48d45f9d4c9401a3ec8c6fe40e2794d6de5e9684fbe7758a833e617684249ac9

Analysis

max time kernel
134s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69377f11459d2ca78144abbc6cdd8e4c_JaffaCakes118.html
Size

19KB
MD5

69377f11459d2ca78144abbc6cdd8e4c
SHA1

4a2b240e59f65d9243e59c767f29c2fb7cd5da80
SHA256

48d45f9d4c9401a3ec8c6fe40e2794d6de5e9684fbe7758a833e617684249ac9
SHA512

2c327f510020c208c828933ef7d2bcbe8e8650beb50712a80a48249c1421325588f252ad45132da0a4c2377370582a648691c3be1de0df0da4308797033bd0c7
SSDEEP

384:zi8KcRAa5r9DIimVBD8ceQ3R5npGYp0REmd5WScfIk9xheFzVc92:ziza5r9Dkgcx3HnpGYptmNOIk9edq2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000718de0dabecf9541aa2c04e2fd1b55570000000002000000000010660000000100002000000074126948af8a2da6dc58246e17d3e34d70352b722e7abfb0e1485ebad91d2b0c000000000e8000000002000020000000b5f23d6ba3e00ee5180176da05fe38e586296f027793c2e38b8250f7f3edd1aa90000000967366219276d46fe8d59b778ace0f3afb9bf514f62fa152b8e3a82228ba9ced9cd53be5ac1d17cd76db6a0e63f4b5b5741c7e4f9fd89bb9663a2656bc48a40a1c7e49d722b6ab03a590580a0574d488b60748a12aa67551cc3d28eef4da520e54410808791fec6f71f4514cfbbbd66dd9cb26bd15cd40f22d64f5895cd288ba5528a7ce3da37e1cc5d0f6678bd9d819400000003774901323086208afc169edf0e3f6e43357f1ba7c9d9c8ef7afb7540c1546608b68cd682649df6ab56dbae5e6f1da5a51a3b45628654d971be9cbf5bc111656	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102d1361acacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422587768"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000718de0dabecf9541aa2c04e2fd1b555700000000020000000000106600000001000020000000150c538ff74fa5a2c58adabb934d7b61a2acba201399da90cb69f87d23c47cc6000000000e80000000020000200000007fddb3cef903f90dc793e603f5d7cf5fe03b9452517a785ad78e709f88be17dc200000008f05367b8c8a4aa886d5a41b7e290f0e83cefd134de137023da44bc5834fe96e40000000c57c091ad19eb76eda5d4834b5a4cba289ec161669d6c8d78762b76408f4e7e206db6014b28d4d78e59f7f932579ec98237e2fecff3c8b5bf262266819f8e863	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C41A611-189F-11EF-8A74-66F723737CE2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2372 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2372 iexplore.exe
2372 iexplore.exe
2980 IEXPLORE.EXE
2980 IEXPLORE.EXE
2980 IEXPLORE.EXE
2980 IEXPLORE.EXE

pid	process
2372	iexplore.exe

pid	process
2372	iexplore.exe
2372	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2372 wrote to memory of 2980	2372	iexplore.exe	IEXPLORE.EXE
PID 2372 wrote to memory of 2980	2372	iexplore.exe	IEXPLORE.EXE
PID 2372 wrote to memory of 2980	2372	iexplore.exe	IEXPLORE.EXE
PID 2372 wrote to memory of 2980	2372	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69377f11459d2ca78144abbc6cdd8e4c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2980

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
1f68a59d855356b5abaf60e464568b5d

SHA1
9cd872930c33180c9755756cc72d050e07af46bd

SHA256
69b27ee2ef16f0ef87f8db70709a04c517edc5975a9614cb9ff15425e4808a30

SHA512
f42c99da216463e44c891fc138b9636a6c581070d0c0b3a735254a8b78beb4f649e7bc2b8c7fd0b3ac07026de325c8684a0d70313268a8d1fa7808961f18d248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
23c77c386591a0a43a3a30c73bcfa8d5

SHA1
da531e7a0b9976acba75f68b515add0c90dc292c

SHA256
d1bbafb5af4abe5adb89c4f7da4d3d546f4515fa150d27cb6d6c41f838e43aa0

SHA512
44f52090a3e9a2bd3e16b939e8ec3a00b4a72355f9aa14425f6e1a44417e576147e2e0ccc8b889d1d72ee329e29b9a4e19df4ead89845ba852324deac7cc4577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
d373e42985e9ebfeb668ddd5afcdbabf

SHA1
1d9cd2b9c3c993fa8e4554b5a8c24e4699793373

SHA256
16253c44916c79b97217cecda4a45c2dc566e74726b3ebc77efd04079c6c4e50

SHA512
2b623d20aed8d8419d58061e000a74b4f7bfa48097bb0dd6b3d0037046a8cf0a6a6d4ed1c2cb7889b51431100c11d3387e5a5c6930dc89b41ea554423af862ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
8a96ba387588a4603f16f2c54b8a000f

SHA1
81015d8335ade6aa527968393991a1228b5dfc37

SHA256
d42c4b8e066ff70b1aeb4addca112d40039fc8fa02c8278840375beba9d1dc02

SHA512
7f72905c635d35d2b2badf045aae4593bd8f146331de2773525c25c5e53df1f0a9a105a678fea2523c868bc540e96808a77c1532f24cfd41e44150a9af8a724f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
6c69f50701eeaf1170be46cc47196529

SHA1
3bd4f6a0d7e5a998c40ca31b5f7ff0ddd7c52f25

SHA256
1f4fae6ff35a8790c28b4df4c4651516b61438f8868da01b8a7b874d0fcd5b88

SHA512
855aeea25ff9a277b498340d48150968d8142252f928eccfc47ed6f7fa329f257c28b1f053ef272437a7f5816840f7eb562d44774d98094f1ddecb02a5578607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
dc9c05250556d7a62d9183164fca239b

SHA1
7772b634384957e488e8dc9c04f20a1f60f5f8a6

SHA256
4e313c74bb9287c101c31ef83c66b5ea2bbac3f179f0f4218d2e18ec8dcd72bb

SHA512
51aa612107b5294f3089c21866f8533e37d9476c54ce859ac4ea2e7bb3fc31e7efb1cca37e4a632d8bc2c7a8bdd101e3b450e36515f35b27d355b3d3721cf836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
eea0f4a1c64882e86fb0ff9496a84ac6

SHA1
485d8eccab19ad29f58fe90d9b4ca0dd9f880135

SHA256
4113099fec1fa10ac0a2ca73fe8e5b60a803938f4afc84e4fb46456a3b4d7d4c

SHA512
55206b53eb8c5eb860f3e06eb1e86cec9ff0f104ba50b92cc76d91a0748d8afa5272cda785d31634e586924284067fcdeca8993ea1a65e74696c112fc3caccf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
c97185a3887c2860216fd572c6f55dec

SHA1
4e4f67be8dda262df794ea8fd109e591ccc855b1

SHA256
fcb1cd0f80809ecd932e3d2a2d02351ecfd152d29bbce6e3d64e8f2d74e12b41

SHA512
9ddaaf4cbdc3a88edf0b0b3c7ecb734b45c7d1d2f3ed5f73616cf82d5ffcc15e00d983f4a649d130b810f01b9c7fd9c7099c3b66342498a3cefd76e09e794c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
8692d993eeeaf7fef4224e6d498ba375

SHA1
8f9ec0afb7c86dfb6ff8b83eb5ee54a0f26fac94

SHA256
2f82bf8f5578ec7a0603afb37accd0bd4f0917a28a41522f186d383c18ce5439

SHA512
eb78f02c0764ad8858fb1f0e53d2144a1952640ea5add30df0968ee620af2ae54450a63f939a239c516367caae212827dfc372695916caccc058af151c239d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
29f753e1701c2bbf36cd06e36a2cff47

SHA1
aa8c5e6e98b03f1fd831ae7a2c95958eef287480

SHA256
6526479bb35a612ec301780bc1c0b11589c7d0f76158d62b6b098ac2d5fe47b5

SHA512
6d037ae81eedcba0c0c27a1a4d989c66c875418ac32899b3b77ff9b1663f2c9ab8eb13c3261f1d9cce956b037f9b6b96e58274dd0506983c8b1298360152fc1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
5ea67b4218d43586220121aad8371b6c

SHA1
a3301cbc8eb11dccc891f62112bff4027b8bb99f

SHA256
03c175eee05df366380fb1efc197edb0e542e10609a5fb7ed465abf45b58f638

SHA512
cc681a62ebaebfb4535d73ce06bd0e4fef13353c618d9b5e00c13de1d443efe54906d2fe91b8391db6d259c92f82d20454e14fb5cf34b8ee7411e66af38dc911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BE0.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit