97d96bc46b1072483c05075f0da717ef83e07ad5743f7639df43cfbf7b68a562

Analysis

max time kernel
139s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6925d6a8433709bf6c6a3d15b6ae24f1_JaffaCakes118.html
Size

68KB
MD5

6925d6a8433709bf6c6a3d15b6ae24f1
SHA1

df95bc1051f33659cc1067435db40aeca968ee52
SHA256

97d96bc46b1072483c05075f0da717ef83e07ad5743f7639df43cfbf7b68a562
SHA512

f3f6a1ed3a008fd77c11567c4604acaca61a995c03611e540be2fdc8557f90e66b206b64e45a4eea6dbfe1d4254e00a51180d035d1b50e91d803e7729ee80d5b
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6F/phTIZpNIAmoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcc:J7STKN/3TcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000080f15749007303449935969168918aaa000000000200000000001066000000010000200000009b015e05579c0de8d47b524b543a0c8c83fdfebbd688153fd85a2d8c803b9548000000000e800000000200002000000003f3fb286b491937f664a2b2da8514533d0a37b23aa296577469a59eb8bb216c20000000bb81504b6687e36488b2858c597970a099a116f37e30500d95ab63087ad2c24340000000f99c8db9fdba8036023bfae35c8b7eeb836b00212b05c4b2b9434fad3416c798d9e177f171574d1593cce70138d097d89177521d55fe3ea31148726991b95bef	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000080f15749007303449935969168918aaa0000000002000000000010660000000100002000000086325a3055fa7d1443c4858aab19c74a3da1ca1da07243c90317a66039e1304f000000000e80000000020000200000005901557d7cf35973b8714d58d4d8cb6bc5755e8d7c3249fab8376156a0cdd0389000000067849983f613306c3222cabdd18720d50d6e36dc4e79fa91a20a9d6a7de28712e8dbb43d57580864bbaad591713f69bc34598aa26035e12dc8eaaa0e9350e7412b001bf30efda065fadfb10ac660030f8cc380ec830dfca50c32db408dbbca99a52ab5a108d567bd91f9feb4a7081f0e207894f742fff8e0eb92ae8d24ad5cb0238f401c317b6a6c641647285697ab4a40000000a190ce66c07ad1292d8c4bf94b346b17bbd04562265174023a2f56071f1c9bd9da1a68cfd85f156f725437a6dd4fb6de5eb3b02dab4990146a2a3101d9c5f286	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A53E9411-189B-11EF-97AC-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422586096"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7031e079a8acda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

856 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

856 iexplore.exe
856 iexplore.exe
3052 IEXPLORE.EXE
3052 IEXPLORE.EXE
3052 IEXPLORE.EXE
3052 IEXPLORE.EXE

pid	process
856	iexplore.exe

pid	process
856	iexplore.exe
856	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 856 wrote to memory of 3052	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 3052	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 3052	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 3052	856	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6925d6a8433709bf6c6a3d15b6ae24f1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81706b5c6a2eceba553958c5e5081d17

SHA1
de632531af22a0b473e71cbbdb2deed222b3a2a5

SHA256
79c3aca8950a6dc6248560ee74774dc7090375bfdc4e253aa243b5aeecf054db

SHA512
14730f02f3271126bdef892992dfe9ead83f2bb9af12486fd4a50af81fdb015c9d983ce81e3abd144a82189e10414a2124c6d1de58cb4704af21ef553ea2479f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
046fe808818b140c19739dd006695c09

SHA1
92186717743d771bb08888c5d1e46b714889d704

SHA256
9b1a0bf0b3e8d10609f65724925c64dc2d0cda9373c643a19e260cd98106c8ef

SHA512
097ab52482aba8b02a905d344fb13b89fdcd7892d6ac56322345b5f169b4ec53995f62d85f83010e12735f487d6ffedfd145b44ace44f69dd07b0fc772097a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c2a86b8d71b1e9d9f3b3a3bb9073f7a

SHA1
16eb515956924bd2c541da52a91079ff3e79dea3

SHA256
a3c5c273143349290b6f8f49830412f6081e547914aaabf518f47311d695ce83

SHA512
dddddc3769371ffde92a5177895b13d5b6e6c68a87d325c1d443607e1dd1ea645a22cb0669a18e1758e1079f5172ad8d5873f6e7cbbc6eb719f30cd134d34a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d716b3c7b9d05cceb1046c49074d9009

SHA1
54404070850b2eb38a10f4793850298416100668

SHA256
171d5951af8b91ebdfdf980968f78894c1a633bcf5b874cf3db9e2fe98d2430f

SHA512
525d2d0712fead80ce99df46abbb807d7230b9dae41934678a82659a6057ca903c98d18fdeacae95c4fe93d7f911f20784f28d0b196da79f58f35a97097aca7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43f00acafe2ca1687033c6166ab274e7

SHA1
a96cd465bbe92c4df41ab17a7873f0dca13f6721

SHA256
c169e6ceeda83bfa7148042b9fb77ee56f9fbba64d26f3bdd8b9f869206d89ad

SHA512
fa6bc1c7734e81499dcb63095fad87a3b29eae8bd5bf7b41cc6128d04676da06241b290972b6e6bf044dcb948ed1fb0e9e29e260d8aaeb4c295347c03789ecad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82c136cccd01bd625d9c54b8c3a5f873

SHA1
dce9a136e292e5ba56b2f96ef885f07f0e13c2c2

SHA256
f60fb9d2c075add86c3745066d37095ffc591fac97f53301436b0f62ead0dbd1

SHA512
2f8551544fd05617fe101ea6816b19719d831f2593d4d05937dd8736bf20d29c39fe9a7cc06e96c221dd629c4dd2a03b26070ead7acaece252949978218d381b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9060b9c5b957c41d6d3793fc6a5e90f7

SHA1
0cc6da4ebaff506b96c89d4c413a7a68926353c0

SHA256
b8883d44cded3775a19c964dd433ea772c9e4801f644a9e5644680ff4e363a56

SHA512
5a059dc0115b7f775c22e3145d5c1cf6d6ad8f05a871ba01ebdfb96f5adfd4954b3302d2d89fdb0e35a82240c76cd566fcdfbbf92797873788409811ad590465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc352126801c0485a6992fb567db91b

SHA1
ffd6ced3a00af26df9061d2617e8dc5c627601e0

SHA256
501757c201cf7a3ca39ebd294262b9c946dd83b87ff595d85e5a55168b522ac7

SHA512
6e752ca04515352c3292d96039b399c02456440e0ec51696d6e1fa12d11e150bcec350a5d0891f9696ba40e888cd2e530ad96b0c2d1020e8e32f9179e210e5f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e864b24a98dd6f730b5ddaba432299a

SHA1
40fdf4cec61ae2e6562f2896abb728abf9a77191

SHA256
70ebe8f1bc4b22989d53c77a10751f5c16a12e7490916ff621ec0560184f9df6

SHA512
e9ada64639a4938047c6834bd9a2e73eb1930fe97dd3852b730999704f32f79689d79e35967ec602b58283b139522d81413f6127a77915b1056e1208c7bcf406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ade3e9d3486a4449cbf7a779fc86164e

SHA1
cae28fe266830bdc2b0d2ea485e4bb144e555f05

SHA256
039ad119fdf456bdccc88f0c4f654519ac983b0af6cef9be8c1befa4d6505c15

SHA512
ce3abbe06fe36dc5292c735b1c105b5be7916539a9c3aedc10b280cd9caede443ad93bd6327a5bf67bd3100b2e0f4ed539280d83785aa9846f7f1ffaef7574be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d15999b89e62dda65bd7b4c56b82e233

SHA1
c9c4a8c16138518d40184816e1d9179cae9bf17f

SHA256
38a59bf35251238cbdd7040d261f43b502e1e58ca852c2033c6693de8b304429

SHA512
10722c6f764593d5e6ec7c80249e51888bebe77eb0b393488c51d93491740a72d7f2563a0da0331aa73ee0474db4c7db9971ddca9f82b0b721e920786191f1ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e748fdbba395e476035bedf19933325

SHA1
2d0d626bee441bb61c5c15d5826f1b9b73e2eed2

SHA256
de7e3552b6df4fb58a898ea53d83ac8f034543a4a5899b71ae2016fd5ab25ced

SHA512
862ae57d942813256ee4c5c5256ab4deb23451c855efdd59953e072395158a6355d38cc3044b3cf7e5096f098f370f255a41ad7d618a8cc826d42ed9954e9ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1975dde3158af68d79c9222bbb3393f1

SHA1
d91a4779ba37149d2a414bf80417ef28c0ee01a1

SHA256
bc1ae3a1fb5d592c9ef27039779df413e11ff33657c69d0da639fbe7aae2dd6e

SHA512
7d20cefab946536e9ff304ad61d9718e2c6451087a281a2bf9f75d6d05cd52726a0951392c6cf00877ee303dd50b4ae42ca3f6bb77ec6c227a8433ee175625b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A94.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit