696f1e44e86abef1b3ed5fe16967bc6de8669993d9223bfbda9e746c8f4dd3d2

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69233302a9b94f05747b1886d70b5fc3_JaffaCakes118.html
Size

32KB
MD5

69233302a9b94f05747b1886d70b5fc3
SHA1

68b97c1dad00b8be5d84340535dd04734cee52d7
SHA256

696f1e44e86abef1b3ed5fe16967bc6de8669993d9223bfbda9e746c8f4dd3d2
SHA512

69506bdc923f4ba34a5c7fe56b0b2c2985afe634fd32c317efde2ab5b2b0ca487f26f7e2205f7a42fd3d133323380ac463dac4571ed758dc347dc1b7427429e9
SSDEEP

192:uW79b5njHnQjxn5Q/inQiehNnXnQOkEnt+gnQTbnVnQ0MC/AIbLU/IfyINcsitOp:YQ/WxHLuxVP2ZIAlkSOc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005e67d521b4eb1ba264545c5055dc99ad903ab08e0c90675f7c562578a7348bab000000000e80000000020000200000001dda94b795ed6a2102b2dedbdb9ab3d1de9d0d118d1524ccf7bbe24ac5a309e620000000609e15cae71b4e13805f1f019a470801339109847f9fe97e79e0f6fcd1c27ae1400000009652f5b26a0ffaffaca70cccf6c1d72e5a165866ae2a1e74379b0e13835564019369a5b455f6d0ddfa8224c5cde656f27118c5326456a5c9f142f020d7ec16d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585876"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07eaaf8a7acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23F87651-189B-11EF-A04B-4EB079F7C2BA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000016a99dfc650b00f2779a35562d7e82e59c6fbe3955cff105a48229aa53bc8d27000000000e8000000002000020000000de9105b57f9150215de381198d351a4ea808dd2f9afcbd149f0e85ad74b6032b90000000e8f2f8641a9897dd1f89db9a3d096bdaaded6a44bbd0318a43e62cd3fd9ee626c501c6a3ba19fed2d9acab78c8188cfede07f7ebdd5dd854a8aa9ab47d052c14e723460b4374dbeea61d6fe469e0b43b1e57a5274e6c229d6f9837326d0050e651ba37f11cbebec5e6bc501958364339647146d68674530f229e07bda6093c875ae2d7eeecd6a9da00d30979a2ffa555400000008dc280b5ccc9bf130e81f541c7d96f4e1cfade030bf2cb09f44ca4c45b331571e75c34bef0f434f5f9aeeed9faf3aeacb46ec33799821e5bbba5c42b017dcb2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1988 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1988 iexplore.exe
1988 iexplore.exe
2600 IEXPLORE.EXE
2600 IEXPLORE.EXE
2600 IEXPLORE.EXE
2600 IEXPLORE.EXE

pid	process
1988	iexplore.exe

pid	process
1988	iexplore.exe
1988	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1988 wrote to memory of 2600	1988	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 2600	1988	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 2600	1988	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 2600	1988	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69233302a9b94f05747b1886d70b5fc3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
39f921a180ab444f229cb6d81a6234f7

SHA1
ce7bcb8fe22474d2272a5ecfc1306fedfc796c32

SHA256
9057c568ca2c6a9096d2215ca1df0c8102501bc4b46368ac3da6893577d06e67

SHA512
01a6aad259b0e9b0cb13fb2f84d73233ebd052e747b6dbe37be52a3d316361db99e94a9e45bfbc59517c17c3691c76a0ddfd7c5ce5f7fc3777cce7a22bcf5e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3b6371628fe454d0e270674d9ea323da

SHA1
bab979f19e2e391a3ff63952d475edb804128165

SHA256
de2a1516272ac48de68a428d4148e9036afe709a418e66f17da6b482e6e3197a

SHA512
79fb770827189520dfb4ac45c54b0b3a4f0ef1314daf140ef26d0ec526e4fde34e3c5c3b7e6ef54bfb620faff378cc8250ee31a10749fc4db3bc806426603cfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ddcda012120d9fa2441ed0146667125e

SHA1
5d48ebcd6149070f28cc3d730f6b21b22bd539f6

SHA256
d12067383496e7cd0f33600147f846cfe29e17ed857237a50eff61c05e645150

SHA512
a80f3af421c90ecee934eff9a67c8ac125e80b3828e4c2f6c2d0672844c42ba8d171c48235f0667bcf68ebd07a6872947724cf2d2afd50a703c50c195f5d6087

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6b0403f7f0d21e42c67b115a0f6f6115

SHA1
4282635b787b4ae16f7724e4e9e6517743c770b7

SHA256
3c6131dc30536000a2c06459d8393e5480394c4e85f077aacd75df99fcf87882

SHA512
8083d091f095fa9ce3760cd08809d1e1d2d846d6db91c4325d8a98b6218bfd0317e691be3289e56b434ccf13cb01c8e52c82ca8fcf043b8b3d586d829af51097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a9cc85a993ea1949cc3b579e4797c328

SHA1
d7e06959401ed2168dddfb68569ffba34f741ed5

SHA256
1502aa6dd6a5b26815d5fd1f6025dbb6c602afefcfcebd086bc2ded9bde2ead9

SHA512
409d69e78372d8a2e774b59a084bb2c25515732895b7db59a564ba2a6da0291dde6b985b4823688dc0ff64bb65aa94c9839868e1400d5002196ae1d886006dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
eee9e36f68c2d828ff8666d97bbb9908

SHA1
8e424febccf00d6704ae45205839e46742bc3bf2

SHA256
b2dd98ceab8da6940dd2e976420d7faf0ddaec370b0f70cb2b1a65fca52930ac

SHA512
ff137dfd864ce7ef063819d5d2f221468ae123fd50ac1faa3911464cf2347969e820de6f840159f265bf267e6f7c9456ca03bc23374d5800a2965ee90314c7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
022114b2cd615b14166d598e47de1df1

SHA1
a6bd06c5ee2e6da06a9bbd591a8f214275d1a5d9

SHA256
def35d1186c87bf73ca46064f68482f4e7c0f5543e01e1e351e9d1c8822d0693

SHA512
76abe51e2a364a56b816fb2d5b5c869ee24707ba7b3cb69171e59a1d89441864c801714a6c10bf2fbca524bb00cbb3606caa9207e614658fb3e8304153e0a7ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6230ab6cfa1bb23f7a4b0af0b5207bef

SHA1
5d81344145aac72694553af81fb5ed20fca801ea

SHA256
269a96490c16f9d399f8e09c6b1289f321d1de1cdfa4a235b5cc1a76c40ed008

SHA512
6f40b63c6356c5bc2c9165055de958bddb69908a3bf9e2aacd4de33081da607a4435bfbb9de5b23d95243a520c1b2112df9c80e00259c3835fea9cddc6de24ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5418b84bce509f5aad8009e33a75deb4

SHA1
d597be5aec09bedd9e45517d0777ffe170434155

SHA256
95fc2ec982978776addab7091b5ecae35200c423604a3d08f9bfa832a6dc0607

SHA512
b63eec6054aaac8c30a2233fa255e1757c9ef9ba2c8e93873d39b1c721012f737a842fab72212efcb7f68d8fa4f38bb377f78f8246d7c22c830754b033781daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
697065f5055a6b8f8860b011df7f02df

SHA1
b253642d63fde4b7e58b9723b5d91dab3d25d1fb

SHA256
3b9b46b43b9dcdd7fd58eb50b36f7fdf9d1e1ffe3f3ad3c0a7abcd504b9c4b92

SHA512
2641358a67c91c609257614c1dff0b44a399016cf1d7a9cb6cf1fa227b68bbef6dc45534a27116aa37937ef09fea9a54731823770345d0e702fbc44ee0ca06d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e7b67335403f66cbc6465aafbbd91304

SHA1
12abdb18740de99524637d6c56291237c9839819

SHA256
0c47e6a7891bf627898decfd17c2187d6e44b171b108208f34555092d35a312b

SHA512
7d25edb00f809071e16a192ade9e2d0c9f03a27e0a55e7fdced576d7347f426dbd44126f4b6ee2d744c7e753873bf9b3b0a5cc7586853e5d98a4d676d193891e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ef2b01d3a6759d6e8a8e96effc507c59

SHA1
e1e9c3d1d40e1a0d7515bb530f23cc212e454595

SHA256
542354587c7f6303cd70309b34e738fb922f3a75b38346cd756058bd7fc4813b

SHA512
565e767cafe0c05a9615eee45af5d982fe392554611643d49f5186a2d5c95a22c2b0e8f4188139d371e8f84dead6eeb11cfb22b8c017552a66ab55c37b8b8ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1e298aa90bdae03637d1a8f5b386a1c8

SHA1
12979e2bd4f6320e522bd1bf3795316a9fa510df

SHA256
d7060ce5ff759f457bf6d6acb975758bb30cef75115da079ea22892dfd4a4385

SHA512
3265282f7cc2b0bb6fdb2c3aedaed2b7e6ab79f1ddd767da46d5dfcf3b0140f8e5c415d7e0fa4e756ee20c904c2675a3efa1765567c3664e2aacb4f44b3d92de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E90.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EF3.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit