c1ff80233c6bd2ba1fd600b351dbcebea5a7dbae1f56322c49c2fd36def07ba2

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691f09acf75ec2c54da7a8ac2752cb90_JaffaCakes118.html
Size

116KB
MD5

691f09acf75ec2c54da7a8ac2752cb90
SHA1

7875cf59a88b23ee44ac0b273c5defa7713b6b5c
SHA256

c1ff80233c6bd2ba1fd600b351dbcebea5a7dbae1f56322c49c2fd36def07ba2
SHA512

a9193429110f67675de091388dc15685050caaa0959a9a427298a590511c816e0cd49a71a541db7dd07e399a92a0794c7de35d511b8af0912277c05e5a381278
SSDEEP

1536:SbicFyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:SbLyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a896209df1a0412086ccb9301a6e974ee88adf130bdb317fbe719f3ebeb22ed9000000000e8000000002000020000000fb0081719df446e0754cb742cf2aed31da1e3bb3faa3168750aa16fc29c8126720000000c5a4185ff221fcd42d10e00f4ed8b13c10ba095890edf4aa903003bb60e8691a400000000c631d16c666770789cf80ff04ad50bfc68e5ce12daffbb04210c2331bf147769ee34804a3e53f9092279c493fa84f7f4be8cba6fded4b290ec2c18d79e50db0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000cd98bea515eb8661e489a14b56eef49e73f3abf3598b4cc9e8c668f696ce15cf000000000e80000000020000200000008f26e8752920f06cf0ee7a648a54fab23dbecfe59b00a53573a038ac4b140feb90000000714b3f944d4b7de0abf56690959b2eec858d261427ec9237438d27732bbacf20088da5aa103e3ef2d83e38d1c02a428045a8fe89d08e850ddb424b81f16b33a0426dddf6f012da26b7ef66dcf5d6c7d86785b6a131d0a4774e1659a01444d99914d12a132a0b7ed3fe72439c239718018b597c361b455e061c60e63645cb2b6ae4c3b30beb145e12df7a8e6f02bfa03d400000004017f42d8e530c09674c3a0e9dbd3ae0943f1ec845231239136d43a69ace8fe3c0a2da1c0ebe4095ae1cd552215c9b63f1c3fa6eae4a56521576219812975130	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585476"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36B737F1-189A-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00005b0ba7acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1688 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1688 iexplore.exe
1688 iexplore.exe
1872 IEXPLORE.EXE
1872 IEXPLORE.EXE
1872 IEXPLORE.EXE
1872 IEXPLORE.EXE

pid	process
1688	iexplore.exe

pid	process
1688	iexplore.exe
1688	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1688 wrote to memory of 1872	1688	iexplore.exe	IEXPLORE.EXE
PID 1688 wrote to memory of 1872	1688	iexplore.exe	IEXPLORE.EXE
PID 1688 wrote to memory of 1872	1688	iexplore.exe	IEXPLORE.EXE
PID 1688 wrote to memory of 1872	1688	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\691f09acf75ec2c54da7a8ac2752cb90_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27507e6b7313581ad985ef49c2685f79

SHA1
8745ae393540f1c2a7f072bdc4f06c7c56dba240

SHA256
2f5e583f168eeec1aade511a679bff6178513f0355130806a16d40ef75f870bc

SHA512
585b789ad714b01deeb38ee879eed129512a7d199f84605963161395dea301d38cf3ee75c9202230752a9ae75d678ced7ce4a0a275f0be159d32ce1cbb2e8111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf34605491420dd9a051741b777c1c6c

SHA1
64acbf73222842f8b0a8b2242436c737320391d2

SHA256
3a13c3bf7c8aa53ea57af82829cac6a3191eb447aba4daab7a861bfa2d98974f

SHA512
b4bcdff04dbc03bade93f549f16adb7c8b3b57de27f450eefa55dee376d06e2e0de8ee7c0e7388a3049b66c63510c1d0d4b31a25266df6836c414137444da4f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
683522cc3c8077fffe21027691663242

SHA1
fefc7bc85804d07d0ab8669de7f5cb4139036c5a

SHA256
3c9b5869944f6753a6836b1e8919eca8e4554511946925f960e2106503a2b105

SHA512
7d4025e7eb557113784570f5e084ecf06c0aecaffd05e585fbd1ff6e94e679f32889b97c66f10eb8e26e6d473f5efe0c89446de7c11e0c68cdd0c70c4776373e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21816952b0576413d20b07a1215ad23d

SHA1
36c3392a8b4f344809661466bc21af27136732e9

SHA256
10e9674b8202c2e065ab3e2fefa918d7d8d46722be6d872b4692d0d407d9ca1e

SHA512
5f187719f0bc796a96d8a496435492343c6246db7f7daa09edd669be83a0a87b75ebc629f253a08ad26431904b0b7e18e581b86b7201b452afdd92c3e1bb7ff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
677937b6ca5a7fe77520465a2e0ac6dc

SHA1
a62747fde6aa3d4651ab3e2b53c92c03e0aab56a

SHA256
fc34e159f1ad87d5c7a32e5063064dcec69410e9e7797bb6d62fb91ac6f30aaf

SHA512
95d2c0555aab0aa67e57eefe374f41bd34bebc7e7f922655565487f5f84725de28847325c99c812500601846be4c4df6ad37a76c227f6b8dc72f77c22e6150ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57ce915569ff677f4f557a9356c00657

SHA1
c61ce96f567509fc2e950846e42ae2701f2b59a4

SHA256
4a16170dd0603326cc1dbb4534100ea38ccaf57bc357783d26cdee7964c69887

SHA512
f07081fcf984449fcfd59eb63725bad33be63cd8b5332be2ea0565ce4a3827a9d126428803229da4e8bc6da2b247041705e330191fc30c833d7473e6815c7889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38da3d59f03198a73c0311b064b1865e

SHA1
fedfbd7c0c972a01a5f9bf296a02b3104e80de0e

SHA256
03e300aff953135e195bf228752aa6d16d332dcd4852986ef6b7c165c112bb45

SHA512
fe28b00db884c7444c672e291b8e7ede899e14b708b7fabedfa37b861e7d896f48d91e1243a0576f3c8a373adb890de41495440bfba17a1f72f45700cb167836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eab7cd63e274dd39ff99b5045613e01

SHA1
24ef05678142dc506c06112441edd0ae11ac605e

SHA256
85bd07b075990b67644a8a221f86ad2089974b0e29081824ba62408abccbdda8

SHA512
d2f58e53532530c7176f7af34e785afda79b66c6b045512d0845c7a24b1c897f7db1b1dc68d0b9af0eff8cb8d53131bf23ee6935691661b1a5ac08b677c7fba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2184a306e7f678ec1fe1dd47242b353e

SHA1
9ee196000d6a07ad4cc403241016af74442d38ab

SHA256
a074d418a0acf6887cbfa34b58df0b580d302f578f232797e00ef638d4e99a86

SHA512
90d12019793e2ceac1a854978b898a5cb66376b107280ef1b0b47549d96ee3c135444245e5e3299f8dfa027a2b0c915f7962202dae26973b4abc99bc03ca3a93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d832ad36244b7bd3475486e0bdd2194a

SHA1
236ea1a8b205d2de71d42e297f54ce98db388b5b

SHA256
ba9b1c12e8c7096c08bbc14ab99c742eff9fa2b5d74c6095408b10d80f898126

SHA512
f033fbd67b42fa521b49bab34d8d6fff4bcf5d2233d94ad0e72e4768b1f57e8539d0c0fd53ca22e9f9ce2dcb133982d2529962689cebf6ee232a1bd7fefef38f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e7633a25486c449d2da371a1f4265a8

SHA1
a7784d8d8b481695d2756052549ac94f26a16c68

SHA256
cbe9af4df29ed3c1a39048ebadf07ea6a6357bc3aa3fa518febacc4652d45ce2

SHA512
f46f404c4003c120aba1b3b86e5cbf7bde2ca75f053449ed029409da3a53182d24f1fba4e0be6b9c089ac2e5f87ff6ede3ce59b575a498940ad6e4935065a0a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A9A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4AFB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit