79fd113e9d1d5f2f49ea91c81224681ee42adee9e8b957db8f5b930ce14f81e9

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68a4dd08fce7dfb3e2d15d1639bcfb41_JaffaCakes118.html
Size

32KB
MD5

68a4dd08fce7dfb3e2d15d1639bcfb41
SHA1

e92f4ed10967920d63472e68d40485b6d6fe4f1d
SHA256

79fd113e9d1d5f2f49ea91c81224681ee42adee9e8b957db8f5b930ce14f81e9
SHA512

42a05478b77fdd917619d6087c257ab27367deaa33e8cac116163caa0ca9f24ed9ab8627bcc200f628fb2b4c3fc1c0b0b1f12c7a5727b85845b32c0aec75cae1
SSDEEP

192:uWTpb5nh23fnQjxn5Q/pnQie0NnwnQOkEntHbnQTbnBnQnXC9Ah6J+kAbieUTTVV:rQ/SKt8himM48IVOR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d012323a8cacda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422573959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005e2279408a87d64c99fd284f92e5e3a700000000020000000000106600000001000020000000b26008e6239508e54efc21257768832d4a82bc6c10882179324bc725a550e225000000000e8000000002000020000000a76f36e4665d6f5f263d85c2cc04eaca711336cf4162e86776dbfc0f4c56cdd4200000001130a69734ea9ad8f0456900ca25227664a1a5c3baef106cf854aa4077b5e1a540000000b869f727841fc35ceedfca9c0876f6cc9d9f310a44b6ba659dd8f34a30ca1fb2f2bc62eb80ed5a2d0b3161691d277ea508902d2f9cfe0e899ccc677ee2f36624	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005e2279408a87d64c99fd284f92e5e3a70000000002000000000010660000000100002000000053bf39288665f7fac695fe9de558d980772db7542fa15163c1858ba249732603000000000e800000000200002000000063d2d38e0170ebe512634a81f64d3338e8a494032c8ac7f040d943118e4578bf9000000067951a288993b00e064a65637414933324e78ce6d0ba5451a10d8f7954f864c44032dfc298176da04ef496d1a328f2f2d0708ec24605498b116c5f9fe95272e0d8ddee0269055f03f358e3b34c62198caa7c41090da42cf5113ae5072c84c245c5e7f065d1d01ccd3d4411423b815863fc86f0cfb21c66d8a70f58de9467c0b351af7e1b90e56b355272e3a9674179044000000010df52fd8fc99bbe8be6d97e3258db194b42f6a31ab58a59ef460334ef649354ec9fda00a055b0669b796b748aac9240e14644f89418bfe418a6644307a87a57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6566CD61-187F-11EF-A499-62A279F6AF31} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2868 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2868 iexplore.exe
2868 iexplore.exe
2568 IEXPLORE.EXE
2568 IEXPLORE.EXE
2568 IEXPLORE.EXE
2568 IEXPLORE.EXE

pid	process
2868	iexplore.exe

pid	process
2868	iexplore.exe
2868	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2868 wrote to memory of 2568	2868	iexplore.exe	IEXPLORE.EXE
PID 2868 wrote to memory of 2568	2868	iexplore.exe	IEXPLORE.EXE
PID 2868 wrote to memory of 2568	2868	iexplore.exe	IEXPLORE.EXE
PID 2868 wrote to memory of 2568	2868	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68a4dd08fce7dfb3e2d15d1639bcfb41_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee6d2230ad32a93245c6c96c4e30a448

SHA1
af59b1d9c9407476cd99a6f482371ce5f6f3191c

SHA256
6fea5d811892d12e557f7a96cf349346413f1af21d60264d6d016ff18f261cf4

SHA512
4ca67510d39b840c458d98953c51962085aad709f4a090f197ddd43462b5718b61069e879fe4d332379c9343870bf5d4ea861911bdf4ce9bca4f0cb1248a6905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bded1066468fef0a48809a52f2afaa57

SHA1
6ef52a9a714380421b7d84ebd063b8fada131f66

SHA256
42d1ab89f97f09e899783add06f954739cd71c1ccc5439bdf767571f495f0a86

SHA512
0904c95562f3ea778893f719035bb940343c89f9d3f463fe5756f5557db8d4baf21e8dc2a37da050dfb186a6dfabdfaa708a4d98261fb655c09b212c7e03f4ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30e396457e7885709272972d6ed89682

SHA1
7251a623dc6e61eff472ee963b60d5ad4012a249

SHA256
8bcdbac15684ac3e3e70660380f7e22b0f88c51ca555e0536423ad711d7a0d7f

SHA512
0dcbe62b46c60cfee0d4032db334c581083963df88e23f87c10a38996f2b8c0c915bc72fa78f7fe3121b2612bc0eec5e13df7d4cbeaa73fd801bb30970041c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d2ccbd71e9ca3c63aa14c0120a2060c

SHA1
c22c2b1c127e5b67802b174ef30ccfcfca4649c4

SHA256
ae18bdd2057814889d81467ed61af33785e3561c6fee4bae53f5a92db2d023b1

SHA512
42f45db8707ea9851360767e03a5eaf11bbd40cc8c5613bd6da340ddb5c483530dbfef75a62082a0af5e911b89aacbe36008bf97e59e96653ef5669cc4b175b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4496ac0405109e912d5000c2987efa9e

SHA1
f786357616677853177f0f1cd75994624100e048

SHA256
63ec931684f0f4ccbd6759b9dafab097956db03577e1c52c3bd91350e9bbdbf9

SHA512
45889cfe354997ee8c3ecac1d7b081226e39e1671ceebb9a0ebe67ce952804b9920788e86f27eff28491035f7e0064733563dc56529751f17fd4faccfd3ae5fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30cefa05cbcc04f5b38416d752eca4d4

SHA1
f14da4e49941f63e9ac41fe0ebcbafbd0587ac24

SHA256
289d7fade2b5c5d876666258ec52a3ec6a2bcc9600dea17bd71323d7209ca126

SHA512
69dd044d059eebc5c8609a8ec4cd6768040f1e8b9d83847d8042da6331ff362525ce2f6137971a238f89fa8e372fc0001a7408c83dff781c86645f9c12ab7511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c17648659da69040cc1fdbf639542d3

SHA1
8cabd83a4d3970d2b9cff0f1a20290b30a367d93

SHA256
f6f7d000e87c637d6567521017a70a1bfe99060bb41877dde79e97f41a3e1bcc

SHA512
ebe144b29a5fc3005e863cdab478c6b68cf8b55c9b981f1a6d907b74d4de3cb83c5508e9cd3c94abb70162d98eb0ec307544fe88045d198be86d5b049bb4da9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b6460ae2aadd7d435b2163f2efab343

SHA1
208750c470e935766faf1f18e42b06442b960e08

SHA256
57c4d70da39e9c45ede136faeb5528be971506d83770076c456af9debd0a1110

SHA512
6da2d9acc59c2b3bd1fcc805de149433877baf6fe92039cc1c48696b11509d158dbba9ca9b7de4e5e9a4b08f3daefdd409ab29afa6683d89e48e22b3a35fdd8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0fb4f56cb5caa4daae3791ebd803917

SHA1
197c6b2253e5ebe9d5bb0782ef166251edfc00d6

SHA256
f19ed1fb9309d3a0e343e8ace305c68af6b47c55dd847fd4bbb42162fe30f81b

SHA512
e4bf61fdf87fd6682ef142dd1d5a4067c9705942de5ded65ab83bbba52ecfb0edd1633c49e8369cfab2e74420ca507c9eef514b17b681b84d51b1acd4366c3ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d14841b5dd22d72d37af1609ab2041e3

SHA1
3aec15310b4154bd13330aaa91eb39fe84ebf114

SHA256
3350f4ace1a16d0af59e73faa36464841d626a30513b5f16fb4d2aaa028619e4

SHA512
51bf33d6cba59d7bc41ec25ecd0a99c50ae6593ec7254998f6365063c60a88b75a3c2983308565dfbf8bac620f1561c0a04b153c3b1b5269202c08ecd00e9769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd2761e850b869d34faf9800f3ce9d20

SHA1
2fe59b02eaa88981f5f94f44cc92a216738fe39f

SHA256
22ac31410a18a97aba442fa879700c96165e2470b6e7dfa692df964e205159f0

SHA512
c4f6dde15c0ed42c4492fdf1657cf7e98c9e96e847b572a608682b3cda563566aa9543cbc73ac2223f052398e838096b9e0683feb86cb6c27e205caa51cad434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6ba4d879b614da54e8cc4b5488a64cb

SHA1
d7eb1057feb13da6dba3fa3454c8993ac8890500

SHA256
fbfe644896ff1c91f04770cb9ab4b8f65f44a59c0c1bee0ab6f072c2fa149523

SHA512
ab39364aeb9966558a563904cff13d9bef018a1d5f1758cfc0411dca11c73e2f7a42df48fef3d47409006f878398a5d8ce6645942b3e786260d098943d57b336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd99487298426d85eb61e5cb9f424557

SHA1
a8ed8016cd0319571c97080fdfc431bc7d28ce56

SHA256
f2e0af10fd183fd988d572f52452c2d5d5cd97b135ccf201418b1ac7f179606c

SHA512
26aa6bfda77e743acce8cc292421b3dc86adf9ff12b5e485d885c6e7ee0511b2b5b4e4d38fb4977a4aa7e725be6e0b3904000f2b46abb47874eb32935aa73a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3903.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit