136caf04d8a0d0857bed1711322ea54b2d6427ceb19dc7f2aea296b7608f773f

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692235d09328d1b98cf89520f4eb5743_JaffaCakes118.html
Size

132KB
MD5

692235d09328d1b98cf89520f4eb5743
SHA1

c25e8e4bef61625626ee74e63fc56418a569b3fe
SHA256

136caf04d8a0d0857bed1711322ea54b2d6427ceb19dc7f2aea296b7608f773f
SHA512

2d575176b94ae5f3d158cfd333c313225cf3ca4b4e85394bac97f1768eab51a85953508163a399a1fea0e56104a42550b23a67a3bc621059b2ffbc00b74065f5
SSDEEP

1536:SwyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQb:SwyfkMY+BES09JXAnyrZalI+YPRD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA7664E1-189A-11EF-B390-D62CE60191A1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000abe7cd7f359d22c05a07727ace6002b276d0122653d5c77a8e322360fef9f9aa000000000e80000000020000200000003b3d61c654f81c459123ec07a8d7286fe83bd39d0cecaa11b619cf2076bc7e0f20000000eaf5b812fc6ea897ee41440bc78cbd6dfd2fd12161a01b40139ab4f09aadbeeb40000000bc7c8a77cc714eee17ee2d79106d88fc32962dd6458d7d2a911f841c34fcdca2062cfefdb8c2cc309a9f4739cb04d1c939645fcbba242895c8ea5b0d7dbfab1d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585805"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705832cfa7acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000fdc067c78ef9c348c6d359113cd612b1b4afc3eb7d7324f4aa2361f96f387654000000000e80000000020000200000003b7f1d99900c4944c6868ec29f8cfe3457953f20c3881a0742cdbc9cf75a13fd900000000afab8e91bf4bb4a70a8617a6d0063542bfded351612e8d147a0b5639bb126f324174a17e4311bdf1a37a9ae201d57fb9cb1fe5c0a3a56bdb5d8eb9c666ed0a3fdddcbd288781e79aea5cd21c5f8ca0751a038a922ca1263721030ef5d72838f666519392f5995347d5aadf7754246c05ccde461ed53f983a6d857ce57ee63bfb31f6429d1eec80d300f0479793768fc400000003c0693c86176dbf324c203caf2c3437c1859949e3d288be54d181b2e84539d7511931451fc67aad74456f0bcfb0e2b3cd037574f7b8d8a9af98c9aae8947c6f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2436 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2436 iexplore.exe
2436 iexplore.exe
1976 IEXPLORE.EXE
1976 IEXPLORE.EXE
1976 IEXPLORE.EXE
1976 IEXPLORE.EXE

pid	process
2436	iexplore.exe

pid	process
2436	iexplore.exe
2436	iexplore.exe
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2436 wrote to memory of 1976	2436	iexplore.exe	IEXPLORE.EXE
PID 2436 wrote to memory of 1976	2436	iexplore.exe	IEXPLORE.EXE
PID 2436 wrote to memory of 1976	2436	iexplore.exe	IEXPLORE.EXE
PID 2436 wrote to memory of 1976	2436	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\692235d09328d1b98cf89520f4eb5743_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
142b06635cec920229da7ac67401bc40

SHA1
4f5ccbbfe084ceced5611763c99bf6fbc7109444

SHA256
f0273e30214dd712224af59193bf509a865d86e6a945d2503e1224b05453a0b2

SHA512
1b8932d53085a0eeace21f6931d0e8b3bd555ee8a2e493befd4ea76ad4810cf979ba83943cdcfebaada6286b59286334e4a5e91bbffce55bec3e0b950845bf18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88b6e2b0996383f75f95b762ce936824

SHA1
02052c83308e30493b35821dc196c7cfd2d5496a

SHA256
07a8e3f5faa42078cffc9ce2713d1ebbba570d20c834cc4ae62f940c73c416ed

SHA512
e03d071f6f0bb7d6f769fc546d800ab28bc82a1c724bfcfc0ad2f89e67e043a937c0e78f5ca042b3373471767df0bc4eea91dfec297e3303f52348a99fa67237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eeb55d76a75c6d61294958c7d5dac8f

SHA1
224f56a353eaf508a5fce9a6c880a00dfd19c31a

SHA256
cfd52e72582a322b6eda66f3245fe9618b591bdc95a372d7ad2a62d7a61ff59e

SHA512
4dbc05f9d320de5d1b96192abcd9a06e00a23edaf66c796114e7f19cb9a10b1c9921fc59dbd9d4edd6b87327cc7774f2433649495496d82ffe5a4bc81a1a0f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91d9c6809ebc7e2fd369c874d1175a0b

SHA1
6a4c4fde3ed550aa7d7b4d1c7968ad1bb974b8ef

SHA256
7870440135d3f716fa995f48de144b21142b933c22daaf7cf6379223acbcf83f

SHA512
3433e2f48863dbc63570a62d0c375c3c86561044fe633e5bd0eee83fb14f964510c23a6c029bee24fa84e848f50c07516b292471f894cd16d4d25ce43642f3e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c9d0dca68c0aceaedb10f0cb9a72fc5

SHA1
6927b32b6b3963c1c268bd7812b0ab8f8da8ed7a

SHA256
8b839ce93b03786b676761c5ed1d5bbb162f3f12ac4fe8763e531b7c802855bb

SHA512
cac9db5f90a4ed473191d9a5516ef1699407d7817bc71978df834b4525e0bd49a1f195282eba74e8662def9991627cb892c14d16dc78bbf624d09d3336365a3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c459159a412fdb079839e00d1f14cab

SHA1
b461670be5579aaf5e0f5b08214868154749636b

SHA256
df9c1849979e5820d7bbbe3eb45f43bbecc2a5cd0e848c6d54d4e020637363a7

SHA512
7b6ed6a07af3071a9b2ff420d8aa556a57622c1126996852ffcaa8cf908f77f345098a9107f3c69e1ba2fe145d30e33334940b99f403e2bdc898df49b413f6f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9010d93eea800adcbf9b516968f3b29f

SHA1
b8693931c6c98fafec90fe90ecd08a51085e328f

SHA256
f1e1ed08084cac8aa1cee5ffae52c326eec5fac576ea811a7379938424e0da6a

SHA512
027aa0a90f5117eebcc0f9aed78ead8b1beda606985c12753dc71371d51e42dc38ab42e4015569114f2100e60451c4a6493eb62ee6355c4774bccc32fd9648b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a9578495478387f4ec6ee1781df932d

SHA1
a198735fd000595428571935059dda76066cfe00

SHA256
a42ec3b84d70a67ec113dabdcf8c456f029e0f28bfe1f409e37841d371d061fd

SHA512
623801e150d8210be16cd62823560764da13818fda13dfbbe654cd65f45bf7e6f946ed6e68e059d714d897637104a60077339a87c8c6fc2ab410bb9f006b3aa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ba42bb6fb47004ecfb5c59a6ae93795

SHA1
81971ed0edcfbfd530d0ad5b53a896762e535e72

SHA256
5fe18aaa9a7e1e919e1c343f66f7c80033814f1b8e581f7e131928316cbbc837

SHA512
d5480340c8fa7e698b7a18390efda1bb56414fac674cd453803c97ee1e6fbf0dee0127bdb09f842c70a595445ecd186d7ff406512c4b3b8354153b35c81db4bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a1ca810e379bcc83535bb2d50d01599

SHA1
a1e5d4be03b57e0dd6630b688ffe139b1647bed5

SHA256
95e0c07c2993ef18b3d033717160394e7b28a7d44a8fb5d14d8ea4547724a6ad

SHA512
c3d8ff69d871bfd070d983f1a8b2ed138153be5858bb284f0cf687dea67c96417c1ee2bace59fe4f0c8b717fbb1190d39da475443e2fb6ef1bec322105361214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b671f9cb70bad432bf2b0d0712f49851

SHA1
abad0a3af94976b7cbe67b02e851803545784a0d

SHA256
4d0b28edea92fcf4f926b382efe0c9e45703a7c69fb8b4f12b97ed2790004c3f

SHA512
4fe8e777de820d41a678ef19341c565bb1270c733d1955f70d662f82f81c16fc0071f1bdc1a8df095e77fb740c575453638540020f0c27b72fa232895fd5827a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d12642a748b92cd44953d723081b50a

SHA1
7119ade2b79ec73f94106992b3f3890442143f26

SHA256
e37aad0ea8e7155b7d4c0c40fb16cfe89ee20d848d289880d6ffbb902e9ab814

SHA512
a30e7c42fbe191613d1f145e2c78831569383a6698391ba3a3baa5046206e8e3326352d259dfe5178c262e2db404207f477d76bf838573a42c8b20be9f04fe0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
889553dd939e256284cc0b162c07c969

SHA1
a8e2f2cb9956008301b1e5443ddededaf7b1029d

SHA256
89cf70b0b664d0a26464cdbd0e847b9679b52ec6210f8d5320466b996d5308d3

SHA512
6bac73c61e140471a6a5717e750d28223878e76d3938f2189a7da528694eaaf7e126aad3c20fed9786f9b73fe69eeca10bdd2e2cb4683472d8d97af56fdd6045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbea433b064968ac85ed5181314b2ce6

SHA1
28e03095c4e96fb7d4ef6a0f53d992b81c5f5b49

SHA256
a487c6a2822c591dd6961738133e0ed8bd1244fb40028f204940a9ffa75e913f

SHA512
ea0af7a89ef416f53f57cbff8bcc13039bead33fd0f27990bf5ec0b167320d82203fd219840e9738682b3be01570ff7c2b80d5f108dc069453c1c2988002b052

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3870.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38E3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit