d76df1ff762eeb07eb5f52eef7c7e87579a27ef3dc19be1f1cce3d07ab2b9838

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692978a0d4c4e461ad24ee4f2cea1161_JaffaCakes118.html
Size

461KB
MD5

692978a0d4c4e461ad24ee4f2cea1161
SHA1

c81936eb8e41fa5017a176808c4907f462691d10
SHA256

d76df1ff762eeb07eb5f52eef7c7e87579a27ef3dc19be1f1cce3d07ab2b9838
SHA512

be502ebf884a5e0e758a3121ff8209eeefdd248c8a17dfb688e9ea81e9b395b76c5d476bfc8de85c11741611c01d11a629c8d7fc2ef67ba6fc8ab49eeed58340
SSDEEP

6144:SvsMYod+X3oI+YqsMYod+X3oI+YusMYod+X3oI+YLsMYod+X3oI+YQ:U5d+X3e5d+X325d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008104919e8ee1ea249d568c4ba3ef1c166c2c340034a9cd99fe7f1ad2899d605b000000000e800000000200002000000093ca5467d3420b1ff65455e7b210e85cf2ebacd6670afce1a83541a52ae728fd9000000059a590be3005bdcc85dc294e24529f59b70ebe4ead990b65870004c946045999e7b06973de89fc52c0804edf71a5df259f7109fae6e6dcc4e73f76373616379f6fce95bdb19314d569ead06787b52c12829f01ca61b7716ccb719287c6dc1f5a577fd0db51a7de4e04df4e25cac3ee3d0c60bcd45b96c95469c3cfa12bdb11f4a1462207d00f1d9244b9cbef9a34fb1e400000000ae27dfdb8c01176798d4004c9bc1eceda0e7dc2a485ac19f733f425e8aa6599cb713ee6d7124594476056ab4982c69af1b0a65e732249fd2ce2e4dfc13d5d9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F23A6A1-189C-11EF-A585-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422586378"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d9e3ebe45f737383989ab32d509f9d8695df8339d2ba662fe53600ffd7aca410000000000e80000000020000200000000257f3371cc04892c1bb3f64a0d6ec4187b77a4a234b177d0ccb1307113ab6672000000066de73008a646164712e3d3657a14ed197730e6c41119df431bfffd0b90603f2400000004bde0add5a459f86e94ce39e0cf2d62025b97a58e1380d336821a70e2523dcedcf9d9f0d6f778cae662e1c2690b7a9d5a1deb19b562ebcac2ba74bb0462bd606	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b5c527a9acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1964 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1964 iexplore.exe
1964 iexplore.exe
2572 IEXPLORE.EXE
2572 IEXPLORE.EXE
2572 IEXPLORE.EXE
2572 IEXPLORE.EXE

pid	process
1964	iexplore.exe

pid	process
1964	iexplore.exe
1964	iexplore.exe
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1964 wrote to memory of 2572	1964	iexplore.exe	IEXPLORE.EXE
PID 1964 wrote to memory of 2572	1964	iexplore.exe	IEXPLORE.EXE
PID 1964 wrote to memory of 2572	1964	iexplore.exe	IEXPLORE.EXE
PID 1964 wrote to memory of 2572	1964	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\692978a0d4c4e461ad24ee4f2cea1161_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fe008bbba6c8b1acaa3eeb7fb52d1f6

SHA1
dcaa8854032f489f521efc2d41ff20eff8041ee4

SHA256
fafe397ec5523541c32d8f8bdfd4462d4c2b218a8ed7bd8f035e54ddb04a915d

SHA512
3841347f0a0998d36272a85938ef3973506317c609544c9743292b811b313c70ba561110deffd068f5164f85eba978c65fe00c3c7f9269e5414416166ac110d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e49e47a2ae4243bcc5c7b115bb76b4d

SHA1
21de4aa3ed8122114893e69135f2966e77f3eb98

SHA256
7f7c47cafe731d2944caeb6bd8d4f24100a571be9047a7a2a9ca05ccf052cb40

SHA512
39507fcbc81b20ffc2a77a516e55d1f6116eadf852c283b986fd1c1fb73587d1ec8c22b401468649d27dda5f9a6d350a72dd837970887b17073a92fd8724638c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c4cea73da140c0e7e13203fbaf6574f

SHA1
8725a94d7c15c38c60b54e3320205dbcaab6ba5b

SHA256
41a5161a5a34d239b2ba132d1d7d7e5f5d922db9bc9d1968632478c1fec605a9

SHA512
74e64f55895ac469c8ca0808fb08126026d51882dd9c275589075535b4ca0c1de86c9396a25a84800d6fb579ea082c94e89b1e513abcd7da45abf75afd935414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8380b568fe07ae51e7603cdf7f2e124

SHA1
f98b7b863ba8bfe15889058dadbeca43ae73e0e6

SHA256
f2117f38a2aafeb3fcff078935cdf09a718dad192f7df11cab48e5d3943c4ea3

SHA512
2b5f5b61279b6f577c6c7586d7e7b4a4f1c3c9ce209e6783f1c0deaee9717259b23101074deb15bffb13c53733cba7300543103423c5ee60e834f9b497620cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c03bfdf8180f0b78ba409f35d97b1c00

SHA1
23123778aab6794f8171b2103e272962079cb53c

SHA256
67ee9e11644ad5437f0dffb24c8889edbee315cf5f679fedf0ba410dfc8b584d

SHA512
2c4aa501167cf73afde8677027bdab0d39c5fd47bf2ef80181019300f8f1b62e43112abb2578c59ad66fcc01de2285f3518f2d314d4e603ed20f070042ff9d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52578113726befe5a1d310e63c1dfd29

SHA1
e48879670ca2873ab9f6a16cd3fb5f2721f9f76b

SHA256
16f46c3bdd47e78f60f2951d98397c66f401754fe719b17d8686ff097de380ae

SHA512
a0ada26bff1efe25721b670ac7274aa45b460193c1119ce6a5fee15808a203e904902f36e0f3e2c868b3723e3827bcc2ebb28bbc409a7be36d50491f0cba2a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b954403bbf0057657c920168b9ef1a5

SHA1
3516bc537401bad3ea331c00b5d17d8286e0da86

SHA256
29b53373c7a9f72b0b9d55317a405f661e6ce3f4d792d10214e043b5c5f9fa96

SHA512
40a482d2703dde78e31ab64d4712d7c43f916ca3c480d6e8faa88ef189f8d46d5af345e1db213192dc678ef4c0752385a37932e401b6d881387da6b09163584e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a05cb599416b2f1d9edd0fae34f26b8d

SHA1
1c3d74aa619ad1cf9fa02454490f103b5b82775a

SHA256
67d6f02b06836527e00ec7c3292614fa6d19c5ec9b09f5326e26f81b426300ed

SHA512
85a7c4dba3591c7e508335d1576e0e808464dc1c54eb84d6e11df1f01bc9c6c0aa886735513267ce40ea5cb28f8c4ee06319db95218a17d97f6b7eeed9663bea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97f3e57265c5895e8f5d367602f66823

SHA1
dfc44585cef91e2f836c558a7a15f1129d4d80f2

SHA256
1f4ef8dcf7f71a3f780b6f5e41d788fa66ddaace2b8e6d57210c96c57a0d733f

SHA512
20924ddee0726142da09807bc657e9f843ff0ef302670f443556eae96fa1810b37041980b12097e474683eb57094f0377168207804cfba4c4be4dcc422f822ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13d982e23e6d19eb7a751eddfe096e2e

SHA1
19016186e45d39b014ed32c1b70208a57d1b4e12

SHA256
c8947f1391ae27422abda8c346ae00c76f554beb370183ab3180656c05859d63

SHA512
f5526f725fb0fd86290eefc28eb7dad21662e8bdb251610c49b9f5f7be86fe5093b9fcbced079b2ec52cd0f402b888e3771ad90dd2a8ff95d1d749017487dcd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd964cad233e54b8a4d71a95ed4557a5

SHA1
c57131d89724739459a15d81368ab32163816047

SHA256
8d4b2a8391e0f515765b4000c12e1032d8c4a9f790b28f17785cae2710d76036

SHA512
aa2edb43e1c8d35b15afca3f4b7a0144ee551dfe48e2e9f315525fa977f6b3597eedaf19e42094ba74a198dfe362b9987af270101fc8ebc6901e64b5b092a011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
633680cadc5cc94b7b4c925e2b8d6923

SHA1
b156a700531474fba212dbf1af5ed057178f348f

SHA256
a55029f7765efec654a7452315a18ebaf629d662f8f3b43bfa5d36d8d2472b73

SHA512
778f75eb4d93f9f52bae5393063785095d928542d0d63e71810961a41a7c63446c9a3cdba74e88bec3de2bbad4298c58bbba1dfa7292f45fc69e7fdeba539ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fa40c509ff02d391c3cf76fe27fb98c

SHA1
8d4f0c16f9f6586bb5f5e47932af979de6756b02

SHA256
db1c4a3d3b3e887701d9b62e28c9b4a424e2b1f52dd063202b0e2867f3724014

SHA512
3c0d1d435f303aaeaa80622ea32db8a0b1dc1a56251745d3bb739fcc4afeb2dcd0a6319d7571e88a49fa62f04f1251382df1120efa799a8416b60019cd48a0c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b3b0008a079a72bdacf7343f0662da

SHA1
1416034f42a1c1892ca94b4cb7e95fe4b4c8ad79

SHA256
84e7fde36ad3a6bedc6cf0c8340d49c8f294c3aedb152de216d6959c0e05a0eb

SHA512
77562639f83cd7fcfbcdeb65280e407367e131ac38b66f004a303b04803a40d0438992aef735720b5e7f498a1af665bca0ea051f2a712850c3eb5cf8dcf80328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5b9189da9f0b187611ba156ecfce822

SHA1
bb522f543ebcf2553bb1ad1fc29499a8f8d9b66c

SHA256
d14c0df3ec2f384cdb3dbf4a6e8ac6b71f9800a95efd1d8ffeede08ebfb92919

SHA512
eee07c21103051f821fdc3673c094083ca76091659458d43024dc9bec8042576ef803d901fc611310fe6b970e760a22173077a269663c077a793a810c1c8c110

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4138.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41A8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit