a76d897e5e133bec9ab222d86076e366a2229320ad6ca9fc9d51dc3895edd35e

Analysis

max time kernel
143s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691e6de00d65482d8e68f8cd87b4a559_JaffaCakes118.html
Size

139KB
MD5

691e6de00d65482d8e68f8cd87b4a559
SHA1

0c51151cf8f1a034eac2f5b0fcf9384be6dd9ac6
SHA256

a76d897e5e133bec9ab222d86076e366a2229320ad6ca9fc9d51dc3895edd35e
SHA512

c7cd2a138d971450054606d65bdea53625999298293256b69a5a2afb2534348c9ea8d0dce74a534416d71fe426251410d2e93da0328f40c0f939a8f9df771673
SSDEEP

1536:SkdNVGiMdiS/lEeWsyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:SkdayfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11C01D41-189A-11EF-9DB4-7A4B76010719} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000035215f51c2c413ee765d555651d52f219c14e96f7ba803cb9116f745fa14d883000000000e80000000020000200000003b1b1dea518ebd2c0828eb65d9bf1c34f2bf3c9bfdc25463f2525c9550ad99dd900000002c7f962df810b3cfbdee28258fba567201090efe0bff907d58829d206fb8056808c49e3d76d747faced923576967ef14e242654ac3803e71ae97162b6e03dfa4f84670a215d7ea878d7fd603b3711ac80f8635a338925189bd992039b69be8794305e902056f5e0140417a0000e170b5ce8c23dbb94f9910e3c7c91162f3e045d6717c9a38842046f05e2ff2084d862d400000001034bdee8deb43e81decfa20da3dd95a42ce668a56792aefabf183119508f5b0ca96c89df5e907eac86082ece798378a3e67cc4110847f6b3dbf1de837ae2d0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e54829a7acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585415"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006bad798b0aaea1068e29cdff68fc61b50c477cdf5062f14babfc25789c3de176000000000e80000000020000200000003702b11ca543ee47bf33d5693360c15cfac11fcb0c7ef9a795675150256c67a9200000002c48a88e941bed14d73096d39cf1ff25ae1d8ea4fca631b96d9b470272389ede40000000dab8bccd314e33c38a934beccff3f408f178adc84f7e050b2450e37c6d2710200ea8a538763350da3d9e0c13f428f09fed8853ae66383ba4d18674ce6ae95464	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2240 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2240 iexplore.exe
2240 iexplore.exe
2916 IEXPLORE.EXE
2916 IEXPLORE.EXE
2916 IEXPLORE.EXE
2916 IEXPLORE.EXE

pid	process
2240	iexplore.exe

pid	process
2240	iexplore.exe
2240	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2240 wrote to memory of 2916	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2916	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2916	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2916	2240	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\691e6de00d65482d8e68f8cd87b4a559_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85f45028dcd034e29c42647ca441561e

SHA1
0c24c47eaea12328db97de05170c31b09414fb29

SHA256
ce6ffc8a5958071e64bab1826e9d0f9b5a507de213a0d9acc7842f0a02670909

SHA512
09e9a0b5e65c32e7fcd8e3335b96e3fb230b61f0a45518f8b9f3d2316e3bf94e90001eb9bc8586bbff15dffb680a2b5e17fbcb4f2334ac182abbd1386dcb9dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ad5bf83285d76e053bb6bbe6df24e0d

SHA1
cd5de5f60269e7bd11f4da4d63fc1c9c080eda54

SHA256
6991afe3643f1a15e4f52fca5cfa0c2d1cc79f960cd239e9b98c22f8388d86b1

SHA512
b1b7cea5ad6c79565bd68b3b3606fcb1300c7d2cfb2c4162f7da91695ba60de94197d901c023ce4544d28d43efccce73cf142158ae6781ebf32092c749e3db50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6785327a1da6512eb84a32b132ca1a1f

SHA1
e01e2ad3c2a61eac50f417183dad85d652f6252d

SHA256
8f7cb2ea254f4d2f53abb78ebac56b2c318d62fc64627501f40df1040f451ae1

SHA512
14d06e127c5b70a3cc7c01434aa8b5967760073c775958aadacc1e059baa74960f168ce3055765d83f2dcb663624ca76abe1bc0fc38476dd238ebaf2e47b480f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c54a774f070fff0fffe49d5bab0b2a6

SHA1
34cb9300e4148a10182d82c138f1fd9d197571b0

SHA256
78da4fe358252151042dee8e07adaf284e28956fba2f3aacfe7838855060c4aa

SHA512
8cb61bd5826f470c8fd11f71ffdd5588a8e9526292376b778d13ccb268680b78358ba67a1f9d0d8f75638d213cce31f9e0bffd946c3d60165b695f92dd2c7970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6626ec22b4b1f870c3c012df6400dd89

SHA1
0bb5664505739f8d9a0ea60727d8f66a3f5f0162

SHA256
8170ff52c05f1b769bf4b29245f4f5bcc840e6aaa4fed305c4b21214f29e8443

SHA512
5aca7846c70f36cb7c439657addee6c8a827b29ef89fcf7a8e76b7c4420d25a07247e574464a2bbe56881128a3891bb4469baf688ac4c2dae8c7abe5b5cd09e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20e9bf8c9d8dddc36c1d5747dcd80b53

SHA1
bd0b6b8c9bdb9f0b3325fe2c8d821de9014d8e77

SHA256
063640e363abfb8207e5eb6725db097a2ca362d86d0c168fa701f2686a5be8dc

SHA512
e7f97fd135f9dfd71674795eb92288930fbd6e4cadcebd292072776ef3befad00ac2e4adae1628a74b9dc45387e83b4cf0de70395aebebac4a2dd7d6d4c95811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61e567453fd2ad91b9f326b2075e235c

SHA1
6ed0179cea918f9ae7ad4d5c52c3445d9afc83ae

SHA256
4eae1e0ec47e0eee45e259435040f0813e85c8dcc024c995464e269e5ce54212

SHA512
44981be6d2c6250734ba2f5803d523fe4cadcac524a045452175b1b4584a3a606fa0d1e759369b7debd93f9746d084889d16970e17d4fa3fe6c4fb503ccf06bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bea16e2fad45af37273cced16dc45177

SHA1
8fdc2098606f34ae04131cd309a62583249966e2

SHA256
55e5e75c4700adb8b5b2c4a540a2542ca3ad1e04043348423e6c18a9163da041

SHA512
87e1733a9711569f4e56231649a594854aa21aca1509720dee3dd237150ed7aa48ca982bda1045c200afcbfbe0fea19aa5801a4096d032874e549a01e9a71a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ddd5b9e47e4e7df694a16e8d46e4d32

SHA1
6b003e70f41797fc4d75dda277472ca8f5503874

SHA256
119d76a036e385ec6a27f0c7be9cd40fd1efde4a02aa29dfb63f93a0c0d17668

SHA512
e5885dac5fa83bc6a9ab817a6bd180c4ba2b5cd6755bc1e39b55b74bda61b65b4e78d6e1fc7abe0ecdcc21b34ca922e026a28b25268c1f6f8197e5c7d4e18f8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a29cc1511275fcc44f57e6c305c99933

SHA1
2a5b2b281fce912def3bbc32637ff9bc13fcec34

SHA256
d80cf27847d57190b5ecf7ef0656c4ae29b8e1d21d617386019d3e9e82b24a86

SHA512
8b026d61bf364fef6c57e09b80226b2ab50e9983b0378c3ba06cc08d4669e0cdd8082ae3edac05204cdee0a64b13f941985f3f9cbf7a773d1ce188b7754c2733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
965bc805cf63528feb983449a19a5f0c

SHA1
a33c79087c28bc8a5a1b47d5d037fb7348fc6c25

SHA256
9babde834392106c99d9dfee706850b17d8be2989b38e9aca650213606181414

SHA512
65de61876282f07e1e8e5f8badca61ace5865e39e98a0aaabfa5ebe138e7a7f04d9e938dc045b36cfa4e9eb7cc9fd2a25329897feff45bd5b2dc624a8079c30b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
778467e58336a0c0ec1a2db9be113847

SHA1
020939b5c657ba486e049e7de2e5db2a76af0c88

SHA256
e63a0cb490ada8fa8d08c58c863d5472edf1ec3ba944a800a754fccb9dc59a4d

SHA512
c167b9c576e2c1187bf662b8b37ba222aea653cd466c4e671866b150e59aac643a67c59b959f4ec09c114a1474a3c95c929fa2b4c437e7eb110bac837ce9e41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a504b42d5df603bdbe7d02bbd0df5ca

SHA1
37c538dbf90a59fa1d6c86b9a5fed73b16d50f31

SHA256
de94cf482cdb8e96a9cbe3e155e6a3d2b134d3d87863b80fc1f4e4e3fd813c26

SHA512
7f9fb17e97aef3175dd8c23d9048c5ea6d1b36e7d0de9a250d06fa5f1bf4e0423bf851ebd7c0bea042cc4862a4ec14c4eeec287c7b40c189645c62e781f4ae2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f4d900f8bd1a25441e92ef0b2e32a53

SHA1
e88179bebf794dc201e96d559de9bf2054fd684c

SHA256
7031762a9a370f1d59247b00b3c4a313357a9c4aefc0d28e959fd5048c0bc99a

SHA512
89c17056c88bca6deb0bdb421526b9b59b90c4feaaf35cb1e4799896984e0cec7a41e84091b3629c24dd71c542668f44a5f361f2e4d06602610e4ecfb32244e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3554.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35C5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit