baf5c263d6e7a3155427ab5b704fbf70bd80719293165bd35667c37a8b1e0108

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6955ce75d96c3c9b564f3d56a28a3f9e_JaffaCakes118.html
Size

1KB
MD5

6955ce75d96c3c9b564f3d56a28a3f9e
SHA1

292f95966e63ea72c55f965190f4f98fc883bb25
SHA256

baf5c263d6e7a3155427ab5b704fbf70bd80719293165bd35667c37a8b1e0108
SHA512

d7f69a1199eabcd072b7f3f6adb09f903dd3c638dd1c0b93bb6c5274f933ddeb12fdcc53894800f5ef590b2ce3baac46d761e271dd142da01c698e5eda1bf0e4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000052a2c1ab427fe245ab5714466049f83800000000020000000000106600000001000020000000b9a10c56016804bf2bb6f57936a9238bfe5476f906667dbbb239026325d79051000000000e80000000020000200000006c4da87cf46c4842767e36e23eebaabe3a1003b031fe241fa164820323779e069000000012bce8b679f6e43fa5b1a3db9af8cef2adef64f1f1ac351eeba53cca48b1674be0f1550633ef67220b3a33e823d69984a5c494e6bac434156325f898caaff0d42cc9ddeb987c1570e115906ce738040d6a5e05a86eed38fc66ba41edd739fb3852911db8493035b7bb5948ac45d8fcb678e0e015aeac8ac1930103acdd5aaadf3d7846271be04cdbd386f5803947466140000000a6460e16995327fe144185362bbfd507a69c4e825d28bba2abd786b13ff7aa3ec461183d1c5c0a5af07428b1af34ee1b7ee3db4887c3bab5b9b91a39c2f964b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d056fa0bb3acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422590636"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3752AE91-18A6-11EF-9680-DA96D1126947} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000052a2c1ab427fe245ab5714466049f8380000000002000000000010660000000100002000000099f3d92609b818b6e9efee7b65e7dd169a63db52468d645f5bd102e605bfb055000000000e80000000020000200000008a4103fae8ce132ebf768e76176b3196354861132871714f97842268157b9b7a200000009de6172ea8b30d3cd16f7636a6869565ab6bc4599cab0dc524cef41ed06c42c940000000563a2ecbad9a0c3ec09d7b63dee70ee1303c8ece668b60af50af836db69129448911a36128478239c7679287a6e850504998183a8844d5d5dde0a20f50a231d1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2872 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2872 iexplore.exe
2872 iexplore.exe
2556 IEXPLORE.EXE
2556 IEXPLORE.EXE
2556 IEXPLORE.EXE
2556 IEXPLORE.EXE

pid	process
2872	iexplore.exe

pid	process
2872	iexplore.exe
2872	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2872 wrote to memory of 2556	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2556	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2556	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2556	2872	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6955ce75d96c3c9b564f3d56a28a3f9e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06444c402946008db9c9ffb01ef1e684

SHA1
68ffe89dce7bab752cb7026e1255be936569a42e

SHA256
06be3f4bc3fe9244c30db5a635c37b88af35c991b8b584be3f817624fd67c91e

SHA512
14dc7f45132ed0ce5e9aa7648f8665b1a56c267320de2f5c68cbfb26d55ae472fc88e0eeec002ebc877f0829e764e51e53f32a5c075d930dc5808ef9ea68d9e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba54371e3ec435f20315e51a41f486d9

SHA1
3092579f8d8b2e40929a2f1d69e6c6a864f76a4b

SHA256
2fc0ed4c83f063f37003ea06c4c3f140209b38bab20d0b5d6d96479a0cbef19c

SHA512
21667b9112e99741ec398f366316324a123d6320137eae639ce3c0902e892aa3e0d4d5ae2359b0af740d3888ff462825b6216d6ae7e718fa1e1315fb563c0c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0b90cb9aa96600225ce7a2d9dcea25c

SHA1
0ee7cc46d2e046c8fd2689b60c0f8fa91b6603d9

SHA256
c776a10e6958c82bf910f6d4b82c766b5369514298d4c7820c72cd0b78d48849

SHA512
5ec32715f36f51bb708f5fb252ca70a8a894bb6252f30ba4e21a079185af0f4b7d66c9893848ad9cf2d67212fa2588b98dc46c9f1bf103f70f333c73ae257487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a5afc61c36a96c6dea56c32982725b5

SHA1
033efb1db1726960fbe4d248b983d8f8af097145

SHA256
93cc024e7678e0b9d885473a2354488a77493f7e0005ad52ef61e820018e4e6a

SHA512
b517efdd04854c3630370fee4f369c9caa8bc63c94e9cb86be2b939eead0faddaccb358121d8b4b613c83eb371c822e449ce757360f34bf6a379e6401214a56d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c3c2f053a42b2986852909a4129c0c5

SHA1
7c81edeb0a31610ffefa8cfe69a4d2ca809a3244

SHA256
3f8bc9337cbacafb1ea1b1f389a116c0085e3052777b48dd51a684e6cb62a706

SHA512
4b451b291df368a245b9156222d6f2676e71c04478ec74c4d5b589bf3445f7a6c1a419fa57b228cf0ef3341a62717e0c12d1e86de7252d8fd14ebe43db027f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e8dff15baa4d77ad96d2e9db3680639

SHA1
cd77d35308e432d096ab7682ae68fa07f509bec7

SHA256
ec087c51e6abd7dace3a37440435bc734eb437f67719c844d24c374f819cd041

SHA512
b76d1e96143aa2e4ad3b1bef1cc001e4b49ee8c3a2e6efcc4382b685037f6b36d9017837aa5933ef968665853d897ce8c172b91d08e5293168447c88564855d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
952cbd10a80d2123b73997f5780d4c28

SHA1
ac46f11ee83959929f3a67cdd1007695bda9db63

SHA256
01960c9aa2652b74e76434ceb60184e6189f5ea0cf6f287c957f4b847b28ed99

SHA512
f4759689112dbe636a4534c99167edc6114cc56e42dab08afed843313120524a5e91310ea895f66a4648dd230bfbcaaa8a721d492daa5eff673020a91a48d6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3eb6f3f5dea9ca1907908b8da579d9d9

SHA1
3a26c48d46bc47950a594620fe6e8f977ad817db

SHA256
e4b995e66f052b849dc18118e14e455c5f186b9e48d2c0e73086f1f1d5fb407a

SHA512
17b0b2a8ad6b4fe3de06ca6bc70d7df9ba2697c20f15539cae16f1bb392bd45b8b4520562fed24fe7e90a1cf342d555c442d10a2e6903dde79cff8f552ea0f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
851757173329edcd75aa9355127a9b61

SHA1
b4aac372e6a11135002d1386f1b6af8e64366bda

SHA256
e41ce87edfb73f212c04e1de91682675a4d411f924b24eb2398a843976ae613a

SHA512
e9aca08fa722b1a1d2550712f18f79d9c9e782dd2f239a35f4139b58ed544cdad21a2ce1fb07a29bbac41aba148f5b8e3732cd39332a85c43e1691e4b6cb3f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eee5e8e2fdbc539f11ffc77883d7bad1

SHA1
8aa0f84e298e5863b10f2f22213a04a7aa5f8c04

SHA256
25cb561e7016d51d38c853cc2990cc5edf367ce57777768a6b80c9f4211fc29e

SHA512
10a051c26e00cc198bff48f2423a2f332ef613c3d6b323b7ac6b3d439ed84f3c08bb881656ed8fe85cd9198277ed8ee9b9886cc00d1421f65b6bb5cd10578b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36a7afd2dbe5e10defd4e7c59073abf4

SHA1
39bee4df71d22eac72f6eb8bc295af95d634bf58

SHA256
75820d872e0245e470416f980cf011527b4f9a5c86a921081f1cbacf86806cab

SHA512
3def9145f8499d45f53208f22d3c3ad7dc03861d2ff4a8d33ef90c3fb6fc217659f3acfa9574c0183ed1b56d5d80b2b5d54010b83691b04d02495370c54be79e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
158e5c02a55effbc00b1fc96f07b13c8

SHA1
9bc058837c8222951be7c76c5dd19b8a4ad864c0

SHA256
6eda8a822c89b1c42085e4725442965ef6a9d07570c23ac39815540d0c20b6c4

SHA512
541297c13535b5347a25fb6d61498c8ad63e4d582515476601a3935c9fb65dd522e7670fc9702574db4feea0b1083a86a01bdda012e31c6c6dc33da4545b5506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f604f46a292d16287fd1c9df2553d331

SHA1
e0a6a5e15b4b5b1e8fce636bc374a5f687be27b1

SHA256
b027bea43aff78dade848f0ae06288379e0d96e463c6d64aa3abc00b0621b292

SHA512
501832f7cb7e6a66566cb396459a07638e6e7e5613e71695a11117a75ed4347c12b49dc4be9d942de173fe981e56f81331b03d00c41c5d0aa0ad11fdf31de282

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FCF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40B3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit