa611c83b8994a0200c04b4

SHA256
2d7569483f0de9f40b41b86b10bdd72e1ece3ca2b7237bce9912427907c30dd1

SHA512
f76710f7a6b309068c9c33f21c5381e13f010784f73a6c93be32867fb309f6bab974662cb32b81304dd99ed2ac3e2065c194969400bb9f2f7cf78e0fca6c624e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
092ed5a2a4a2070711034ddadabc87bf

SHA1
a69aa62cb933910c9975de47c6dfcc13352dda06

SHA256
8c8842676d27754c08823595c4c2707abac0b02e36b1110bc8760d8159eebcc9

SHA512
9aa9198bb39f3227721d441d83f1fa56d892e4b5736bcb6fe22dc925f1d8f16f4d4d7708bbbd60df1649f2f75e8bf8c92d1b614eab4b9892e1dddff770926817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
96407180bbf1379f9a46d42f2dc80535

SHA1
4119fc1a52d7977e7bdf9cacef7000879edb8005

SHA256
f9a45a7b82ac4fbb17524d4de7bbb6c75875ea850d41c6ef1e76ce35fe2bd7d9

SHA512
2fae8c35c221c51518c39a0323afb7071192a0c3d823344e5fd7ede6272391f43677f2713726e3e8023d2d4f73cc46e2e66e37929dc64e3751760e26639de62e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cdaf6e5dc1c567474b652b20f5634b37

SHA1
ee53ed3171f172f8b77c84a93bf9c880d86c732c

SHA256
4e0d73cbc2bad18c1072e4881242f432ce69300df936133d2d91d1b39cac19a5

SHA512
32651ab3b7d84c4a2e084e9b567e028fc626393a30d674bccd839c01c1d71d8dd191ab5cbea89c5a2032050557aa55800533d20334badfb0661660c4e7dd5519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2bace442cc4cf88f69fd392b7f21b8ba

SHA1
67a7b9145b593fe4d70f4f22d7d2e0d082307ad0

SHA256
ae020f9d2e8253644a2414891e8c6f07f622770567eef8905ced5a67512d7f07

SHA512
3b1fbfb1f3f303fc3c4229c1e41c08621dc0d913d01c96840f65a79e9174bb26e89d762de23048be1dadacb4420c26a6777b44083b0ffd97e7ad8673d3db2929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
501a54b5c6c2d031aa4df9fa532d5579

SHA1
300682589c3b4300e4a4c9f9733a8aeca72950ad

SHA256
af11f30da62adf7708fc3e51ed0c186de2f87d850fff5c171652ddfc0210ccb4

SHA512
f064cc809920e278653f9c3dcaf3442f5b0a648a06e21045ffacd3644d7b46122b51be558972db5231a64f219929c532e513ac392b6e749bd08942e4d5eb0bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6ee596a6eabe4bd6bce2df5c1e934d59

SHA1
33b54eacf102af3cfa02bd61136e962dce0468f3

SHA256
1882b2be2b1e1af24cb23d4f627db8ef572ea3722501260b799597918ec6e44c

SHA512
20ace9359a4dd443d4499c735998c1b9099aede4d8b224dfabbc3f39b67928a905d78539a89babf0f0e3cd102c5ee58de814df929cb7afca0763a44b3cab211a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab48F5.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5538.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit