fadb1e0ccccdf7267d17c04ea7b4ea2159b48bf5bd48696c0901989fc2fdba7d

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692c396c75930fe10889cf0c0d96c65e_JaffaCakes118.html
Size

68KB
MD5

692c396c75930fe10889cf0c0d96c65e
SHA1

15300c60f535fce9ce1dd35902a0b4ff5a04a0b8
SHA256

fadb1e0ccccdf7267d17c04ea7b4ea2159b48bf5bd48696c0901989fc2fdba7d
SHA512

2541e0407c2bb78ea43476bb5757688fcb69f483a86b9f1f2e48f187b8057020c61aef2fa25dbfd178eb4f5e44b4676f1754d7bb6bc8926dff9660e8d47a6df1
SSDEEP

1536:JgM9Z9ixtNYxD9zTcNen0tbrga94hcuNnQC:JL9Z9ifNYx9zTcNUq4hcuZX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009bac860818a78be8b22f5a8da35d184e25b8f62721c5cc1fb50218900e749748000000000e800000000200002000000088b31639eda1efd1055a82a2134dfbc1daf72700b61d9f62735d1681afc0960420000000438016680098cc99dc188a0716b178f8e94dead96908544154fbdfc0c1c27adb40000000ea4e74d5bc9c9bc89da12d731739a7248812584e0f87e4f9c89f5b3f7aef619a571a3a4bd27cd6cd436e1c7ce4d529113feb865c4d9c36c59977335d0894cc36	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005dab28205545568a5fc06a2925267bde35f12cf9f4458a73ec7f48d2486c4342000000000e800000000200002000000052aaed6f94a34380f0573e65e0d416a6c84ce469103a597c0db795ec8f44a57f900000009830a9ab8b26127796547e8bd6590ef41321a136aca8721a3e19f81a7641ad27dd2c519e06687d463c7fd87b2d2b5a7f68a9d6cda7cd0ee722ae1c43071b38c70d50b46e022e0db4ca03f37e111d9afa31dcaa2a1f5f583ae179412c904ce1f38be8387a304cbed46c5548246cf0aedace2bf2b34a25df874d271197f7c3ccdee3569ae5e02629aef47587ab0944948740000000a1b3ab1b3bacfd08e884075c2df5d1de690b69559513011ba36e24bb008277ed23baac237c64dbb0e4494aef82810340d5977626a410446c4fb37eb5cd44d708	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E98447E1-189C-11EF-AB01-4E87F544447C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402ef9bfa9acda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422586635"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2056 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2056 iexplore.exe
2056 iexplore.exe
2904 IEXPLORE.EXE
2904 IEXPLORE.EXE
2904 IEXPLORE.EXE
2904 IEXPLORE.EXE

pid	process
2056	iexplore.exe

pid	process
2056	iexplore.exe
2056	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2056 wrote to memory of 2904	2056	iexplore.exe	IEXPLORE.EXE
PID 2056 wrote to memory of 2904	2056	iexplore.exe	IEXPLORE.EXE
PID 2056 wrote to memory of 2904	2056	iexplore.exe	IEXPLORE.EXE
PID 2056 wrote to memory of 2904	2056	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\692c396c75930fe10889cf0c0d96c65e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b255b4e917abb5ee723dbec7894e84e6

SHA1
7ce5cca337909afd75e0c9dd38b3be66714dfdd0

SHA256
bc2dde231ee577183df4313c5c538f95a3e725fb850bffab7e7cb8b119f1d806

SHA512
1777f5c84172332319e11b1a7dc79a2ea1230112177f3e2aac4ae763ac28feed92e6c1e4dc946380ab0583d302070db0e85c2802eab0fbb5584068ded627f906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d17b385bca23e0988f9c4151f5258dc

SHA1
5a62b1f4b1b67d8458b7e4f4a82f34c6c7dc9063

SHA256
cc978628bd40a6c0a783afb47851c7d3ea68abc45c7c935ec1c3666c6da224b0

SHA512
7335c6fc9e978fc6bc6a622670d8fa530f4d110bf966b84cabb77cc10525e8a1e94b1017c7783d1376f4a5b11ad3f23206771c1a1af12c2e8adfb0fb240cefd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc81ecad20ea43f7c79cb9d3ce19d763

SHA1
99c38a7cc09575b7226f3ce144a829fc9ec8113e

SHA256
d5dae566d3ac547b286a7b4216786c8786a5e0ec9320579580c18c0fbb2b1735

SHA512
7c3f7837d34dd68604e9048c9fe92650f544982ea50ab9182cdf5c02ee9e96ef5e17008ea336c1aab82df1d5b913cdf60f3385e530515ba09398671bd335e49d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e1a9053a6cce73853c3326ec75074f5

SHA1
9e992b9bdeb32eddbd3caabf4f365e283c03d399

SHA256
1f470785374a4a1296c464fb2a7886d632654212a97ff778376ed2d2ba90b1e7

SHA512
6418b9704b551a9fcd2ed5f9bb8a4f21eabd16dd7aa339508c2dbcfb6dc7aebb190176acd9b244888c268c0bed03dc7376af87844d40cb212e06f48f9334c5db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6165ed94e2ea96baca05a8bea7519dae

SHA1
50c9920c9b1c399015c3e8c77e11f26f9c7891e2

SHA256
81e2900510d1bd1b79760f356c9dd97e16c18e6048bd79a80d960dad50c040cc

SHA512
c87ff68a00bdd5ec056d40a2163faf4c3ddb863357673cda90d126dd0d7c7067f433a972966e306d57a6a12ae155bdc2f871739216b6ac26b5de23180dd5e6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ec27c1bdcdefc45df6e7f2575833627

SHA1
ccb11238e7072af62fd9c83db6cb68357666504b

SHA256
2c1b9523990210d5deb7e8f3e6f9a4153b8c36b1d4e2b56fcfb578d1f3d6f642

SHA512
815476b874ab365f5b84b9205e8eddf11c5d3fd444c99c63c28d1a7399635464398a0bcf7f3726a03ff6ccedc5cd5498dc358dea346b0d1f54d505688b8a9d34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bb3f77550442f7746690631bf47817c

SHA1
8693d86999b9748cba1995852b819032c8b6f639

SHA256
0ee69d01add4b44b53026f090017e3f61dd638b8a521ed3d970a8573cbd68747

SHA512
dd4e631ba0f3ca80c2063c7ec7895a26a813e632dd47d76152ca6191b8c1fd3ae0c85ff074676a05efb103df6219f759fe5e5fc6e4cd894d9676d204a3534785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
549a96c7930f3f11e2cc0d455786ba40

SHA1
d259ef30962ead5df379a08cf452c100f6448cbf

SHA256
eb347f7896a93c95174665de681c77219f49b7cf9aecdf26761969187edb4cc0

SHA512
d504867be887f6fbd84bdc8d649e3e51561f12ea245753db2aba2b55375b078c45c521decbd0ace1cc074566452404199351fb86066494bf7d090558c2632092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5392c2147411b3ba4acd6790a66c25b

SHA1
8968e2d69afd882e9ade2c71bc9ca16b2a9f1380

SHA256
2311ecf4bd84c73d564940a8a8c21795f578ea041f213438aefc850d5d27b0c1

SHA512
8040413211e31f752f19989989d1152a2e6f386e80f0cdf08dd67dc17783cb2242d0cb649707456726e30c1afa1f6e10c30f19e256823dde097eeee4e85c82d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
759e0040e60ebf78a9a42266ef6567e9

SHA1
c025143e696e0e6912b18198cac847099761914c

SHA256
b97608147c8f04a63f687c404a631abe96f77ffff82bab5df8580f0624e3d57a

SHA512
ce2cea83c19297916b84b0c8e36af9c66ac82efce30fbdf67f19812338d4a4a7294fb810b0b5d04bedd822f18cb3e106cecfd83c288c4a4abc0fa6b04d859601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1516cdb0af73ef7751b70727db27ee09

SHA1
9b0da55fcb2dcf977b74b3d5f105950b72d87070

SHA256
2cac69d9dbf31c2c7e421cbf57715fe2e5bec19fac97c3760bc93f6a61e676b4

SHA512
28349f4747fa1c4097120a15adcf915e86413bca50f2a501911a12b70cb881f77edee52293d16809483ee4eae19452aca394cc94aafaa5156954dd49597ab269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7be773c64c9869e9b34bc5845d589587

SHA1
2e3974dca78d8d091e9bc07bd1ca16ea72ea7c7f

SHA256
8d988d68b81eaa4d4344fd8d0bde923ec1ba848ee90cc4c54c2afe8c66e1e7f1

SHA512
4c567fc0848db1f404982187b40d330c134c6aa43ec0b3e5b9b6eaab276f7f9f2c2e26289298854230d1162486720b8536247d18cabc2f7c9239d05537d2d15f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab45F9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4678.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit