46b4d8d0085e6fc246359fca28b18b1c09e75b59b9e6f6f62df9108a17c73df5

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688e09e6e8d520bef020c72eb2bdb3e4_JaffaCakes118.html
Size

19KB
MD5

688e09e6e8d520bef020c72eb2bdb3e4
SHA1

7512b7f69de161d3640192c6d5d31a42bc84de5a
SHA256

46b4d8d0085e6fc246359fca28b18b1c09e75b59b9e6f6f62df9108a17c73df5
SHA512

96fcd10eff712c6390600029a266f7c8909b9e22d8c4d280bfd60eb141e28397dd58525f113cad610fb2ed95147ed6d61d69668eadfc9d097472264833677d97
SSDEEP

384:zivK8vLWmBVBD8ceLQ3RLpq+cmWsXucfIk99hebzVc9a:zi3LW4gceE3xpymAOIk9S3qa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07ee23b88acda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd8394cff025df40b43ff0314732ee440000000002000000000010660000000100002000000065871b47986996d86241d9d69ba062ba43fa68a636af829b43fa6d3735d10741000000000e8000000002000020000000b3fe4328047ff71560d4f1b9b1cabbf3707bbfea539ffa46cc258d168ea3871d90000000b85e34a555caee6a5f9ffa8e4b4d951666420587a4d6743796044fad80b9ed2123fb445c269441f5e7b2be65ca61d414188276a4e8d868fac0a33b748ae5e268b1040b1c7f3fa9305d8a8cb3cea7c2db367ad278d6da5e0e8d85fb49b8c06e72c39741ce266a1385dfa556fc1688bd51dba261a173ae1d2037bc871711c9c62cb00e7c37a3897ce7376cb9ca4cb3351d40000000f0c5b39c09c89ef3565231624733d101e4bf34e4d743d049583ba22fb3a0ed7ef85d649dbe9d5457c6e9e62f14bf75b4a5e1192573cb65d09c35b7c10eaa742b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd8394cff025df40b43ff0314732ee44000000000200000000001066000000010000200000003df922cad1b6f2f414dc141aaeebeca5ce1a817b60ae989fdd85757c9d36d6dd000000000e8000000002000020000000dd2dd8f438c4fcf547ca3215dfd5e1cb758654a61b6720d1ed48f1222c43d39920000000b4348bcaff4f4e65ac57fda9baaa5ee8f6716370c87815f6c7ade9000aa8b5c1400000001f80b7d9355740a7154ebab4e831e00198a76b554d42fca076a1a857cf06af97efe0a260a613e248b95f69f13d4b4b320bd73811046592e2e9ceb21330eb0b59	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67321451-187B-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572244"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1660 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1660 iexplore.exe
1660 iexplore.exe
1388 IEXPLORE.EXE
1388 IEXPLORE.EXE
1388 IEXPLORE.EXE
1388 IEXPLORE.EXE

pid	process
1660	iexplore.exe

pid	process
1660	iexplore.exe
1660	iexplore.exe
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1660 wrote to memory of 1388	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 1388	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 1388	1660	iexplore.exe	IEXPLORE.EXE
PID 1660 wrote to memory of 1388	1660	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\688e09e6e8d520bef020c72eb2bdb3e4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
a9c8db34a648855c741e9e822eb2fcee

SHA1
a28377cbf3a21976071325ff17153e8fcb435a77

SHA256
ddb841f2ad608d3b050bcf8cf4c384c7db1f5281a533c90a3a87d5191063aa6d

SHA512
c00d76d8e8601b25167887a67f34082027220b887d8f67a824862a6af229012c5e17cae8f27984d740902c1d8d6774e863a34020a479918cf02c4431bbf1149c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8baf50f33237b87689d70d69276e3e6a

SHA1
230741f50bf26e7838ab215c1bf3beb94a519cf5

SHA256
68b12e7d94f517303f39863d45a786e16b2cc5bc815c7f6628aa37dc3cedc340

SHA512
84ca50c32c01641390873108ded15f13ade0c03a50c238a426bc16c6b26a7aa0cd020efd08bb679351fde6720941bf12bde8c9c4d323d85a9a0d4d007084ef0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7a621467e59261ed643022a1d1ec5f51

SHA1
520eb99ef6232cf6cb2b28fa908ae4d02f7a3c1b

SHA256
6f54d1683f580dbfb7e29b84423063ee8895e325fd2257a8adc2797427cef576

SHA512
75c79db84b2902ac3c568d4192f1e26dbfc739b1db74ff27858eaa2959c6b9ee330cc329ab9633d68da4652d9c3e86a095404c8f862183fbad513e8d19e75b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
28d0f5b334023052884498308b42a85d

SHA1
535822999fae0b9d310f060e6d019ce5f2d207d6

SHA256
f68b1410afaeb2f2b6b5ef1266ae470d7ab3368f4afde8728588a76bb27276ae

SHA512
52177d5ee029a8a50699bf6ff670b2c5071fdcf5755c0d6c67f2119e4ecdb063982fec731ff2e6ce1d31a24a87676af253d37fb89773d2df7c4d2074e65eb511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b07748a372ce626dd33f5158b725dc06

SHA1
0ef18094b9f3ffe7c1deb328fe5a872d7a18651f

SHA256
5c377b2d5da8bb732ab619416dafc6f4ecee0d0783fd08be6fb7c29e1893ecf3

SHA512
fffba8884f58bd71a00df7c6a0c848408474a2f0128e0c0e1e83550e02b6cb2e088516758421cbf1ae59695c0a9ccd38566056c2716c37c020fcfaf949826fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e1e0b0fa8029663913fce620e991c521

SHA1
91e1f787d2bbb7b098ca247a9645882aeb06611e

SHA256
7ad9938fcc44eb6eccaf86401c8a76ea42230b80784112be5f7503e83874fc79

SHA512
9deb167cb1bc2a40fcca450f0c533ec863062a5afc03c06beeb7f649bc80116ab1734618667dfb24ebec87a47e1992dce97ee89e4f38b5310891d761bda79fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
dde045029f43684ba2186aea41b1baaa

SHA1
309582358504b2df44038ab859a6b4ce78f61340

SHA256
4887a43fd061079506f2b76f188a4f5190ab314af80fb3bbae87a54a92a24b98

SHA512
ec0318a2fec08420985575d27195b6a05bdba678001683399c0cbf746bd0b8e46b4f15c4939e6b1d1a0eee1db8300043632885bccd2a4b176830b846c2f82f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a9522ea67a026815b5bcc4479229c58e

SHA1
cfeaf2dc47a794b1e0a3160469fee6af63522d3a

SHA256
97d56bcf44685d734c40f62c257d507cec03e308fcd7fc382b143a897824f251

SHA512
3efe76d0d1024a646796952f9566c72b1f924cdcbf870800e13736d05cb498db4ae5ba38d49af3cd2220d5178c2fb56229777a3e596b793297ab7874657e5573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
48754f7fa661de2d083e1d5c1021dd3f

SHA1
46bb1486a2dcb364a450410604b302a1e150e274

SHA256
9d5f12126e5aaf3096b7bb173eadadf5c736a5464d6d7da6dd12e1cfc3b8ab20

SHA512
87dd71d0354023c3e4e34e1e16b0d46df8f008368772553e40fb04a5487b5d4ebca75016052276ce780d573258f98cf23cc7f82d05f70f7d457c633bd7d3ecba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E66.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit