6097a7678931e5f4ff056b18e055aebc016553762e990ef923ee4d99cbc7a17c

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691f1deaa5aa55f0c5e30897892d6825_JaffaCakes118.html
Size

507B
MD5

691f1deaa5aa55f0c5e30897892d6825
SHA1

bb3e04735ff396ab0347f189e4a7097c77d4e95d
SHA256

6097a7678931e5f4ff056b18e055aebc016553762e990ef923ee4d99cbc7a17c
SHA512

23b8fe018bc943999fe861cff84deda0495c1fcd3cb76ed029a1948343ab5b846c5ed64e33289730badf87b81f50f387c8ae3ad8001eaa92d3f9fd717050f516

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0268b1fa7acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000054f85434fb1740b0a71d7aa408543a9c4fd092033659142d6bcdecafb4360f7c000000000e8000000002000020000000bf8a9514a84d89d9fa88e2ebd60582075d2d2e8a7d3c6afd58aa7b7f121cf2d6200000005d6bfd34b620c9927ce30516af4f617a91bf3d3251e60b8d5ad4bb9a96137e6f40000000f85676dd421959224e222017a65a7b4fa7bca149a7e46ffebec45adcb7ded30ef4bb82a801228a97fc175c740b77a1ffe781aa03196b2b8d5164f4d5fe807a71	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000036ba42700c216205ba8a6e5c0ff85a48e86f891ff16e4b0a2408cb12a2860562000000000e8000000002000020000000429b240e55058a778eb4ba2399d149aad22490b9458c2736028bb4413a139eaf90000000bf9472594fd04cea64a8ba78e19e38d23e46588818fc2a4b53a208931274313b2b00e8392700982b918c1974e912d4af71aeceeab8ad966511f28f1b45ccfbaeebc2431c0af516913f0ad9daad178bc3a0571531dd4f9cfb82fbe7f134e80e390cacc42b999d8c9579e212006fe77266bf7ca19b6f49128ad0d69d6d531d6aad227171baf750de2a5d02c4243621c4dd40000000b14ac97494c48c65ed9817cffe982c55596f1599628097de60a84868fb79128d0d7c20c0adb4738c6df2956abb616328d654c1185e2da34f1fde7e9406761d79	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AF0EC21-189A-11EF-BDA8-6EB0E89E4FD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2936 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2936 iexplore.exe
2936 iexplore.exe
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE

pid	process
2936	iexplore.exe

pid	process
2936	iexplore.exe
2936	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2936 wrote to memory of 3036	2936	iexplore.exe	IEXPLORE.EXE
PID 2936 wrote to memory of 3036	2936	iexplore.exe	IEXPLORE.EXE
PID 2936 wrote to memory of 3036	2936	iexplore.exe	IEXPLORE.EXE
PID 2936 wrote to memory of 3036	2936	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\691f1deaa5aa55f0c5e30897892d6825_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49507d4be74a5a030ccbb0c583b3ee26

SHA1
5f8d65df70af3af9ec1f4eb0dcb030cf22ac38d7

SHA256
8fde3b99026c24c02fc1b7a2f0b9d409d983bbe8383f6569323b0a2606fe09ff

SHA512
5d81e99bd4d3b7e5fb6816deb05ee8f04697ff42ac8eb273cf88eb2c0f6cbbefcc08269df7de916dee61d1b7f423de7f5c95690e4a3023b1a70407ae47f123fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78fbfc64d23752ffd731acea3b49e133

SHA1
17d275bde7b3dbc643426d31275aa67d741562e8

SHA256
795c25f5492b5d2eb925f84de4b7c7ad5094e7dc13925021335d2ba2afb29128

SHA512
1bdb22d54135889e06f61327c48bfb5779c7b3048f01f182fc03b3cbf2fc0511fb100580b50b688a475905e0f19c7ad81da9f1a4334bcbc0d0d281534730f4f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0882c113a8f7de03ea4747794f60f45a

SHA1
8725b5a28b43a00a683a8dfda8312e50aad95077

SHA256
04dcf423d8463e6eb2d4584b693fe9e277ab553c2bc94638bd5caa586170e2fd

SHA512
8568bff6b143d4eebe5ec793be9419fa5b802a114ef7f479b3c0af8a4eace8ed51ad8761080898c545cfce8a1bcb236fc211029b101a3ffbf8cfef95479f3631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02f7ce6004673f71ccc8d998d80fd1b6

SHA1
18dc340a895215814256857581c4a5ab036c98fa

SHA256
0f99797b9a985e9c16fdb28c63cd3b9fb26f462982d7d86ff542adc32df19fd1

SHA512
21251f11b7e2c9a47cb236e15398c2306678ea476dd98da8af468d5a9a582f826ba1005ac5e09ca1b0e9fc64ed11519b6cc014cc99c68348b96ac90e0e54173d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db92960d38879e3bc8fa9394957d499

SHA1
59d66753e74187b4e3bf9e80e5885c3ca8116729

SHA256
d4a3ac553c77979e4db888d40b6c2a5d8f2403ac789acc4fda45e47328964cc3

SHA512
147f833a7107bf89fe9e10d27f8b686cb6e9ebf9f6f5ef28cc5f471d6b93d8934739378c2fe06e9b8904813a300ff794bfed9d94fcf59b4b2c4ac063d116c250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00dcb225543cd8cc39f0dd75624c62c2

SHA1
7b630359efa539f0ed8ac479c344306fa15114bf

SHA256
f99b49da08a138ed4c115516426a9a5ad3ecceeb7c9be00defa24a1b216ce865

SHA512
3d936af77df783314cbbf003f454209e623b116010aa5481e07e269b8c48eec71429c9e824fdeb97c575e580928e9bf91ec589fb7732d6cd37e6d24c7bfeeabf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
746cf4dda33c50341125e386b4b8db70

SHA1
8bddd86f92c9eaa3f3b5d9727999eb88b38a4307

SHA256
9539c8221adce867ab3b6047c49edf763c0216988a7c40a9468c313a5e302114

SHA512
b6086701ec02e1a74f32ea13af4047123a50e4262031b11776c73e02b39bec1c5e7e3b33e5506b3c929799c8d9ed477f57f426a500ad5e7bc48260079d5b1425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e369e8e00fccb7bad2e1726fcf615c05

SHA1
48415a05a34b791bc54ca9f399eac93e2b921f7a

SHA256
d4662914bda9beb7f6dff89040d1156a005b923bfafd2d0dd434bf415fa3beae

SHA512
512bc1ae4855fe4e88a01e41973ea66823cee96a312c00f93d809d4d75ee55c36cba8a35ade81a8ca5919615520f473508c759e0bee079c0d21bdefc6886577b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e22f179b765d8369b90ea094901bc0f

SHA1
c3f66433b871d449785be82372b4d8d6e6a16f0d

SHA256
0aa0e4ecfc7dad4708bf516138e63bab67903697193d0f63d10dc3e6a37067c6

SHA512
7e5d4eacac3878ae56100daecce38ebf9cdd5de0d35a6adb5453c0c3315c979325a4f0338877ae5410a3e26b58492982641908c8ddfe87302ee92aeca0e788e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d94d363618bd8b5b1912116d2551542

SHA1
259ccec301dcd64c6ad63bae9c2b9d4a6ab5bdb7

SHA256
db69ae18af83d1c5126069c4aad528e66f3db1f055e41405be12daf4d9014996

SHA512
f06922842ad61659cfd6169886546a53f225045f592c003172503e98129eb3d6419a9ab4c0b634a8dd40b7a96fa9e36800b8c171dbd05a916c34ccc19d512ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3075.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34EC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit