fa63eb185c8127b61d4c55bffa9610d73105e45bae0d47faf07ec9c09ecd9b8d

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6931f2b352b6b758d9e2b4d5f9ba467f_JaffaCakes118.html
Size

461KB
MD5

6931f2b352b6b758d9e2b4d5f9ba467f
SHA1

a670b162ef017c68c32b6bd6abd55fa942544296
SHA256

fa63eb185c8127b61d4c55bffa9610d73105e45bae0d47faf07ec9c09ecd9b8d
SHA512

2ac9334591805d0ac6815fe2df9707f927f988d85a40172d7ca65037bf8e4eb2b10990074546125a054037aa462124c9a69f4f12ed7865a465b738292cdbc212
SSDEEP

6144:SVsMYod+X3oI+YeJesMYod+X3oI+YjsMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3QJc5d+X3x5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0262721abacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000037863e8d59327f4cb6c7453061b5fc6100000000020000000000106600000001000020000000411b809c98979390015faae65ab942061788b4a5ce3d16ba448662b5ad873907000000000e8000000002000020000000226458b98d5c6a76cf8d7100563a301d53320ace17a97a3cbe56de3550e9f4a720000000addd9083b1767bf6aae2473b79a73837e462a1962bd7336a8161cde98620ca694000000093ae8127127ea2dc0acba4bf986bfaa94987b1d72d1f2e0054c4b4669dfd1f672c2b1da90cedf3b5c008f9442755f380fd2a2d58f38ff915c4de6ed441d9208a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000037863e8d59327f4cb6c7453061b5fc6100000000020000000000106600000001000020000000f7e8ab2b731c37567a0969d2c10c643d003977b85080f99d6bc0d99742c9214f000000000e80000000020000200000001e44782f730581c7ad04e32bb3c801ca7a9bc578e04b975e5328db64231798759000000016213a7ea30093ca3c257ddcb1bb1aa6af4e589909ea83a36298c3bf86711f16cdb32238acf8547d04d17f2762a47e19146f195c757a520fda498a985f433b8a43c4cb171ef425453a15a108196faf0e6332cb44d16bcafce593fcda2e9c958fa8e2211844e9250554fd9bb1939f7f7a70070293e3915f67d35c14b427c42d4e4b82225c1133eb9e602e5a02c50638ef4000000051ebecf51a21d6305a0c8bd61fc4b74dad7e3eabbb5b30cdb7ab15c42035b75c7c1a9fed517fc2cbe0eec59dce67cd7cdba9856d5226239cddd7c635cb8af9d9	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{488686D1-189E-11EF-BEEC-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422587225"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2476 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2476 iexplore.exe
2476 iexplore.exe
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE

pid	process
2476	iexplore.exe

pid	process
2476	iexplore.exe
2476	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2476 wrote to memory of 2484	2476	iexplore.exe	IEXPLORE.EXE
PID 2476 wrote to memory of 2484	2476	iexplore.exe	IEXPLORE.EXE
PID 2476 wrote to memory of 2484	2476	iexplore.exe	IEXPLORE.EXE
PID 2476 wrote to memory of 2484	2476	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6931f2b352b6b758d9e2b4d5f9ba467f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
474dbdf1c72002b8c56813ecf36e87ea

SHA1
6f469deeecd43b9cc5b21e3ce0dd375c2966e674

SHA256
baeb2c62c8c291995a7898595fe3689b3a431146cdca40a3129761cfb594edeb

SHA512
fa81282527b54aeac0c4ed74108b73f0462f80ca4c2f4959ea2275a006df2194443c1c1a7b613e665e90b139c80f1c870f5d1a00a72ba19b56b8a56917537ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab1e3d3026d53634ea6f7601c0898d76

SHA1
2c58c10ddef0c7ee50e724ad964bee874a1af094

SHA256
0a5161c299922641b45a590686c211ef62d9f97f0fe0f14396814ae421ff78fe

SHA512
777fe71565e56dfc863f7e9bd2468a3c1ba44f86149225284f1984684c24f39b71fdb6692e9144ad805bf98d9d7f4e9c6686f9675d4cc243f7eaeccc49814c2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
201d28a57e452f0273596f181eaba6d1

SHA1
bb327f0dab0ebc04f14689b3df02dbe05f30c5ef

SHA256
1e594865b34d056913a561b98bd76e9db40d7c82350067a7fd97415f96221d52

SHA512
9a4e6a08f3d5790e284de5631335613377a38c6801b6cb408fbcb5339e16da98293a9ddd1b76c6bc807b1e33e54b79f9f45ed97542775710a8a08dc0ac171fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f652cec1320efc954c0de406e978bc3e

SHA1
d58de2b1ceaca9e56ce2f2fd5a33b8ec0a2e1adf

SHA256
472f5ab4dda06036f65a97398c11e46c50a7375d9cba087a891462e9cc7f3222

SHA512
f1ec029aad2fa93f1337e59f855d8d4ea5ae0ef4398188666cc6303935b2725b1daacabb9fe79880dd0afd7ebd172004522d322c9672bd77ba7fe240381dbca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8d628d9a1c360fd9a810971ce989993

SHA1
396a48d7267ded630c23985160b0320856e9ec8b

SHA256
f7bbfafff4f1271ca8282a789fc6f14237bd554774bd0c440dd96023a3f867ae

SHA512
e4306fda24ada3f5bd01acd9c8ebaabd80a8f2c125483ad5a34780c216c8fd7483998535a2fdd458c3b9ee24461adcfb07f4a3390dfd57e4457f79593379ad04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88646bbd4e5f8ea1d4cd82a9a3fb8d39

SHA1
2b45d2401056e07d852273c53c523be2676112f8

SHA256
ee7ca7b938b159299adaeb23d1dc5c9f6780185d795208222e8a55b0bc356e87

SHA512
0c944d04daf03c2085ace81f27355b4e3e93a10ad0f5248195a1386748c8617039726c5b9a4da3c326ab0d54733e7a79d6e8fc2f1b9d9e4026cb83a17a431cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd8182d86feda13e72b7752d93262366

SHA1
34d4c359eec030271f8135517347eb4c90e29e45

SHA256
4d97604f5c86aff9e63d26e918e7677e2d8788eaf8a3abb39edde3eadd507b99

SHA512
9d257f30a082cb29fae545b101aa712732429162d83e91de2067ab65a970ab91cee155e6485686b74133eca3557cafb728a0d4e5eea60d591d7d43efbb3bd5c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6682c16495edf25d336826761756d399

SHA1
06807f35f7becfc1d1e461155d23f082e61405b5

SHA256
48c9281d16a1916b0f52f663ffbadebce1183c0a6c7022038598c83cd0da65e4

SHA512
5921f0eb9247d02035bae37dfea0ef5c5591eb87fbb1e7e87baaa800fbb1feff13d6fd71a40181ac3e6d356817eff7fc3288cbc888465d6e16efb57cd5c11636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75c6310a77504c8b3858e8fdb532378c

SHA1
7e02afc527016a6ec2a2c0d506ea67c78fffd0f5

SHA256
94030d61c52df48cf3aa3d8dabca9c19f938dd3b2ee78f833ad20e174cc11f23

SHA512
4c0b5061fbb938bc651270615aa2d6072d028dcca59a6bc08e25c716ec9e0390a727c21a34bdb8715d3e25c7d57f8d0d9879db7f1c200741de1a76ffec842b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f785ec2905099c6189ac610eb950e26

SHA1
21393c1cf5ee9d611ebae5f4c369310c50bbbb31

SHA256
a54c841f523b4041f234c2c9ba3b1cdd0c3995c7c1d7d36ebe5a4241ff25eb58

SHA512
8b41e659e74b8f2d374ab98e53700efc16108f1d0879147178ab16ec002a321fa32c68a7ac68ecf59e8c90d75f3a98e6a0ec36417d7de6926f7ca79b60c5929b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b87094fd47c5b92a9729188634ab2893

SHA1
b40828ecd94a568351aa97a9f4a3a99b47656e49

SHA256
05490c5fed217d36001a60b64e87ece55d379a876f566488c74ab18b176ec3fb

SHA512
eb14fb703eb5f4d7bb84ea4ef6b8a183199b5bb1db5fb59e88cd99a7fc3bb109530afe2ec0d2cd7835f2cb346311b2220578d10c604a0462fc3896fda1fffc33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6735b29a756588d6b481d89e92601d7

SHA1
5506a8b85d01c3f951f2eaee90b14998d1fa17b6

SHA256
7fc72bd6c4c5266a6afbd120dfbb3e0b9a20a168e749fb8661a269ef6153cf5e

SHA512
3f366c9b0e652518322f09e78535b089714f79bdd4bf490dbaaaccfc865fc472cca55de764192e241d024b50d80ff3d38287c8e3cb0fd7ee4eef0ac7bc3b4af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31f874e462699c298fed2e4919c035a3

SHA1
461ae88a9a0b4538bfe479862038dd061b55c279

SHA256
eb33cc8e8b903cdca9e64a64aa7992fc7c23a3cf19c44314fda6f8016c152db4

SHA512
92b2bc353f45282a48f475f4fdded6de84d2020e490f2e119494aeacd67d09b628b5357a1f36c06ba012cce18d5a0c5d83c5e61ef54fe98c5d64233091744f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d859992b5d548f0cec8cbc4acd968f53

SHA1
6bbdb313ef093b6754cb5a54f01d987320ef78d0

SHA256
e7aaf994efaacd434cbe0919e105907f33776ecd6d809bc9c65818b70bc09459

SHA512
c63213850a188e22021bb7c6e3290c285605473e9add1ce5689972545d66222c42e44b3a88d987d6c9e7c0a757cdd5981625b004dafa1bdabb103b9e72ee8469

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4674.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4761.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4776.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit