676192cf794929c77a957430e37948c35a4d046672f60258fdd7c9b7f9865143

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6950138682fcdf5fe38b7b6416b43b17_JaffaCakes118.html
Size

16KB
MD5

6950138682fcdf5fe38b7b6416b43b17
SHA1

8838234d0be4c3e0a15b4c556366f9a0bf542986
SHA256

676192cf794929c77a957430e37948c35a4d046672f60258fdd7c9b7f9865143
SHA512

51e4e162be3144c9693423231bc4280e80f2f7b2edf78b8eca6adc81a21c6d65f0fdea05e63c1d8e39faf854ec9076f0de9d480dea87d29eea45fa8879430ce9
SSDEEP

192:CzzvMgBEOks1QTxE6av//X7/pTUJrENyKECNAZtvZqfZlpJZelZ//ZuxZusuZO8V:CzzEOkjHav/T/JUOyPC6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03c0acdb1acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422590100"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d9c12937a21d6f4d9acc0df449bd34d200000000020000000000106600000001000020000000ea45148566f85fe8582f2c5f6f006e70bbc45113bed14d37a7315c89a36fbfe6000000000e8000000002000020000000efa2dffeaee39f99b1b043577e966e8fab65f54a9e745376e638c0abfb7667f49000000083fb458af7465ca92e32606e6bdd5de854a71c0226e522e606912bcde8944c39b75d3fb649a900762a3336c62fe5687ee56d1349a6cb10db1f2cfd7b04fa1fcc292726595be381679e6d3a40589377f401dd3a3fa7fa94c205a75b7b0584a301b5b0ebe33377b04bce6d0200218e9ee93e1b78f59188e72caaac6b914083ee72fe51e6c1ee904bfde0f39247d8088ec9400000000ab2205f8c6862390fdaaae06ceee7f28f09aa546138c81a4e7aecb03684ec8b2f2304fbb66e565effaf29bf4647aea930bcc132475f545f8341fc4d3cd39ed4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5444D21-18A4-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d9c12937a21d6f4d9acc0df449bd34d200000000020000000000106600000001000020000000d224cba429acab6fb8693403cf62b3dc07eafebe84284589b21ffa4550f93009000000000e8000000002000020000000e5c51be812970a32822e69fc49363870f20d557d619b3877c63526dd84ad28de2000000058af9e722845749d0da5a62c4df1fe27010d8ac73af20ca05610adcfda9ef423400000001387b3aa468b1e7e72430d063a66d06ec7982426b589592e40d7910ed35f86c2ea29a19cece103b322c54aee7b94a21a39be101b57b41610b1b9153b8ba2cd2f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2872 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2872 iexplore.exe
2872 iexplore.exe
2564 IEXPLORE.EXE
2564 IEXPLORE.EXE
2564 IEXPLORE.EXE
2564 IEXPLORE.EXE

pid	process
2872	iexplore.exe

pid	process
2872	iexplore.exe
2872	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2872 wrote to memory of 2564	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2564	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2564	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2564	2872	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6950138682fcdf5fe38b7b6416b43b17_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6bec2b3252395437a2fee03a0e5f040

SHA1
2d277f20dca48b6c29365cd1f3dce97b6f063de6

SHA256
92f1ecd83deb11a97a7e4c9bd3dc9dd53f0d2cda582ced41ee9fa9d6822a7052

SHA512
0ba5e502233f1a0a8291a7fd94161adb39e124fb6139e117e2740ca5e5935b2978056a46dab5bc50b75970699cf50e2daebc3429f35066fbef0ac510d0ce653f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
429004fc101fe3360ced004eab7f681c

SHA1
8aee4451bac70b064dce821da27a2a22aa3f27cb

SHA256
d300d95f6c01b6f887122f9da1bccfe6e62de856d5b5dfaa9a35b715e2393499

SHA512
3e5b7fbffb3a21c2b54074b896355abb980f2200dcc837f16d580845a6903c0393966b01a6e0426d89d96cfaa25e2f03cf8909580c8f583250da532c67dba240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42a5fcc9487edba91f22498597d92890

SHA1
930484b0a78d60cd700e2129c959994b22e9bff1

SHA256
e3e28b5e16cf1e5bded4f00aabac2f42057a624a72625aeaf32baa68da143aca

SHA512
e9de113bf70ba36711511ef12b94010f3f243bcfedd155d9e572dc1f8c77815f85ba0b4ab0c68c6036545cab8f4f99c73cf2ded5762215b098fc329c8a19a00e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
393db680aac65f6c9bc85315c7b74b17

SHA1
7386da1ded55ce86dde3f17257d6788bcf80f1fa

SHA256
4cb42b6182edab3c1558af1403448121c8a608746275332791e6e4ab0875734a

SHA512
a6bd74baee22fb3220fa5260f21e9f9c84c2ab9b8242259b28680e97ab28565109136abce6fd9bcd4ad708e516d6510b2fec91406b18d42274b9b13e305d8b45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22c823e85d969e15d539bc3754d582d1

SHA1
2e5881daa5ea21ea87e293627dae90659492d638

SHA256
d8f035f071383db321a4a4792cab2845e1909bdb0f2d1fb0e548b0dbeaa0e87d

SHA512
4ca9fb0eeb55811752857e6997581b0febe4656625867ebc5dbcca83fc60d0121f7565a7fe6466e3586c4bcf5fbde45d13248b915ea6055b67e223ac08364aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52dbb20d4e051faf199bbbdea30330c4

SHA1
d08ac98324dd542ac02facf34329b95fc870de48

SHA256
a6e114a11d23c866ce7e9dff0aa9a913db1a37da4110a5f09ff923660d0dec6c

SHA512
b32fd6c9e0da984343522ec899ff060919150f312e5913dd088c7df1dc683ebdd3045f9f4fe1cc9a3b7b7ee61d4e95541846ec202a6e09eba36c60b8e9482cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
095cb472345b776d9aaf2738af3ea50a

SHA1
75b4c68066c1fb0ba68f00e5b2f69404f8efb77c

SHA256
68e9f4e7400dfa56d6bdfb74df07daa52196136f067fc0078f0a8076f614aedf

SHA512
86f83dcf1580e6cd950be443d5bc72d760eb50cd5448e4ab32b3b1469f9547bbb29507a117b24d7b72e615d41b2a032672f9b31850879582029f95b7b6dd47ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
402ca73cd2cc3c3d17e4de5fbd8cdfb7

SHA1
e761c9f055c87879e010403396a4625a43bb6580

SHA256
1c14d13c86e200c956ca8d4c85f181f909f2a9784645a43c5e06b56ede69d9d0

SHA512
591ca8c0c6c83f90bb39ecd1992793137936ae79e70cfca8e741a178f80cb0e47936352bdc8cf51de9d928ba5fee8beffc286784c6c9520ceda0464186972d29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e3fc81026ef8380ef17ff3b63114114

SHA1
5c84b720bac002d49e593d8d5f5f41667712abc4

SHA256
f9e497c54673ca3e81ba7cf392934898cc41a473690bd3449a0466e574ca96fd

SHA512
476ba2ed239edbe527851cd3335539fcb04973dedfc7f18cbf5109b0b4934e156c2b204147fae982fbac16431984294f7260996972249eeb8b2455ffd8d8d8fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69bfcef47dfbf9c9599380c34f84983c

SHA1
3fa268ab3eab5fef98ca7a4428cc007e1cb4e97e

SHA256
69a4e733ac5697697d3295eaeba661d280de52d05eaea05f895cfa842f05a129

SHA512
52033e45abb0bfa8401d8c6ce006c7f0a75a63fec724e8483bcaecf08e84a06de791afb831079a2b4d6a91eb41f4e8075b5a196a3d590bec235f43a25f180260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c32f7d0c14aa0cbd10332091abe55697

SHA1
4775868e66c84b6a8836f1f5f6d3914ce3a1939b

SHA256
81bd1fee98dba724bcffab8eb0e3aeb8d06b45f5b0a6f53c416915d19eb99a0f

SHA512
b6e3d068e2d2c4bdcc5cd15d56f861470d9e57bc2b6ea168a3366272d732d3146b3320ce18db720a316e8e5f7cf435f472856b9b63c96ae43cf1d2f3aee65814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4a221bce24e23936e3978e82bedef95

SHA1
83cf4ea3268148776e557af6cca3bd8a4b0f051d

SHA256
6fd1d4fd417e50f93ac4d6d86c5d72da5573ef950e8f99afd62c81f97673d4ab

SHA512
9e3ef5d7af2f2b44264f24ccd56dc77b4e4f34d1628822d8a75d3cd972c45061cc0994c0a3172f9edacd44ee97aa9e120ce56d3166e59aa51fff30e655356495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
437372d0de01930662f2b75fa2f5a630

SHA1
9ce40277d74a654130da3b1ad71a88aefd86c216

SHA256
afa8585074425b0b6e2849aef603b4f586261ba6efa8cf5905f0b5cbda1d28e4

SHA512
d036b5b314caaa46ae09e0d182f44d40b3fd4fb6262d260d6e7e1de0958600108e3f3e75d60a3fff23f8ec9031db6d6b7c396aed05d8f697c55e685bb5eeda61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20d241a313b9fe619263a8fa5b16c30c

SHA1
5ae9e15fff2369e72f168954afa327bd81868145

SHA256
b7297038ab3593f0d8f673a512d0e83539b1238f6fcb298c3dedfc28a07f14dc

SHA512
cf52a2abd8706e44d8a1997b28edf35000934957db6186beff7f8166f96176f36f4f4fd1e3f662162df6fa3728812cf7aa8f9e2d6a99f95b5699368e512a4d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD68.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBE79.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit