64d20d1ba3e6611dd2c67e697158ccfd16052173b3d263fa20caf0ab54bb5cfd

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6929a1d83f811171b5908a2ce936525a_JaffaCakes118.html
Size

19KB
MD5

6929a1d83f811171b5908a2ce936525a
SHA1

0066bfee49e85f8cf5795519e82a889372e9df8a
SHA256

64d20d1ba3e6611dd2c67e697158ccfd16052173b3d263fa20caf0ab54bb5cfd
SHA512

18e934150e662d6703c79f227146e2656a7cfa0ca93fba4d1386ff67a6dcfa717d6c313c68bd5023c1db7c38b0d2682c1e488947c7beeccbdc8e42ab1b6458e9
SSDEEP

384:PhDVQSL2Cta1y6knj5qPQDftqRn4W1fNijrEOH55aQoreWUd6H0nQStyQ9g+svcu:Ph2nCta1y625qCfo1fNijdH55aQojUd4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30487b2fa9acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58156281-189C-11EF-A9A6-4658C477BD5D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000084339edf62141b63d7c89c1693775a2a6ceb67585f007e50884c88ea7c9ec31a000000000e8000000002000020000000cb71520c7a21221cb5b25005ee0ce6bd8ede69e958a50203cc4eba0e5c2fc3052000000084bf48d1122cf3b4164a37dae5682095694a6c4c5597874ae4046a420f3f5ddb4000000042226cb1fce1f38d54c5c601fd99a3adb4a8efb5af8520247648271d73e3054d3d41564f4f18a8f89bbe6457c27fc6c6d953d411ebed94476043830742d32446	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007c16b96c83db16826f14502d1ec5fd82f79dca91a4b1e6abf24e1f557d6e174a000000000e80000000020000200000003b921d85b00f7a1a1b10c2e24f47d84043870da2c76802eb0965312143d5cd8c90000000f8763f08290541345689735c180dd9411d010956f26424a8e624cc7b5c17dd3f781a4dfa40d5204cc791f3b00eeb2a333a270697d632dfb9b8f2adc356c990765417facfae3499676bbfbc43e33286caa3f49733b329591d951ece16b930c42ea8a3d3079b7fe1865e23f0434a22e4b06c4ea2d7cbd13bdd807ed5c1bf58f9987d9f3e22ddb41085b0b0062c7a6d5da1400000006e43a742f4817eb23882fe5035227a6f74594b28e2bd536da850903575494bcf208a289a2cc6341c826eaa625e69de7c0bb347fc7e981b7fb1edbbbfdff0dbf4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422586395"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1728 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1728 iexplore.exe
1728 iexplore.exe
2064 IEXPLORE.EXE
2064 IEXPLORE.EXE
2064 IEXPLORE.EXE
2064 IEXPLORE.EXE

pid	process
1728	iexplore.exe

pid	process
1728	iexplore.exe
1728	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1728 wrote to memory of 2064	1728	iexplore.exe	IEXPLORE.EXE
PID 1728 wrote to memory of 2064	1728	iexplore.exe	IEXPLORE.EXE
PID 1728 wrote to memory of 2064	1728	iexplore.exe	IEXPLORE.EXE
PID 1728 wrote to memory of 2064	1728	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6929a1d83f811171b5908a2ce936525a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
72c3db729e9ade41e4a8fdd5e300c39e

SHA1
4090a044671604ddbdd614b85cfd3b4fa71772e7

SHA256
cdfd779f5fda1fac03156ddce1e53fc7322937a9b9dbd0a0978bcee6f66b10a3

SHA512
9da8a20d586135d5093ab9c3d5f4a0f154ea9394d92cd74bb8f90277bad1ebbacc3bd77aa3380923b2e84456bc94ff67cbfef2217180f759c281d2c66dcad95c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b12acba0225f776bca6c07b9ce4b3cee

SHA1
322c02ad40f13727318473c52d9e2b016bf9fe8f

SHA256
1330b7d4b465178630b9bb062937a6315fd819035cd69db2af6c3ebc0cf3b44b

SHA512
e56237de3068380cda2f6717330efa938cf736f09fd3b5b47ac5ba83e4abfa853a797842aa7f0d331ce644a1a2c0268d80e5a05b7d9797cc8516d79aa60f924d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4b8a33935f07885dd208c39e7cb558ac

SHA1
633fad5c3a896f7d6f09b8ecc386092b38f36a0b

SHA256
299c94800ea42a0f3e62d0b739014f673f887d8f02265024e542320adba901d9

SHA512
2590a2201ef276aa381b68beb53f3be144263438a621040d98b0f019550156b7e1b77e09f896770112723ec8b7712aebbf2276fd140c7bcee2638a096e958a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
460553eb6a7aaf4a9c33c6b9d0526df8

SHA1
8c3c44584b6bc79483f49f451b45db6485c1c54a

SHA256
2c2c6fd9182ef9566005370d41f3b55a4021a2a92b5e5add6a3effe627315382

SHA512
261b8036c0ee1198fb30a36fb74783879540f611e7ab75c4f50b8985e26e15c9db261837ca3376fcd052a51edc2ac7bcb147b883726e21f96e1059342e1e06b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4540faab074b16be0f87e909beb366a7

SHA1
bc3aeffbf1a5fddc0fa6f862b70995ee382586ab

SHA256
5d3c9c475c9e706f572a67e2dc4bf738c9645c3841a26776da8a15a5fa9f145b

SHA512
bce317059c61e1ff1d5d007dc6a5839d2f49e7a8426588f7478a32ae41eaf4fb082da53e80d91d08a37d29da2013e5c583c7597d7991862311952eae318ee42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ac1e99a09cbc2027b618210a709046b9

SHA1
caa4996be124b1d03cb932aacdd10ff1dce85989

SHA256
201a083141d4b200d69f21223f0f1d203252093f5f03f15c3d0a777e3942dab2

SHA512
f96adb79a6d6166a5be3077fcc7c833c89202f28703331de8bc8f5b0ac5a965f2587fb6c85cec60669c74f09129ee8f9da8fd0b236f5064f76626402974b3769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7e660c199cb32cc2a9d519fec1626541

SHA1
d5cc3c41ec6e9a19f341061dcdcaa804da474818

SHA256
d812b6aa5276ab55cefb577f3e2389abb6d91312ead0cbae61c45a7b8193da68

SHA512
3f01b844ac2f1814530b6ec8eaf960ea305f6f25495de5b8d23eb72ea339c170f9e3377367d8db081d02a34af587070f360bb52bc1ef3b7d13aa9ce0445188b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9baf096b964c285c140379e6d7af4f13

SHA1
62ea288affebe0f109ced73c78b8f7cba43a0fc9

SHA256
246658777c908110eeb24d0fc46277462337a3821c7329676ce6b6e60a3e2608

SHA512
25d4588b7b2a196c698a90e6e1deb93c54fc4ed3c2ff133b21bbb05b2f46fdf6883e514598dc2a1c661947c1d28d0266edfa7f7f9cfdd2dc80cf112bbf2c854c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a7cc1bb46b89891d21056c3b1acc92c1

SHA1
482a5a9698fa3c03a0bbf3f4af8636a89b084a13

SHA256
67dc148a4236bfe85d86f6845996341eaef970ba62b083a728e3fea412b1f115

SHA512
6c699c76c82ea32a327dc2666e9e4cd5ae898032ada9ef5aa55c26637c8b584b1d9a41f75183b0e1852242a88243ebdd0cdb39c4752b4bc51620e5b56c221dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
01fafa7692cb4d1d4fbaa139251fdf60

SHA1
68896f24b2ce4b85df0bfe4294efa3cabe63618a

SHA256
3edba87311f7df331eaee0fb5ae3148e2030f532bee8af5b041b29d346767f42

SHA512
864f6276c804e8661d3372d8a61796154da711cafa2c5d80c68f0b94dd6a176700ecbfa45c05e26d31876bcf81ee649d664f3618c3a24f5f8d239f34ff048b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d0a5a5dd2a63f1731c138ec202f70c08

SHA1
2415fc58593426e2f1bf73c4138b980d9b2146d6

SHA256
5da91487f206ee0de3836b561a97500f181e6933ba9a491125b0801d563871f5

SHA512
7d4761f440ee42bc9d7c58e7b4dad34fbe7655bacb8637775ac940e4e3bac0c431c7ed433bbdd805b233a741bfe556862c548b38b753659672aa39687e2020b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cab48bf030f9f92d2ec10963629b2f32

SHA1
f7ff17fb0dc5020fe4bdad4c1dfb71660c236bd2

SHA256
e40a786d2c3c67d7d755f71725d915999f98301a23ab3e912fa11e4547e3b711

SHA512
d35c075b18aa931871dd39de1273bf46c5c3baca747be3f7c6dfb93aeefb8c40076ad10a13e3dac19f83569490c9601422ceef8b58231f10753424f26f7511d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0d0c4aa26d54d7ae4b1c99fd32d546af

SHA1
2051e11b63a25c0a77f9fd773a9e0e3708a45082

SHA256
a2596955df25dfb4d5e58586923630cd37b9a8ad30e81d65d3b8ca24ff37bee5

SHA512
4d8efba7d37e90e8dbdf5819120a316a0ff43274843f27e9189a58196e86e994b3877c53f0b51fa2e3d3054114d0096d4b18b8d23a47f6c189cc20d033cce03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5daa67d8052f50560ce169e80eb67395

SHA1
4b31e6403e2fbfecf3d61b86fc1ec2514fe07804

SHA256
24400c8d1f5c979c94287d69faf5864acc60a26b9abad8f8c8dd46ecf93d0c00

SHA512
ea8773ebf5caa7be35a310cdaa3e31e518c2c627aead7c6bd4267a6a5d36cc2543e187a97bc287a0a5280ad437266c5e224dec02d4bc0799caa079f7b178fc3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49A1.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A01.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit