d27b0402dab339c8ac6d28412c57663760e88225f881384944cb227450367d84

Analysis

max time kernel
133s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69534a7d2a5db1b7e75dda87d3fc098a_JaffaCakes118.html
Size

23KB
MD5

69534a7d2a5db1b7e75dda87d3fc098a
SHA1

45c08a50e14ed4a09a380d704e30044c5345351f
SHA256

d27b0402dab339c8ac6d28412c57663760e88225f881384944cb227450367d84
SHA512

581b7747a98525e16ead6d1f6b1752a4edbc560de8dab85cbe4580ec6ec0a12800b115c24e21239e5e18f359b3364e102a28deff5835acdc8a4b402974fa8b8a
SSDEEP

192:uwaKOHkkYsvvgb5nxjGS2uvlqn1qPzonQjxn5Q/PsnQieTzNncj3nQOkEntduQTE:vQ/XG0pt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1004ae89b2acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422590408"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2663D51-18A5-11EF-99B2-4A4123AE786E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e2f8f04ca9d57971796c75fb7c59f3fd0d55897021fe27c4af302a5f3da664d0000000000e8000000002000020000000ea35e63cc8bbe12cb0a6a2a1ab5c6f9e2abe03d0810373f3fa43d44ad4259b83900000004c2ebe1af0443fae92cc91837254260bcd73473af42e6840ee139c29a734d216693f50aaa9a64d98528b865152fde22f8e8cc43d87a1a2d47755fe65447ba6ffef13f6445ec44d725633c593f2a8b010eeaada0da568fdac3a1407f9245d9000a1cb33311d8cf242115bdcda62d66286a883c144b50ee66f66cab430a6fc0fdb8579d65c3a173d1f3745d899b43db1e740000000ab592578366185d232cd7ca5fb10e25ad1086ef40189c23502562a2f45b32808045027863df1928855032f25cd05abf9851287ddd5af6d798fc8ed93540c3ccb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000078bbb49f04fe559dd592bf36117b167a543c3deb4dc0f6f4beeec2ea1639938d000000000e80000000020000200000006845a96ad2c220f411d8c6653cb683f22876f035d18252eba86e6c796d7f75332000000081fa0ca7026036a29c70de32da978649acbb8a80aa36494769030968a5c73446400000009e0b1a0f69f53f98bee06c76d345bb643472848591d5f64458336953fad0b01a8bbc7d853e4f8a8a7cd6c0d31944bbaecff1dfb25c5d74f9de6b4006546fa642	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1992 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1992 iexplore.exe
1992 iexplore.exe
1276 IEXPLORE.EXE
1276 IEXPLORE.EXE
1276 IEXPLORE.EXE
1276 IEXPLORE.EXE

pid	process
1992	iexplore.exe

pid	process
1992	iexplore.exe
1992	iexplore.exe
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1992 wrote to memory of 1276	1992	iexplore.exe	IEXPLORE.EXE
PID 1992 wrote to memory of 1276	1992	iexplore.exe	IEXPLORE.EXE
PID 1992 wrote to memory of 1276	1992	iexplore.exe	IEXPLORE.EXE
PID 1992 wrote to memory of 1276	1992	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69534a7d2a5db1b7e75dda87d3fc098a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1276

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b05e6650b23f8620a4697524fe64840e

SHA1
8890f900fd134230369e9195067ba955bd09ec05

SHA256
94e75e1aef2c891c9ceceb384e56aef02221b066df4a788e5eea4faabc3eda12

SHA512
4b7b8946b58cc3d417660d27559ebd6cfe4da032810fcee8c74db2110322d34dbd0d3c0b4c76354edfbac86258f0b5afb21d48a939e48df77fceb1fd3a309b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
20a7fca09826a5b813a0232d1e1bdadc

SHA1
b0a0309c2d360631ecc196ad76ccd003cd2bb6c2

SHA256
fe5a63905212f70808a3970ab6f8f0d85b778db4ed1155f8c338177adab6dda1

SHA512
63689e231eb352b1d479ea2fdf88fc5ef74c067ab09e2807c4c7eee12abf43153b458602fe138e8946345fbd1badbfa0d7f43178b51c15fdb3b7977503b1ef4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
876c65188f531c08479105f68d8a248c

SHA1
b8ab97f019f3eaa8becac4a26c402449b4af768d

SHA256
0b7e81aca4d5312414878022acfdbbcdc8ece8fd556c2f8cb01c09d628514d72

SHA512
4b050a5e49ebad2bf21889cd1fae2d9f00a3c0ee129fe3fe374c75a745e8fd6d790b8e2cdcfc8ec46d25118e1dac57ceee01c4aed802176e2f070389bb261095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f617e6a8e684f3bd0b556b74d04508b1

SHA1
8da8be18943c2b2873fc027e759c61b54642223b

SHA256
21d117ebbda0101f854540295647f4dfdb1b79bb990a871d465eb99eed405df6

SHA512
dfd4a0b35d0eb8d94ab5cd1fe055f98afe9b1c14cf6c3ce460b073e695fe7e83da772dba051001492433b6f34ece01a2be2170da2ee9f61e7d4a4d2a75a14a23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8445afb429268e346dc106302dfd3037

SHA1
2f78dfd6660057acb13f4c1e4917fe52023e130b

SHA256
12fd89a558230ea81113db7c61d41475e58f519830de2bc656ce3b80f6d7e1dc

SHA512
093b50036319530a0f0223e7928ab6bab76155fdd260513b2c438e74d547f50df202f3720ca4e8032e73eacb20cdc455178664d8efc8014fdce10ed0ba27fa16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
65250c5a9804c6126ad6b908c600572f

SHA1
95119348b35a77aeda227ef18dac9424c25b6016

SHA256
985d791af54d7b3f8e8a85f227824bd3dc2e5d05b18b4ce8d7affb2888854bd4

SHA512
6fe40f66cbbf576c33ccbdfb1a2d5154583c39b18e29abb6aaee0a7b050441ec9166fdbc667fe3cbadbe13e0cdb868355fc6793dd8eb5856aa8f7f84aaeef3c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
10cc4ebf14a2c759c6a172551a2edeb2

SHA1
59c6cb4376e653b7bdf9c53ec154850f8f496d04

SHA256
04cc298efa95b7eebbc237357b1591eecf909383fe4c694c3fba279a326be0f5

SHA512
9e312093e3b77c33653fab6be9229cab2f2ef921423b54b1a035db3f359be8551f3a90da8ea2e088ddd3cc597081beb1a24632cc4640bd4fb87760502dfa171f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bfa2cdd8e2c847d71b7c819ec1db070f

SHA1
029253da03b795ced5fd2613ab639245a0e9a1ba

SHA256
82e4e0c8208ff6fdc77ee3a3a1b94160e5f2f818ddb6af61bdeb047a0febd519

SHA512
0931e753b21cda01525eb4ed0ac536784226b1e473e3fc08c4723d38dd9f6960dfa07fbf46568a259efc0f4f1c7a5c7c617c61f0e8e05244fd6ae4cd9276ba3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f1374c170beadc83c9f72b01ac2d1920

SHA1
baa7edff44d7f8ab528923fc7d64ff5ee443abbc

SHA256
28bfb52591e5f0ba16dcd10f1749d4314cdc66af3fdc0d41354c1fb7e271ca02

SHA512
e06880ea0ede9aa705e593d3827d9c03da86a238756509aaa7f97d6dceccc47cfb97bcad6c534ffee549cd43bab192376ff29ad807fa5a8c5ec1a250815aec37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
21c4d8de1c5c8f2381548e5a0a1b99b2

SHA1
d22dbf19f7b3528f12a79cb604bfced431fa5c86

SHA256
73be06bbae2695499b11080c7c1426e352dd7e0453222d8a05b3901bb25fa23d

SHA512
a7c4c4c6e506d77e634129e5c8552745cfbcd3d4b07e2f4a8e3a1edcaf2665e9c9474b3e2c7f9e5865f4646f65964ac0a6ce698890bf0e55dcf4ea100d3ba4c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0e5040729a313ee4a61ab9e7a18ce08a

SHA1
00508d5cfe9e0d851aefc76675e47b03a66bb892

SHA256
585eff93a03aa36880d1976ef320907a56de54ed54a2815b049c223b1bc60a3c

SHA512
3b3bf35888878de345f9e596a47de1c402c91e93e36d38c87857571c152e6e618fda767848b18c0d8a09cc94069e898747ae5a1a93ed080f30880a08cf62c108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
746188655400d84a1d784c27e15b3fd6

SHA1
02e47c256574d8be3c6b4a500f5ca5c02135a0f2

SHA256
8998a6115d597f05b74f2b395973d778e244884973158f916480caa637646e52

SHA512
16cf0c227a50f0785103757d2f90be132275b2bac51dcea54e5a1d362d8e32d9cd0a72744abb2b8b1f952244ca59df400de79f66529d89817b37b64cc754e83f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
71a3f411c9c515e7d7d2b3f9ed861677

SHA1
ad8d36d253941bf7bfe00b2cafb18d77033c3a1d

SHA256
90064802af6ccee6c90fc113c58ad79a42c826698747e402161367cf793d3d8e

SHA512
ddae658e802660dec7ea1d659ec2173ac1bc99f78853286b0cbad476520ea7770b66ea414450d7d40203e0d37672753c10d270621c5283e10d6b511dcaa855a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1113d70d88f5f7fbced74b9ac3fdbb25

SHA1
393347091bb91aab4be8444a6206e2a809f65024

SHA256
e7d3d8d1e1350e24d7d966c5f8844b174633dd669faec9b0e4d8672f37fc567e

SHA512
7f2a78241623a8a466a5535fb34e78706f4d2d5698a7c9202c9393a2299cf8ca5f756e801ed2b703e51264ca5237cb3652f96eefe6f60310a131ff12db0cd42b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4750.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4762.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit