a18e2b49b265b0fd9aedbafca6800d41f47c3fa50884afffcfdb60b874a32db5

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69593eb20c58bef9278e4e54ecdd3b04_JaffaCakes118.html
Size

16KB
MD5

69593eb20c58bef9278e4e54ecdd3b04
SHA1

9efcc20195ba9debc0901feb605525a8c01bc930
SHA256

a18e2b49b265b0fd9aedbafca6800d41f47c3fa50884afffcfdb60b874a32db5
SHA512

009ce37a6bd4ff42396044c0a5f55f32a94e664f2e11df5cc2c25074c1fc443246c8812363438c3c7624c609ad92e006e15741197f5cb50c8f2567ddc23887ed
SSDEEP

384:N/EjFK3JRil8RNi/pHKE2vhN0/exo5pf6Ei1e:CK3JRil8RNepHKd026ViI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f1cef5c9339b4e7925344e04b8e6ea50048b48151fbc50f1cda671982f170b66000000000e8000000002000020000000bd5c80d69b15d809745c057d96b30937bfd72022aa9c88d856dbc6125e50dccc90000000b1f0204666b8b7eddfe2283885f8708a469f293ad928f70960fbd638fafe582060d126a1ecd3cbb75cfc62e37b4594380db8f1208748aeb509147cff7e2dfa03c5034dad1f75de1a5c673e422ac38369989c567a1e48ab959a5cd4091e3eb7f4b973c3ef319531dc0f87c34a6e595faf7bbba87c76e6788917a4e75c980077a9075b08607cde8cc19e025ccf1f3ed19640000000e8ebe1f9b23202ac0b33cad687fb39acf927e874c22b4a47e7fec7771919930ee1cd632bbd23f3fecee8ccc63db89f282d1eefee599845b73f2264e73b10dec7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422590948"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3A0C461-18A6-11EF-A0CE-F6A29408B575} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b1ac296e3d8725f34f3feff813065d4ad580e9ba9479f088436a9169d82d1d81000000000e800000000200002000000044557d760beebca19eef80ce6e0ae55759599ee26e3cd5d15b55c56f02b1c7fa20000000e7dd8a9ffdc27e887a9ee6ff04895ed9d477123a39bb30372954925e22e3dcce40000000f2a6b4fb859312e0bf43f0257bd6e0db1055c0077fe6f01f606e91b37af4d4c02a097eb25be0f98c312b7801f48e90c8cb23a559e040ed96e2d7acd6571bef4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e7f0cab3acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2944 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2944 iexplore.exe
2944 iexplore.exe
2824 IEXPLORE.EXE
2824 IEXPLORE.EXE
2824 IEXPLORE.EXE
2824 IEXPLORE.EXE

pid	process
2944	iexplore.exe

pid	process
2944	iexplore.exe
2944	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2944 wrote to memory of 2824	2944	iexplore.exe	IEXPLORE.EXE
PID 2944 wrote to memory of 2824	2944	iexplore.exe	IEXPLORE.EXE
PID 2944 wrote to memory of 2824	2944	iexplore.exe	IEXPLORE.EXE
PID 2944 wrote to memory of 2824	2944	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69593eb20c58bef9278e4e54ecdd3b04_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ec9456ae806a169290b81b51965fb38

SHA1
bde1a556afeea8cce3be7d7994648c4a7a42f211

SHA256
e169d10975aaa37c46b9f3b5d1fe68c345ad5f1c116810775c980fd66cddf7bc

SHA512
0047067ba6d564fce42d27eb700d4b6e2c222efa2a631e4064e45ccd1372e279328c2f00b6bd5c3a804d5ab75fc1e2b0df8e0ecde6018256398396e50cc99544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a54134a05db7a8a27df18e2717a25414

SHA1
1d877eaf61e1e714ab80f968c4c3fd837d42f250

SHA256
66289c70103acd707eab0b4d8cdb0e2bb72b98178a26968b9163ead9b63678e7

SHA512
0085270ae884e801685833f066446597c9064c136df3a55cfe8c2da48b3723639f913c18c91092582bb0117deb8edc766049c92187a5d0608fc076f5acde8690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31ef9fa8c2dc8cd77444c9d70d49768c

SHA1
f6428b665b3600f396c5476d927ce75481ea0d5c

SHA256
ca4dbb36988c74317c1bdbb1909a7452d71eb1706e70a076ad50e769ff24e55e

SHA512
c6a06ce8f978bc3167da124ff07e1e05712f660c9a8dc6d2143265214a74b622b1bdd5f6fe7d64e1cf25e3f9ac06f867a62b2712a458bd2a6508e64a1b9ced56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d169616d8b7bab2e643ad29a44117595

SHA1
3be7ade33fe03b2e218425fd49b4710da8a51fe0

SHA256
f4df3f7b3ed42daa661b2dfe8f43ec3b0619e3f0f7efc2e1768b3c4656c4d3ef

SHA512
efb61924c7d691ca3d7d3e84754fec755ae9c9509719179f4682518fb844698d0e13a346a9ffe61a13c9cdad63af3997b66fb218ea172ee6017ad1c16f577ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf50a03c6bbd709d1b87a35c5ae067a

SHA1
621e24b636a344f732b7e7294e93c4b4714fe387

SHA256
de6afd536b3cea65a719d2f983c8b05b4473e4df37c39c24644af3ab4fcca86b

SHA512
25e30380531cf7d604c788ca6d58ffa9947235656715607745db7e8e64c15f1406fafbce155b0261a235243d44ef3ab973f0d10ebf309f11e49eb77b43c3780b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7954e3e1068a3fff9ffce7ef4adabf5

SHA1
3516f0bc336117d5337f0d1489b082b89e014f95

SHA256
67f36990d6bc2ea944e8be8b523131cc73be6063eb05764e82cc01981354e54a

SHA512
54d001f778a175c0f26a06b86a11b0b560fa22a2d29e51e196632b1f3f0b54bbb6249271f39c6f8aafb483eaf817e8d1a4f6efafa9adec99af034d1006a613b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f91525ba589623eb3c4234918f68c5ca

SHA1
3c17dadea34a97cb84b01b201a88dd77c4a55c9b

SHA256
69312054298937c0fc682b106fd6ebb5699872e2580c64babbad6204549e1fd2

SHA512
1e027d782ac34d367a6e54c54272d8ab1212f4a6eb25f93218af77259f9b6f46bee93483677bd131fdc88e5c7b2b37e269778ca6559ad7aaec06679cdde0b267

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ca7327111bb1b64f820768bd535733b

SHA1
a789897c84629bd244ab44edbfbfa4a69dc3c83a

SHA256
96d83d5d9ea6d390f586140691a8a94ddee05f178a65a5b8b899ac67876504d4

SHA512
eea7040582a005294bce4f3f513be2914780b2de6b72e950d311dee39246de4433f1bed916125a0723b07b3c9807eabedac99a4edb14248e14ed5ef0f5c03e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
481b70fdf8d30b87b6e5979b71eced62

SHA1
4a2619c61fd4f5d98a5a6648d96630a4e03a3a07

SHA256
3dbada3cd522e0ff6fe91e7cadd5fa51a5aac6a76c7303006cf170ba846b7076

SHA512
b24fbc2ee5f2b95b2fdee92e4e4731f851b569a7906c53db2f1c8376130fd29f8699f13c3b7fbec1360f66a5f2a23d77f99655330a5c66733a8ef41afe2e097f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00c5239e2ffebfa5f889c9c206b37784

SHA1
5e6a5591e11443430b86b343ab3048a176622a91

SHA256
6ff6c2993a4025d7744852333c762ad7e5f7b5513e1e5bb6a37ca570aa1b9584

SHA512
5ed055c80048a9cac418df0ebaa058fba6bf1bb7cb2094ba1a8ba08c09bc64dde1827c07f99f1efda33122e60a0f493d64c374e0a1b80ecf9d8d6ad41319d820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
390e14e07107c2b66dd67a597dfa5f5c

SHA1
138923857c43c7e21eb0d45a0f13df1bb6cfe257

SHA256
9919b5a2d5ef9918c612400473501e8e1b465ce6664160feca89f8aa7248f8dc

SHA512
36c34db91fd3ece4495dd94a07338df3794e23b3296df88a8e0b18bf63d8dcdff12299640a4702285de2b8e04c60f64547cb52729fa6ec7bc37773546b4c4a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6c7c56d87a86db1d57fd2dc34fe483f

SHA1
9046693910719ef981fe1b5e65d665df02de327a

SHA256
6972b0b23d718f696ed188288da092fcb6072c4652b9fd87b9b519367926b554

SHA512
65d7091a2c05dd6793b6dec25285c70d7b730c40de7e1d3d8d43287f06cee7265121c3936bd8c017aee4cd932494d219dfd1304d7f5c90034e78759e751f8720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93f2e51cd25d8e2e26837489ced25e2d

SHA1
fcc95bbcf4eb4c156695e7d486e4cee8c09f9e43

SHA256
a9310de94286847bd9da77a12bbabf0669dd0a96cd333dbb5610abe6aadd936c

SHA512
eec0e06a4d680b0636b11c7e9ce8c15a325f3d9c381b487abd0359e44658a09522693c17854fbab290451f68efaf0c00f675dad394cedf4cc746ca86153012ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d59763a5bee26ec907b232b9da4cd83

SHA1
b102070b3268af22fd92e6933544ef19f4ebfa07

SHA256
733da9dea6556d8d3645c4418f70ed1d306f92b959a3c2f518dbcb9449791ff4

SHA512
b9993708abd16c1169fcc7d65bb1e75dc911312acd894aa9519c29998d36c27a45ce68af8030d2dfd0b19fa5c1fcf6ccf6458c741991379160e374ee8dd30d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c84a5dea738b19b50b29d0a3556318

SHA1
5352352c1c3de30e93b6a32d5f466096c0c81661

SHA256
67c9b3a7e3026c20a08f0697cbdd2deb4025cd65db6f5b8f34e04835cc7ac14d

SHA512
22c3bf05b9b87d8d383321f3feaf6407d646eda88a784541cdba72296b539a19179a13dc0e2ec61dc5d16dbee018a8757b82b8b0009f720a65037ba556640883

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4423.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4485.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit