ff02c8bc5a946216554312134c903c7bfc4155e2bd63e3b16598f054747a078b

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

694eec8b2b69c05e5e4bec1d49025ce2_JaffaCakes118.html
Size

28KB
MD5

694eec8b2b69c05e5e4bec1d49025ce2
SHA1

a98c7c1f6d259e3bd86b9de49d8e60bc98caf1ca
SHA256

ff02c8bc5a946216554312134c903c7bfc4155e2bd63e3b16598f054747a078b
SHA512

f4deada14ed1f6e112a1155f5933c0c09a8930e6cadd6c79f64cb1fa8ca56266245504cebe9829ebefe6b8477dd4d4cefc488ed9ff464cc6e01e1638098fdaba
SSDEEP

768:COJ4XIxTN+4pH7mgDg4gmgzgQ9gdgwgjgYgN1n:Co4Xax+42S

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f0c390b1acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422589995"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000084d90f18e0e4d0c274b7eff516c88e23582eca7fb137e549a0311601b4fded0f000000000e80000000020000200000003eabbba8c7936841619b9df6cb400b02a1178c4f4a98af3af53525491a1136eb20000000feefa7e3803ec03f0549cd46b21060267c3f77c37b7f2183b84e7483576569da400000004f00e80a55cad724bebb7954094c83c4d9de60d67ef26b08bf3f890bebb000e5ee5259a9f68e84a50cf61cb9f85b094b861d3f5ece3def5e372d6a4c2dd0ec8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBA67C01-18A4-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000057a357a2bcbca69ddb4a6115ce82f9143cc012b2757b869fa8d1c5c2781f0760000000000e80000000020000200000004610784c45f5fa4400f2acd563bfd98ee3a89af1d7cbdd108a7d9029f37d0a859000000025cd993b0d3284efc87429fe68053f3658d17f0d98460981b32eb40583f4099a62ff09c3aba9ef399ea9186a54e963a26ce5e3859e2968f36b02bcd477d7286a0d7e4282fef12afb18a50fd36727f9097148e0c6edcb0b3a3b457088638de8dbd150498ac73d62b3b9bb27f4c87610728f32fcb50cd413b9aa2947086fe1caaf6ce5f0688717d4ff9dc78d913e894b6240000000f4229e4cd6a8fe70d25b9c7fa8484b0ad05720c0e05bc9628e031a615bcb4fbf294fcadd9f60ab3ec4378125a215d62d98381e978cbdec392f1519d0b28342b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1692 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1692 iexplore.exe
1692 iexplore.exe
2128 IEXPLORE.EXE
2128 IEXPLORE.EXE
2128 IEXPLORE.EXE
2128 IEXPLORE.EXE

pid	process
1692	iexplore.exe

pid	process
1692	iexplore.exe
1692	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1692 wrote to memory of 2128	1692	iexplore.exe	IEXPLORE.EXE
PID 1692 wrote to memory of 2128	1692	iexplore.exe	IEXPLORE.EXE
PID 1692 wrote to memory of 2128	1692	iexplore.exe	IEXPLORE.EXE
PID 1692 wrote to memory of 2128	1692	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\694eec8b2b69c05e5e4bec1d49025ce2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2a84a4515e76daf6649c6715e74f60

SHA1
71065c1ca66a9ac08388cf68ca206da1af13e884

SHA256
2145d44fbc5aae5d737ae7d3321123a686a46b331dc65f39a19d386fbf471f6e

SHA512
8ee655ae36a48fdf1c236344fb4f353553c40f00ca71135b9aa8062fe8f7ff371738d1a4f2594a683fb92588523e139aee7c08682c90764a3e98d7084418dce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab108e497425dc08e0604c3992f01c99

SHA1
ac669cdba5bf6e045df7f23f5554a8c52f326587

SHA256
9d58fea414f277e3439ce1a163b0fd12587f465f35d0f3a96f849c9624ed703c

SHA512
134874f538ce7dd81b683b57c57f2a67cecabce64fdef88f51ebe0b8d30cd4246ebd7166cef1db04389910593a9c64df271e36e8f2e5f95c1b07ec361e70ce21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fcd0b5041a8265175920042e4f83462

SHA1
1e4e032a34fdc12c582c3ff418c55e9b0bfb6ad1

SHA256
37dd8c5292449349c67ca4ab65d4e5e290442591ea26d40ee78d9d87c07aaafa

SHA512
a4de7b2ec6263065ef74a062db865d2bfe29d6f333aed0ac159ef5e4da4eb9dd0e6e1de5bd9482bcd9808a451731b70df0d12e2c647ef232dbdaef45fd60b965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e21b26e12abdc31c07776466c6bb833f

SHA1
841dc4914ac7f78048358aaa428c9808eb1bedfa

SHA256
e9cdba8b3bc2189e83c0e891b787cb2c7179bb30c0a70fe57ba1118d46765d25

SHA512
a9cec8b38cc387e95fe59b5c9f41e60c9b1a4517f2d3ecdaa52bbc55c5af8555039edb2901df075d4af149ee56b0174fba74b465c22a2573810fe6cc7013c58b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0609e8fe60570a7c1fb488999034254f

SHA1
b7efc2a405b14b037ec58cc3713b88283fb8f4c8

SHA256
d99d1e6e173674185a4d36a87dec335a5b3ca4217e227c6fad5754bb3d0789d5

SHA512
e38adaffa992c9cdba0e7a60645df3f9eb3efebce78eeb34ba8f4aa18d7db5487e1c0c6ce0654608a7835bed4c8b1e1c35a94bee27f1861aba1e5354a0f5cdb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdf9ba68c4275d1cf9f4cd6c8dc59d29

SHA1
506e2ebaef349304c50f4bc0640c1deb61720de0

SHA256
76ef0337b415caa56b3a2f43b8c55fd4a6f934860a127377d8fd0770bc813160

SHA512
35c51d0e59a69b34b7ad132a2a2b08af6637eb54b99ecd5b5fa75f0ac542b7fcfe61533c4514089ddafa3b7b55e26237b6e00d85b0d493b4e0723d485969d1c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7f297ecd8fcdf9545f424cec8f6e647

SHA1
3db33b9a6b8b55d0579fd519aad72c7b10922e84

SHA256
fa76cb65e1f002fdd0e41ddee9c510e938b169afe0c0b2c43da62dbd637a9f57

SHA512
62042d1eabe4e7ad21e46e8e49aecb8b568573198a7e45e13fa23e9feda78c3a0bc4dc6444ebd51b74e68e721628cfbeb07ea371d09371f27d0a1b150e53a475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9bc0998b88710fec2d8979aadc5d838

SHA1
c4ba28545458641f58fa47f75851399907ad14d6

SHA256
3daa2805e58645159dc1bb7c727a052dfb1fc72d38f3b4565f47cc2b2c5ad2e6

SHA512
0ffe96a728b255ef07b4a859cdf2b05ca71e54dac758d705bbd0f088675778d800ef5ac59c480692744b3e5551830e6f3bc3141b15bed4713fc9b0e5a55c281f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a64a0d541a3c8435b0ac44c00c9fda0

SHA1
7d27bf66879d236ca1ce28ab546219b2e184c118

SHA256
9f73531837c814090edc7a09d8bdfa5bacc5fe46e1ba5029da22b42d9370a235

SHA512
8035f8b1905f5f5bb1abb4a79d83057ec2349b7b162986cb3268a743cca354a5f4511c344353114171255558a6f176baa8972deb4075067ef44d2612c21f56ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca54c3481fecb361896a468d7a270871

SHA1
39419773c7520d3ed299a3af2656bb6aba6f00f7

SHA256
c2216b5d11929a991daeca0a75073d19900b812a38fca84c73b1fa9d366b4855

SHA512
a58141d1881da9a9a4cef299b6a5d921793015266651f2a032cddc4729e35e84b4711a747228852aef4ed8626a6be6d63a45ab073fefcb23ac5040f253ae0081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4ddff4bdfd1eb8e6ee9d673eb1c691d

SHA1
356f85c186dc4f4b6e12fe54a352d56ca863d141

SHA256
da3eb5198e8167357d6eceb23a2a1f9c6c00bab14e5cb502470dd3f72d802820

SHA512
f08864c9c92ae9b931dc6ad629e2178b14d026ba832ee068b3cd7da631a19cc4b98643c28066fd061932422829dcb284b0fff63f55d8a8ecc8c84814d61f4ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7c00e452a941130d590757e5c54d0db

SHA1
f4ba7a94f55e14ca9fd9a70032b3e36d2f07fbc7

SHA256
7d22994b2419b812ec3fe501cc24f29d28a204afc0073dd1ef7f2a7797e69261

SHA512
90ae96b6a5b76d9f77709a957cd473df522d70ce7bfeed06cd872a5570107e7d5dee4af26c1718f2e5dc4d1d2473dd67e51268125109e2ea47837b8870a0d432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4450249d2ba0cef4592dbfc23254dae9

SHA1
5961c08134ca7bfa2fbbc86214232b7a694511c2

SHA256
e24f84fe67d3cb60e20c87ec3cf527448cecc7668d349e71e712030f910f712a

SHA512
6795c34724fd520c40c6a242a0e9f17c2da0f6e0e62a28212f6bdab867cc95f33ee46982a98bca432f86de05565ba07b12d1857dd8ed6ce88f306d2d5e59b41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e229918b5c4b44df3c1c67bc1d3899d1

SHA1
828fb45e34ed486ee8150191401513f61ed489ce

SHA256
66d988ab2a130b77ccf3021c5a6d0a32a9f3b90bf6ae29204a058e3a4b311891

SHA512
9edf1296bd2b63405beb89efef814bcea6106a8e9f22203708707441c9925835cd6aa7024d0530fdd976da304b5746669408e6c5feb4ab8ab3cec42695bc9f40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9af5608edbd3f0e4d8da909ed7618d02

SHA1
a52e46c0bce8e3918522d8b54bd59b95489580ea

SHA256
e474434c0320e5176e309eebf1430ce0eeb1517f26cd2e908678bc8211b11e1f

SHA512
c1074b73f23036963bd5e39de75964289c92ab976fa17e951764f79beff4447d0ee9dcc05f7affd03f7f4452c262d5de6da44b14462096ff2d979ff3afcb0409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
138b5d0b993cfd678982982c4703fc32

SHA1
4cf5f3266aaa62363f7487cb9d4f21c66af27acd

SHA256
2a1f7e2b6d5d04d48cf44c08c14ee96379b798dcd67c8218bf82e92b1c0e7ea9

SHA512
7b30b6d4e6299c5e60f9371d9fa5d5b59c10c35cdeb500a43421cf07503406306e166a01aa418b4419753d5386f0f1b62f7f18354d30f66c7883b5591e0ccf57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3CE2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D55.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit