504acaf9311798199def7ff0ac92ff11a399a2a0b5a766dac71ba4e9c95c64b5

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

694da1b053991157c59fe8397a483cce_JaffaCakes118.html
Size

15KB
MD5

694da1b053991157c59fe8397a483cce
SHA1

155b9c5d9db991740e89156f0b027d426dca9613
SHA256

504acaf9311798199def7ff0ac92ff11a399a2a0b5a766dac71ba4e9c95c64b5
SHA512

8b4d07d50457f38b0300fa20511635cd52be95136b1c7b966b0429c8c865c41b59a5d76325118ffe75b0ed0d585f715023ff7727bff18ec18dea31fc452048c1
SSDEEP

384:P43Y5tVYv3a2Ol6W0FVsvVG4GbGlF6gMdwuG6BtJUs:gYN2OLnx63

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f70aeb7bf7b9db4a8941c6c3e7f49220000000000200000000001066000000010000200000002225204af0476ef29d6821e409bee02e4aa18e47342c6101935fb597c074f893000000000e8000000002000020000000c3797b6d8200abf58fd30ad86d6a64690e714a4db666d172c8acdc142701083b900000000d5b8daf79d92d95648275512353f544775153fb0a3285c43101dbacab0de832d3333e11ad19f7e9f3d8337e4625cc3b5a2c6665b8a1818931989a3a22a4092650ca10f8a886b2fd3c7fbd51fa5f20150b9590f2ffb59746b98fd960e63c3f168e2fa422f439f924d0b236d4b01ccf1c9d94018c06d1a7a84f655b4382b0cf5d34c79832f1bcc82b48a9d7354e65a743400000003a3554f2370724f9aaa8b744ea1ef69958c371c2fd3194f46107df3403b121d93c9aecb42a53d4c3b4023d26fa21af633fde71812d9f0aa06af1fd83ff6cd032	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B5BDFE1-18A4-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f70aeb7bf7b9db4a8941c6c3e7f4922000000000020000000000106600000001000020000000f2b6da42cdfd4d998e5886edcf83728220074cb9aed6cbbb5ca786067519339f000000000e800000000200002000000063e248d1fa70168ff93aacbdc77a5685d4e96e5f8916e66fba5caab3398c097320000000a81f1ddd6d88db8d41033a3715940196485f78273d6d53f7fa02304fb97bb145400000006222f9037e396684cde9cb06d21a84bf79b4ff4c0bda1f8b8007bfe6e4583c91f87e5f5d96b1794ce781f7e03a1aa2507f23b2629179421eeef0abd216e10126	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04d0e60b1acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422589915"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1888 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1888 iexplore.exe
1888 iexplore.exe
2496 IEXPLORE.EXE
2496 IEXPLORE.EXE
2496 IEXPLORE.EXE
2496 IEXPLORE.EXE

pid	process
1888	iexplore.exe

pid	process
1888	iexplore.exe
1888	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1888 wrote to memory of 2496	1888	iexplore.exe	IEXPLORE.EXE
PID 1888 wrote to memory of 2496	1888	iexplore.exe	IEXPLORE.EXE
PID 1888 wrote to memory of 2496	1888	iexplore.exe	IEXPLORE.EXE
PID 1888 wrote to memory of 2496	1888	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\694da1b053991157c59fe8397a483cce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
842b1b5f4ccfa30defcb346e31407894

SHA1
72334b3056e1cffa05a37d6c36d952a5006e0e86

SHA256
ca1605ed2d563b98c69ee80c353b729dc8fab8ac1dab01f97bbd3cfea3bb8368

SHA512
a256ecdc935b0a82ba723d28132ba63f2cdba75c7d972e37dcdabdb37d10430863668119f50ef2c484c79f8c625e62fb4d4b7f54aa88a857060ce23e576102a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33a934070ee4f83bca61f067a76f7c0c

SHA1
5a978a5db2ed67795908fe6037ced4873ef65bf5

SHA256
e4f57719de25655a092f3736cd72ac0f882f99ad3617a1e33f5aa340381e4110

SHA512
8ca17317704dfcea39e46b3a831a8b8b1f37af1644add441e79d06cffc4a316481245a4a00c176dee1467d770de1c3caf8d57e27cfe566b192fb83672a0bbb06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
161805f50077a0d2c6c9bdbaf3b23a16

SHA1
f2f749e329f1af8efb5f66c5bfc71252ace76bcf

SHA256
d31c4739ea67d893005dac294066b8773dbb2109946a6065a4855098df1407c8

SHA512
800416da4e2b3a19505fb283f8f083e4d9bf58be514644aa5e54f6dfab804fb691d925a846ca4c27730135cc07a467d7b2c88b4bc05c10f0ee2eb49dbd8854ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8dabbe2810439848333a1c0c459be82

SHA1
a6e242c68ecdbb2caf5d7a86288a957044f123e7

SHA256
20319740dbf13f50662cd292474539bb6e53298add355dc87194769c7a38b023

SHA512
f901ec593154e4c36a0ce3eda488ab8306023b5566536035d22451a671adb23678be1a9ca04aa68f721d517b17d8301917db8bad540de8e748fa2197519fbc08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dd5331ae4aa6f298033095f62d5d8da

SHA1
3232d34146cff57699f21c57cc89cd7c40b31024

SHA256
e5d8b3a12e074988674f5897f790eda408d3ae1c2b7c4edf670f1ed6d6fd0091

SHA512
dfec35b7a0a9761fe78777cbd9ab0682647d0177abe213b79c6e1fe3aecbd775e01a3b976122a5b09509e0b2039567c9b59f22a2b04382eef94bc871868603e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e9e4f3eb04998a4bd6390756a0855c9

SHA1
b7ddfe47f696d9ea42839569dab94d20a9cb6e29

SHA256
6032210e2ea8d4fad8cb0cbf166455e77fa775fec40e0cfa42804cf5519ff2a3

SHA512
0652ffc2504e6c3449604e3233a2fc9a69ae60f2e18ba666d267563eeb9332bc11b45921a2d68de0e3ed8e67fdbf5170d79f3126ab0c594b98e2ce11c96b19be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd1d2898a0cd66b9feb5545940578976

SHA1
85396a856fe4436a7ff55c6e8885e8513f67d52b

SHA256
5a9c793a0b802a95936ca4ddde30a867209a788c996b967d7d929c92c99f5290

SHA512
3adc6eddd27d27d8d78825aecca8583ddf69fe3773765b00b1f9b21c1417a21092ecbd934f02c0d00e434804656d657a16d82c8f78d3818c78338ddc5a78ae42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c32b46581b36c43213e312fa3e4f4fc

SHA1
3d82bf19ad81e5489538dd7d812be6719d8d267e

SHA256
7f8c4148695b6a506b39a5498f5ec7d4d39c6b521af751a742f74dab97e1a2ba

SHA512
1a3b34e33cfe9aff21220d5820b14e78435d825a96c99098a368e18005b020e4ed5062f399fe66747211d45b234ab10a035203635846145e3c8dc0a4b772792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a5204c41b650f53ee95fc04ddafe911

SHA1
d5c057cf0b5856e8fcf1d36215dcd81715daa71f

SHA256
12b650b9c7656bfcf344b4b0d01eef452ee1690d0e70f2f05fcf5f14c2897463

SHA512
cd49bf89e7a8648bd107ebb1c7c149b1ceb35f1033f8a776fd5c9e921d73bc0e503dce4e91c61208653d276523f55b204f5af7d2cec6cb3d5bfee047bd74dfaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8349ba2c4263f9f84b2a819c5ca6b32a

SHA1
3e82b368dbeea0ae949c01c1b6c4ad973e769d70

SHA256
07e98bb6231a644e74140613f8ff892e6e2d5ec5c788902a40e3eac5bc052672

SHA512
a8daf4820170945c7a239a27d073754ffe6f60eb40637a10a8e15dcab69c358eb38f8d5a9d004cb1a89d2a041f0c21548f33cb4d87827d53d7ce1f072e69d033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5163a17bb2c73fdafd20a8002f89a15

SHA1
901d3bb7e913eb50fa9b63f359aa8a25292d3dec

SHA256
f46dde3dfa649ec3daa323add44c9165905e18aeffadfca3b377d68e0ce2a3ef

SHA512
d25a6dedbfb088d7f40a50facf54a84afa1c2df18a2ee16402116125127423a60678d51f4c01dd9fc77abc46445b9ed09c4b78b39c38109731fc53a5253f2a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\css[1].css

Filesize
729B

MD5
b76ddb80a4ffcaa0d748ab0ce348e766

SHA1
677830b546fffcdc66cf650302f7bb1d092608d7

SHA256
b85725abe510347fcbf31c13165e0ff34436f6fe9956d5a0e68e41c33ab91691

SHA512
b67f661e84044324a8af3c92b129645fbf0cd0d9359cf7020f7526caf3d718809eaa43ef2d7be73c932428001f91fb5dfb9f6430d8e79092d1f8d66e753abf15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\css[1].css

Filesize
684B

MD5
d1399c9e61371643ef62c66a3390706c

SHA1
7e50837ac0d83905c3bec8f0435e158e882dcaaa

SHA256
3bbf40a682fd3c0afae412c6e8503534e60f626697313022026dfbebff6f0953

SHA512
bd33515c0f72e668c03427e2a8e9c8916993b5ea9ecd59901257f9dd27e91142855bed6cbd74d1a4e34112cc19e3988544cca90312d01fffbfe07bb85b64f1e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab40D8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41EA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit