0e5405eb03ba00eb47090ee60180becff5f812cce734a889bd495c1ec70f229d

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693f8bd2602835bf0957afab7d2f6995_JaffaCakes118.html
Size

27KB
MD5

693f8bd2602835bf0957afab7d2f6995
SHA1

a5f5ed5cd66159c6d2e12d46ab9311341b06ef24
SHA256

0e5405eb03ba00eb47090ee60180becff5f812cce734a889bd495c1ec70f229d
SHA512

b5a252220a164bf5a40917fbfac40458462a34a482a431aff8501fed5527cef021887c2440129f499a05aa4e264db6414853eb01f5033067a7a660cdeca4e387
SSDEEP

192:uwLgb5nhWnQjxn5Q/knQieXNnxnQOkEntQKnQTbnxnQ9e/Hm603BfQl7MB3qnYnr:YQ/dm5ABeShS2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009a30c1fc6a18c8b749b971d3dfdd42a505e56c0b6ddc8c8e6542031db4af52dc000000000e8000000002000020000000162f3f8e4d96480002024580ef6624e1deab8941543cbc4ea83cb3ed5c94d0d32000000087749ef9622a203cfa7c77c7596b893ac52d37bcfd492e13a6ff459911fae14e400000001fdb6dcfecba553b48002d522af787867c26c95788505c0d544da8edb5dc5d4b5f48097ff72553417b734dbc91dcda73049df9f4804ab5aa542a48ab63d478f8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5EF02B31-18A1-11EF-84D8-C2F93164A635} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000f9f33aeacda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422588550"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000008cf5a6d6efae371109553075fd56e4a3ff6cfb63a2950d7d09c1864ab0e1266c000000000e80000000020000200000001385ebd55230f6c637bb63515a41da7ad4508e3d84208badd10fc4ac69077f739000000033cfa4d0fa149b5f1e84abd9c7489b85c3f13a68ac095d7bb016ecef5e6660b092c9c7f8a3e7995384dbde1fc38939bb274d8c6980ef420d219de5572bbe452e908e8d17aafc9bf8739db17e1391761a0f8aca60f74e3352a94cec41b9b490f223aacf1f3e8ddca6509f0abf7396cfb0e7125c88f11bda66c344c0d3f2dd2431b18ea9632f6d4f0b6d1d7674eee55e1e40000000e5841c3a66e3b4b411aac22fe8e63c1fc191981624ea481fd2bb06ad39de8af56ebfa7f568462b49aa563e5f77c317a9fae168e49bd9a739e47830f295f0983e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2580 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1760 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1760 iexplore.exe
1760 iexplore.exe
2580 IEXPLORE.EXE
2580 IEXPLORE.EXE
2580 IEXPLORE.EXE
2580 IEXPLORE.EXE

pid	process
2580	IEXPLORE.EXE

pid	process
1760	iexplore.exe

pid	process
1760	iexplore.exe
1760	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1760 wrote to memory of 2580	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 2580	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 2580	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 2580	1760	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\693f8bd2602835bf0957afab7d2f6995_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7d0e7da06b9e67868e22de6f24b03cb0

SHA1
50393c3c94163b18dadc29b52d044fceaaa20c9b

SHA256
cd7dda4780688b94b7a8a95c3b676eb8b17245da7617d099b9afc80ef46c0d90

SHA512
8f392bc29abefc1749445d90644074c968c3b3e53e108e9b4cd2fcc2199055ae252170fdd6ec581e8fc69993531fbc17a418dc071a79d7df71086d3cf3de0fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f2b4fdee115f52348431f36dd395cdd6

SHA1
90f555c46a866eee59ec2b2897ccc2ed90767e85

SHA256
3b80d152a3c517b88688d374c65f88b34443160f01b575018d6ff31976508dd9

SHA512
ce0715c7758b56ed9511fb4c1375f199c14cd78f7d612a537207c98bb84aa5fa8cf4042d07ee07adb7770159ac800500dae74456b3461a080b41dbc8efd20e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0d660c64e4b400af74e043a08b30ca58

SHA1
e5caa180ba387de71d678155f2d032e88fec6f0a

SHA256
d10452607720b305117df63bea6a6969f111cb1ee39640a9b38700f6621f5932

SHA512
0df4e6bd069034bf0d73136e9d4225e92c642e12fa18a7adc492fa0150c75bd6e0927b5f45b40949ec5d43c4ef34e9adc1ed78060be1ef2be137ff37b6096e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3d55e3021c38c5b89dc3d76c6c62d3f5

SHA1
cc9f9a00cfbfa49fda958d304de90634c5c7c165

SHA256
c585762562a3d884970639f7eb90667afad4ee1c7e774599cb5df9fb2f5645a1

SHA512
c5fc04e09f6e7440af476039abf596bd0b51cd8986b4ca13defd99f8140209c8d252b43ee88b217b06dc727289a2d9357b15ffe4b2777ab4d157454b7a24984b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
993fadd79a1802bd76a115a4ab990448

SHA1
c4ec78638a8a805e0f4ea0cab5df6206e8e82cb7

SHA256
2d5c778a0f90b9a6b98904d27e0d2babd7314ba7b42163a3042e196b200b059a

SHA512
8de7d7f68e1cd1ed53e058463a1c5b7475b4a184e773b8a313b573a8bac025b669e4abb83741bfbcf2022fa7af7572e3cf53814b8c1c74a3f3d80fce9b701386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bcb0c4b2aca382156748eb30c0c1be54

SHA1
cec7113ac4938278d2b97bb85e0ae811ae65d157

SHA256
7dfeb3649bd0e695800a433211368f5d62664473c2aab388d7458d7feb7fc2a2

SHA512
8667f8568ced2db191b90312fa0dbdca8cfa4cac725b91663e56f7278d112a2ca7d8d7814a647c91c55a8f12fdb2a90ac98e4230674e62ee66d7c737b533500a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
86ff5e411e4bec04f7c904c96d1fcaba

SHA1
47d7657c003a72522c19fed3e007a86e69ae2aa6

SHA256
3162aa84e445635278de55ad4bfc88b2a9d55f372563f7905aff710c4209a22b

SHA512
538b63506c66367dda38ab00c34fd22d5e23e2f7cf31fb45b19155b4a2f7b069f0d86ff956d08ff58f04baec4a6df7263af8dc0c8521ee85d8c29bdcffae4285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
70c7b9fcc4665e473af71f48d6fc96dd

SHA1
d44258de1e135eda87de8262e46661a3f2712839

SHA256
58e1cdaaac398f4d41bcb38bcbeb501df7dacbb2abfc014e0adcb2222b249332

SHA512
116f306ced2d56e0f2be00e76ce2803b1b136f82734ac60d6e5662f3fdbc255c211fc1887bf00bf16cfcd85697bfeee163c318002c8692236e8d0a71378cc96d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d6a77d819b5d5682414503e2f0927c10

SHA1
664d58c7d69dd1e3ab671d4e2d30692d9abe14e1

SHA256
e89784c4ecd88bcfb78396abb628bdb5bcb927c727ba2edd82837f074471c3ea

SHA512
e3d8f73b35c751b83e41f151706be6eca77e82ad01ddf6b0ae5d01058bfa6aa3a1405ce4d1ff9c55d91b7d69cef2be558537fe89e0c9c0ad54ca534c7b25a580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8616d07a1515c9b1a51227035c2535da

SHA1
37092b9a879a7953c75c0fb0071e5f0696c6dee6

SHA256
44ccbefce97d383e5a2be7e1ead4c49872c3a14de7f93b180d381d84abe213ab

SHA512
b8d6c68649ff78a9025c62b6a82daeb2882468b458aa84d82cf9d6e615bf78e917b49c2f3a7f23d5d18feed032c1f9014976d88430a2bd794391bd2a7247696b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b905ec73eb32c22aa647edd0ef005fcb

SHA1
fd1f33b1d2135a2a91ced9bf7051ad93b65d30db

SHA256
f26973a5f40db99cc23988d554ebefaef3d2efda7f97979947ff92ce53494316

SHA512
d73c5e503978cf662ae03a5c0df0f8e5c2a6768215bbda216576778e9a44150933c06e0f72a50ffe76da7325f85d66f91261c90b8d10110f79eeddd81d76f2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32E6.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3356.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit