86e5418c93ecb42bd126d8dbf2a27f5e5a8125afe34fd4a6f7f8e793c6d6f3cb

Analysis

max time kernel
139s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693c4ae729fbadea8b979677e6d16e7d_JaffaCakes118.html
Size

345KB
MD5

693c4ae729fbadea8b979677e6d16e7d
SHA1

f98da59add757b6e8666bee2cfc0a6f18388726c
SHA256

86e5418c93ecb42bd126d8dbf2a27f5e5a8125afe34fd4a6f7f8e793c6d6f3cb
SHA512

2fcd8b04cb3092cbf45dd8132feeb4bcaf2ff52d7b5de456031f5392276f8e831bfbd4ed92936bf7ec95c8c7fdf0a7ac28f8dcd78fdbe9d3135ba8b771867b73
SSDEEP

6144:tsMYod+X3oI+YcFssMYod+X3oI+Y6sMYod+X3oI+YQ:55d+X3aFa5d+X3u5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01235acadacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9708EFD1-18A0-11EF-B35F-5267BFD3BAD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422588220"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ce1574f1969b4e4680584170db8ee00000000000020000000000106600000001000020000000a76845e5d3046f0bc03bf9cfad3e95b8787d0311b2982174d6334d8aab63b2db000000000e800000000200002000000059330ed9440fbdc634512030345e555eba5ab7dfd391c3b55e1394423f7d0750200000003f13ccc18d379e800049e915aabddaf63b7f4f645426f2d7c100cc7e747c40c540000000d114e7a414c49ff668bfff2208df279604cce79fad45e3e8f53f03b6894dc5a6c6a53d7d22196e51b5a8e6e4577f8d8a03e04e0471fc566ea9d1de50f7becd08	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ce1574f1969b4e4680584170db8ee00000000000020000000000106600000001000020000000d4f4aaa0d9888423024982789fc418be2dc73e95121f1ddeb1489eec9660b428000000000e80000000020000200000009d856fd1e72b72b41557a3b34864963a95ad0303da2df20fe7bc6974cc2b182c9000000019ff3e309ea06ab23d112e59f04140da1a225c2ee347481583f7255bbeeef0adc1c8d588e14ea0181a75d58df729a21c36f8d115deffbb271d4d07b38a9242ca1edb09e113e166d5fea71ddb7bf8ae157e68cd3f51cf15bd1fafb7551e50ca8c89c084cf6f8abf2bf6afb321ae72bcf4241c5ba90ac2739643733a384776ecc8acb17ba3b1fa58e432ed0699148c1cae40000000dbf6347e412e8d5cb40626bbad657904dc79d0001095e733d009d4579ac6da23761c1279d189a6d094c2f0cabb04d4760d3a2c0c6bdada88e7c250c38d2c12d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2148 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2148 iexplore.exe
2148 iexplore.exe
2084 IEXPLORE.EXE
2084 IEXPLORE.EXE
2084 IEXPLORE.EXE
2084 IEXPLORE.EXE

pid	process
2148	iexplore.exe

pid	process
2148	iexplore.exe
2148	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2148 wrote to memory of 2084	2148	iexplore.exe	IEXPLORE.EXE
PID 2148 wrote to memory of 2084	2148	iexplore.exe	IEXPLORE.EXE
PID 2148 wrote to memory of 2084	2148	iexplore.exe	IEXPLORE.EXE
PID 2148 wrote to memory of 2084	2148	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\693c4ae729fbadea8b979677e6d16e7d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c69c84cdd2ec9429806d67cbdfe2faac

SHA1
80d2e3e57d96bec59dbe82223e51bd54bc4cf4c5

SHA256
29fbf8d71277c24a762b29c8c6459bc4cd28d9ee90e3daf3ad4881cd660fc34c

SHA512
5e3305218a03f9aa4d3c7f88958762ac4c484b48ae93170c56e6cc354829be8ed6e58f6b6a41c37390059ef1c719e08e7bf1fa3cc116f5269a3d1a2aa2d3e969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a79feb29ee657475f641dad8aa428159

SHA1
72d4ee2e864b1291212836702ff999d0294eed8b

SHA256
caeb3ac97427996af4004be5db9d2e3e9a0eb4c8901c396825773eb295bb7cea

SHA512
21bebec7f34b63ba63ddaca1cc04731a8e741b3001f9e81a67bdae3530e1291aeb034355b0257d7ef72d5c807fd34f9f9b83f991a3378dc7cc6b9d3674f8fe18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd7d08c0a1ae9535ece83d2164c756fe

SHA1
186c6b414c748bc3596496ae0a7d56c50f74fc12

SHA256
faae306a18bffa98386a43f62e0a114c4d032abf81f177666983e3d8ccece9f0

SHA512
a7b468c1854cf6c4e180447f90affae33c4f675e3232f914269f42a7f9b574db19cf505cc37867c52d3c43b9b6b03f78ed2edf4a93174486698af6595c3035a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af76def5617a5c7c21222414ac6b0a4

SHA1
0fc7977538447a39b5baf38be6bb0f7a12db8125

SHA256
795b5b1ba34c362cd48f8fcf4152f6682dcd34ff4b5e70a51767194bc57315e2

SHA512
8b451acf588210cb55fa5fc9722e08a639b0365ac18074d3fec9702da4661bd276e620b29f7b12a7b96754d66cb10588ddc879657d515d8ca1d42e534b7bf6f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d24dbc4f358f694893d4fc1564c9c59a

SHA1
9515663efb0e853e48c6f3016b4b75dd38efc8b7

SHA256
2a8cb250bc6f5b59b9646274018a7fc7c98a67b4bee222df7ee5008be18c4d05

SHA512
57f01f396cddb3b180138d493c7c2acd8818a719a9194478696744a8f178afed7571e24d26423f312bec072c10e4bae51247066a217123db41c6d646a7b7ed26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c4095daa71bccfad8a5d6d3c19f185

SHA1
e529f62265b638954e310d2cd72cff3c62664350

SHA256
04700aeea03d3a9effa75c6eae6042900a7521a4ecce065d0efb694fe78361b8

SHA512
7852507e4ac77eb972aa07a3607ca4603faea6ddf0848f94327463ca449acf59e1af86f272116284f90eb02c82db4604dd90d9585b2e973547be1e7af7fdc747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61ecc3ce6a4ca6d49e1c1e5c62c100b6

SHA1
e0f17dbdb1a944c65f391f3c25f76d2df7fda0a5

SHA256
f955417ad505e038c186ab576c32aa68c261746d4af15ff38d59add6a541a6ca

SHA512
e7f1890535187cfc3df91493044c13754d1094dd6ba07976103f129144cab600b7cb0bad550d074292e514c40d7f3117719d3cd11709afa338b48da98a97e87c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65e4206f6b668419f257e0d68d6f9a86

SHA1
6dcee0dd02302fa8c933e4b90f6b964dd7fd5790

SHA256
0ca3a5d58a5b19fc39ca96224f7823810df7d462bd04085c6aa465df47c911c4

SHA512
890fdc6a067c25c04162c94e4db187cd294293a4b23f7f6a568c9709a122ec471bc5515f976f3acbbed3035192c9700db33032b37799ab3a2f367a0030301c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47ae52814702df05ca950394d2821486

SHA1
ddb271fe13fc3b474b61d68f4e498f31c7c2e95b

SHA256
0dfd4d7c5f846f833c04e94868c24a62e821b922ee0ae781b808e64d54bfcc4d

SHA512
388ad041fc8a16d8a0452fb161bb8078f59f5fccbe3b0d83986d623cbaf0e209453bf9d669fce388e2269ac3b6faa143ea9ec356335ae891e1b0cc1303598eb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
907f429101adfa7ada4c31a199a49982

SHA1
fc1e8ceec0e7a21852f30f40a1fc115a35ef11ff

SHA256
09d28a420cda32f50c572bf9b196003a40543f1f80d86b5c3300d4560b263a13

SHA512
712bc020fa94cd92612e02de324e07bba76c52566c901cc9c93fa2476b44e18a700d87050c42ffba20dea6cb45adff0cfc7d41fab4a57830cd7e0c3a7294b7db

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD03C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD227.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit