5aa39fc3e67577c3378e7d98a49e171b0eb4f2932e93550901307f3eb9b475b5

Analysis

max time kernel
132s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6897cff38891425147822e4b7c94a681_JaffaCakes118.html
Size

63KB
MD5

6897cff38891425147822e4b7c94a681
SHA1

7bf1338344e9ef2230390fdef08523c9a7790b07
SHA256

5aa39fc3e67577c3378e7d98a49e171b0eb4f2932e93550901307f3eb9b475b5
SHA512

ef57bd4eccc3e3eb663addfa02a5779d3453237e8344ae055fe3bc790d1a72cd88eb55fa3d7422216b54125a57347e55b4514b8b6f70b9be91ca5a4c406d132f
SSDEEP

384:n8gdPJ1PQJCpmAWbHFaQYS6ZlkomnXSHH2LlSEcz99Iz/kn7Mu6FlAzdKC9UT6WC:nNmJCQAWbHojaC2zkn7MDjEMegFC1n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000fe5e7c927cca65e122b45ade4c4179088990d1a11773f5de84e5695c3996d1e5000000000e8000000002000020000000da1f18e51bb43f016f21b4e652f9852d094f49269251984ef68619cffff75808200000005ea0ca6a3e28545c5a04a0ea60d7cce72d3eef386569fa115c89d03a4980730f400000004d7b5f7b42e6aa9b676a2922a608cab295aeadc3d9c945d5aefbc1827b399391936d90c71c790ecde762df3d66429de2597382d8905ee4decbee293823cbfcb0	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006fbb0bdd3c65595504e43d761d4795422427f50581fc1bae81d62a99f60e7170000000000e8000000002000020000000455abbc72442db5c8b92582f7cbe398558b2f877f779697032d06ef2005f613d90000000e5d0d869296797a97d70a06490b04a58cb58ec863adabb19a85668052109df5ef2e86c29ad03b6c991142f1eb7f757cfe9815784dd5d5b527ff12bdc5089edf6b125140c2d8ccb19bb79dc066a9560f7b512d285cf01fac06a979b1e946d7e576c42130570f199a5efc07800977c9cfe7e49971e7c7dc8c06e837ca6c00e7d440f1511dafb99094cf702571d0957063840000000fba72756cb1782a2043baccc49e92a19e03d85c8afe605078a78cc45c25b0af72ab5a8e5eceb2d7b396830c5df6f68533422c9f0fc8be0d935ddc50bcc64d183	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f629f089acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572976"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B8BF371-187D-11EF-89B4-66A5A0AB388F} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3068 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3068 iexplore.exe
3068 iexplore.exe
1776 IEXPLORE.EXE
1776 IEXPLORE.EXE
1776 IEXPLORE.EXE
1776 IEXPLORE.EXE

pid	process
3068	iexplore.exe

pid	process
3068	iexplore.exe
3068	iexplore.exe
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3068 wrote to memory of 1776	3068	iexplore.exe	IEXPLORE.EXE
PID 3068 wrote to memory of 1776	3068	iexplore.exe	IEXPLORE.EXE
PID 3068 wrote to memory of 1776	3068	iexplore.exe	IEXPLORE.EXE
PID 3068 wrote to memory of 1776	3068	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6897cff38891425147822e4b7c94a681_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb06290c3ad937f27aa9fdd18e1fa143

SHA1
ab84964c162f20bf7d7f112e47d90089194a8850

SHA256
5ba1b80f22674ab15ef4b16a81b4dfc54c358c0145dacffa0623c8c23bca535d

SHA512
e6c178edd899771526eea22ae9258695376ddf0aba73ba760b0c490d6b3425a13158ba72269ee989c9f997f90bdd27fc6d42d39931476cc4b7a2bae116759115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3affe0d2db957197dfdc670773623d5a

SHA1
2d731815c05b89e6fcbcc7bbe80d600994afa6d6

SHA256
b8dc0da200145d4e8fe2547f1ada7b7f3fa16ac691ce991217f415c0207d71bd

SHA512
28b6c576e9165d0dfcd0eabab4f94df7c3e3fbca602913406914dc3cde0993567f30e2b6248476e754f8b9a83b0501b17ff83ee3b0477399b465c783915ddcfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e3e349899305d3da3f979f63d87ad71

SHA1
5062540265bc82d2fced48b5565196e930031dbd

SHA256
6365e24027e3e406b03c155c937e82ea362180ebaf32f72eddba0e5a135c6050

SHA512
7b72c0bc733d9ff0227867ac4c9eb80c2c0070741179a423100fd48968dfc8ccdb9dda56c87b13ad5f89411131b10ad1620f3ef8688c688800c0c6a2059aaa2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3a31550d7b1a332ff13fe4cc9cbdd7d

SHA1
7b5089f1dd620061770adda40f31267793c971f4

SHA256
371adc0e11d14765010701dcab2f58d243bca757c8745299e84cb4baaef74e68

SHA512
3ab186c4dcc288d6198a5f663004170642c69235a5edde0a2d2ca9f5ebcdaadae5d8b6da5edb1dedd966c9769d8be11abd0e48c42fac553b2e4d6fc805c590c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee449f1a01bf50c36ada490a3c947f7e

SHA1
494ed353c79cb3809b4bf6767bb06dbff86d9ad3

SHA256
b766e60d20e8786cafda165ef5d9a8b6654dad2b144c18f810b07aeb5738641f

SHA512
572ee7b82e97fff614551d9c1f62072b3707150c6d6357d9904b5809e2e366e23e34d5fad16d8aad7a4443408eb09bb13b790a60967635039502142ee7564792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97e15e9f2bdb2158462585b35cabda1d

SHA1
868baa1fa1cceda5ef9155225ceba48855a16e3a

SHA256
c3208f7e85c563adbd295228550b3f6022b38251c8446f2c6d9f2bcbcce1b025

SHA512
8afca7aaebd4f036977506d6bc07d88fbb49ef039ecd3eaa3a940db7224c6dc308a298e4cff02c63b568da928ad35ceb528bd51a4d618774e68f4191310b1297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9055e6a7c582f8e4550c357b9476a52a

SHA1
e5ce32e508c82cf37256af19e07e97ac19fa1368

SHA256
8ed8d660d1cce4a00fc6874e63365d6e225e42b1769c25909e33d225dcb8d8f4

SHA512
900a1571639f30c7f6e9bf8aaee9de630d88cbe8b4d22545520200fecd260e2e3b1b2cc107dac6538f6b677ee2f8fec532d7eac24d88cd1fdfe92d1304ce1d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10c8582726588a5612b6746008e58ba2

SHA1
1855838a7af5971628aa40f502a33c9a1ad81dc9

SHA256
dafa1b005038dca2f88786aed9a72a642ac9cc7176b704f75f499f8a21838586

SHA512
3ac29e79869c6b992a65764ddbf3f0cdfb85947b30b8a9a94db127d10af30335f8f0370283afdcbd1b5261b42724867ddea6d4c4de0552dd36207733bbe549f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea578197a9a41bdff72fe17a33861e0f

SHA1
8b98c66672414376f22d292713e10bf85de051d5

SHA256
9cdb81c29b163bf660a559fa96079587f0d8afd855e41eb85f7822dfe39a7ec2

SHA512
aed56a6aec5e151e989665a732f0cb2c6e4d1e9787bfa0dcdf0253334bab7702573cc01af892ab55ff3c39ad0a0a7bc7885b75af34595783b4f54e2621ec3536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76f6ffd33f461ec0afe40ab4a9bc27e8

SHA1
077f4ac979054ef8af34dcd5f34eb048c488c8fd

SHA256
74753563a1f3f27c25fce4c1a8b469afb656ab55598c195a7e4ce91742233432

SHA512
3c0ae820d453b2359a63effbb1c10fece49cacd39dcb0b209062f3f770182222310747a2b1af525872bbd02d30852d6e6ca8611e2a58da9f7f03be0985ef46db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F83.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FD4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit