5645ddfc0e012666824664e0851868df2769dbf868bf9ca9b7a33ce8a1965d25

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693c6fc42c4111a1bdb6744bf6c67fab_JaffaCakes118.html
Size

133KB
MD5

693c6fc42c4111a1bdb6744bf6c67fab
SHA1

d0408cd731f67fdf3a07f83f485e1161081dc055
SHA256

5645ddfc0e012666824664e0851868df2769dbf868bf9ca9b7a33ce8a1965d25
SHA512

ff11edba5a02901db2f2d6a5499694010438f979bd15d75d160d597b40f34f5ea311bd5754d1adb690cf173b88eb55ef88d65d39118638707145ff1a42d4fed0
SSDEEP

1536:SV1EYQfQsPfIV+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SVP0yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422588235"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083343237efeb6b44b8bcecd1f35af2dd00000000020000000000106600000001000020000000e51dceeb61ad761f09470da04bb98bcf01243756e50f7454d3b839632866714f000000000e8000000002000020000000ba1b5871741d83e4c7b07ecbb8ac896c4de135a3b85bccb035ce789ed74e97899000000028dc853cd46a17066f26f238df811b8f8bd76babe25630eb805f48c8b8931e627478cfb66a0c09f24d760e21733b8c86812d53d63cd0c81c5c561646c267c06217bdbfbdf908c416a0d1547941fa178e7fa32d490c29d9e11c9b3cc0f025dc06befeec258796238a256adde557962df26a72cf6210e2fb1c5575a7983a9d014a60c9dbcd03d15808ab58fd44d804c233400000001a16054168f7d9c28288b53f1e6637d3d0e8c6029969dce12147cbe33976209f88afc200dd71b1c61f7ff2e544731f777e9f77b5ef207a45a1605a5f01625aa2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2A05041-18A0-11EF-A635-D2EFD46A7D0E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103b3977adacda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083343237efeb6b44b8bcecd1f35af2dd00000000020000000000106600000001000020000000fc314d201c795cba2f024f7765eae34841d9c688953ca2f62f37db681d8e4384000000000e8000000002000020000000704fbeef731b5ab96f0399d5ab310f39d700f35f5cbaf3ede2fa139331459954200000007c13ac1df8e647d2bc9458bb1be968d39571fa399d7fb218c10afc12d9c8727e400000009c17477117ba31528a67abbaf018dbbe2da9cf8cce64b9877cbcf42851cd20c984c6a47264438a86b1cce45f8e231419ab2c093b7ebd8f3c9d018d145f0b53f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2320 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2320 iexplore.exe
2320 iexplore.exe
2180 IEXPLORE.EXE
2180 IEXPLORE.EXE
2180 IEXPLORE.EXE
2180 IEXPLORE.EXE

pid	process
2320	iexplore.exe

pid	process
2320	iexplore.exe
2320	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2320 wrote to memory of 2180	2320	iexplore.exe	IEXPLORE.EXE
PID 2320 wrote to memory of 2180	2320	iexplore.exe	IEXPLORE.EXE
PID 2320 wrote to memory of 2180	2320	iexplore.exe	IEXPLORE.EXE
PID 2320 wrote to memory of 2180	2320	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\693c6fc42c4111a1bdb6744bf6c67fab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68c9fcad80b3925a59d997853e244782

SHA1
58df44ac45217782d8cb133c52aa3c63143c44a4

SHA256
ceab8e594b07fa4cb0ad4b508d9bdacca735ff2a2a1b1d9ffc3dab618e261d41

SHA512
f97cdc9fa1ac50a4f2e9399d604a048790e9eac7d7f6c9c604c7e0a2db414e45809415920b776eb74a955b02dd3f972bfdc59e532ef59a25efc6c31de55ff7b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
660c14196beed5e7ccf74a9322043a3d

SHA1
61d01f905ffe1de8a24230c9f08c3d8941d4188e

SHA256
7b2c5eaaade5e4011f9803062188df8b880b9cdb32e367da6a712083dca5882c

SHA512
3e7ad4a624d1c0d0c0cab8877dadcfa848275c15a664468aaebf4e030f095902416991b74014d8233d2132a72eda12da23981622095ca9fc873fd9e3be396f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b7ad6c299cce33e4b56e20fc961e8b1

SHA1
941e60f958b8a238832633472c12c2554181ebb0

SHA256
320594082a94d70448ee87ba5af371f03b859a39a2cc70174b91b46e6eff24f8

SHA512
b02743f806faa7be0e9b4bdc153f65327b29893c6440630755f2ad743f4b48994575159e12d2975bc45fa838e9e6880afb82d22d9e6f9a311944df3f6c78fd1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d494561bd5859ddc5457ba3083d6791

SHA1
228e5142c85d9f7d49d09421068d9a441e5f90fd

SHA256
fd419e64af1a642a2510cadfb392f4fe06d1bede8213b6a68dcefb1cb23978a7

SHA512
969d612ff01afa699833e6a35463bc2d36621c59e41727fe1ccf9df32691e002a1553c1030980993c6348e8e6f1ec2f1a5fc946f589331846bb893195f1a0211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efda46eea34b782ba2ffc0db55395bc4

SHA1
3143a41a4290db355471cac409dfbbabd93e8e31

SHA256
a770a24cb69bafd41f27daa803bbabca1d85ad3238cbbfa14c34bf52e48eefcd

SHA512
a0ad2336b38bb824b0c6c4a5bc288813b10969c7eb50dfee1d7fe48a6c99f65cb50a62f2a2c6072664f069a01da63279e40b0e12795905ab593d649a321f469e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7caad2ad48dac396d681bb4160b8b6ca

SHA1
0f0feec15cb46e7d798d7f31bb1f28f77f178e35

SHA256
1759d30e013d1a16aaf0a68c90aa07768f72a64345c3dc2202ca65f2b6bc3de3

SHA512
e496b0d98b762a9a32672ecdc108145758054074cd8b3d591e0a9b2f6df3a9d64773db0aaac2926b680a9cec860fb95315c6afb5c0f5f878fe90437ee48f8b78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53bb2fad082b9af719edae87b793e0d5

SHA1
697b89b80f1ed40c6438c643498e3148a1a1ccc8

SHA256
7f5130e7d83c86bbd954ffd4ddb8f605828991bd7bad64e78387586c680fabc0

SHA512
fd2f4de46956242b27540a320d27643f44fe880f21b2dbdf4f4d3f5adb7f1cf5b2593bae6a47a8d43c0596e0567a5984257bbd9d750e0b8cabda632b5ea97a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2852af4c4928cb192cb1ce44bffd6eb8

SHA1
7346df656daf1bd5413a6b0da58d45f9eaa98171

SHA256
e71875c465760de05cf29c7a4e7fb3176702dafe77f299f9f78da4f0ae34d881

SHA512
f4e93480911ff25de58f8860a1f11fdbe425c8c75b8861407b4118fb8449227a9e4f64e801627ffeeebd8dac6be1bb88864c2b2485ba19ed404b7489765a14b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea52a62fcd1e3f899537f5796287b70d

SHA1
e2141a47f08e5e2f5870910cb9c64562279947e4

SHA256
901ed15d5aff17bb18f3f7a7d5c728490b4fe690846ab4555e34761ace128784

SHA512
ae9f73db99cf3affe7c1b7963963069a83125d9c9cc6a1a7263751cccf2a44634216bec599f7aff8c2bfef4e1796513283c2dd8edf862c2b79762885965e6f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ad1bd42342844da3f59de4b8e6ce90b

SHA1
14151c5eb91c0e1f66c4900a1bf6415bd271d814

SHA256
2e830b065b1376c4f388753a7470cd6342f6a59c2bd61960d210847889afc02d

SHA512
7411cbbcb3412cc589e5c02729e89a9bd049467ab0a0fe0b2213f3def43548dc9d54aa6c488cbabdbd55e8ed6bf35d035eba05b854b2287d3fb35b4c71ca6add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ffec784fa1e04155b4c8588a6737367

SHA1
39338a5bd9d1a374ca3f283d322c292a3a26a3b0

SHA256
672c1d233302fdf3a287ab5d902a4dafc7af70ad1f5ffc9c8423cd602d352698

SHA512
9aa2a88bab8560af056b528e37866c9d5ada44d5cbe731f9e6346c5cad68682229eaf8266e0b05b4fda6ae412ddf313dcc23385c4f2e76bd7e70adfb7215f247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b4654f343af0ad416047570695cc393

SHA1
f948cabbddd34799dbdeca940e6a7c9d388152a9

SHA256
3441b59323a842dfade865c0dd8d13ec7f187bce4de0882e5e6717a501baf4b2

SHA512
4ebb84dc4e24bc08daceb392823ba4d2f3d4e520cd339f8df44b1875c4fa990f7ae689f28f1cb87b8805625394ca64277df1725d3efb96e987b1b52d24886501

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A24.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B08.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit