5ef11c074b0445e8bce547b9342f6c30440ebd5aae1277603391229edf8c8acb

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69776ed706fb49d66e59cab6db4f392c_JaffaCakes118.html
Size

50KB
MD5

69776ed706fb49d66e59cab6db4f392c
SHA1

c81e25f7af3c40abc00ccacbddc2afb1a41a8ee9
SHA256

5ef11c074b0445e8bce547b9342f6c30440ebd5aae1277603391229edf8c8acb
SHA512

4e59da19f6d3e3b6399d5c12897d9aece7cf8311a0649440403c6ca1d8ea0db257691a7eeca109e90d100163d32d0c2ab768d3900818b2d50f79855e2987edc1
SSDEEP

1536:3lJ/KTptwxQeP1panQwLIljIPYX5VR+DfJyKsPQImEe8lVdnb3tSqBn:33/KTptwxQY1panQwLIlWYR+DfJyKsPZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409a7742baacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422593676"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000016f828ee71b3bc16f3ff18660824ede69ff8113ac28df380cf0cb068ae24cda3000000000e80000000020000200000005f7721d467be45ae2ed0348f579faedf04c24dba168a1949da8d344fb80a2b50900000002ef79eedafba1c4f7e3df06e90ce3b47921a27484a3759a8c1a45810c1f7341c841fc43183aadd3f55b5f3b6e7062a13ba6c1b19d08a97123840fcd461cccec58bfdaabc4f6ab989965ab897f1e2775b04c8d4234280eb6673648576e773fcc81e6e18d474697288fc34d4aa9451e435026db7db031253d97dae247b01c1dbf1fd5edd13a1a8e096fed313985cfaaf7f4000000054cf7949e5d50efbdd2ad0904d57eed5b675df41b575772ae853ab42df5cde66b6e27bb132def7de95e9eeedce59335403d62d9a1dc7772361311b138d9d28c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e61a67beb9035b0de2ccf893649b548d19efbf6d88a0a3eb1beafb85299239e1000000000e8000000002000020000000849ddc27aac5ed0ef51bf0dc2e6595f9d8a81a37f0e6a6fca2f59ba259fc04cf20000000bf5a769195ca7f7e4394b92f5ae55a43d100de68b35eba672dca4e45537d0b1b4000000044c7aee26e32cf68f44f52339f9888d2ab57362ebb7eb72dee5ea9527243aa8e4b68856ca24042e201dae09630071d7e65023a42a67fe632a91ee8556b79cd7d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B4B0FD1-18AD-11EF-9A38-7A58A1FDD547} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2056 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2056 iexplore.exe
2056 iexplore.exe
2956 IEXPLORE.EXE
2956 IEXPLORE.EXE
2956 IEXPLORE.EXE
2956 IEXPLORE.EXE

pid	process
2056	iexplore.exe

pid	process
2056	iexplore.exe
2056	iexplore.exe
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2056 wrote to memory of 2956	2056	iexplore.exe	IEXPLORE.EXE
PID 2056 wrote to memory of 2956	2056	iexplore.exe	IEXPLORE.EXE
PID 2056 wrote to memory of 2956	2056	iexplore.exe	IEXPLORE.EXE
PID 2056 wrote to memory of 2956	2056	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69776ed706fb49d66e59cab6db4f392c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bc49f2cfe89c0c648efc456559a609c

SHA1
e835f55cf833cb686fc490cb5e70d389fdbc146f

SHA256
cc2fa5bb0759b531a8270417578cde8e9f8aacdb926c199b08735ed0c04bd4ce

SHA512
ee9b66422425368b7cb316af8f447a2bb406ea29066820419e7a1bd80e0e4e82d87b7822151a142be08aae8cf1061ccd41623040c256e4162c9a8e725663905f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e00f689c0de368c3f2c3d82ef36e4c54

SHA1
74e5a569af8b056e2fccbe188c252cdbe6f2a0ac

SHA256
114de5938c0b88697e6858c8ec87023b055b779fda24397def9b7041d8e1f981

SHA512
b22126a46ed8eb48c67c881498896aaad81336a8b5e77fb921b2bfb8d0db229bf57949d2c021714a67aaab68392c389f23ae6c8fb67b4fc8784ebda8fdede384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad17e01658342a1b8778abb6e86e58b5

SHA1
93b16f329c95a410da5c76e5d6ff0107e75cecbd

SHA256
937ee1505fdf949477bba080fc47f73fea40dc0b6ddbfed3f48627b3a857cb22

SHA512
5d7fa0548f696d9fe8d8143a1fe26d1639155d917e844224a9ea947347594e14755d6f876676c66979ac4240dca195ff822e57c5dd9f3f58cd3cbc9f703664cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
535e77133a1e07cc57b5f7fd9ae19f24

SHA1
0c4c2a20ad307dd875a7dc3bcee82256a685283b

SHA256
889ec12de79529861aeb21ed807a7ac4fa6452a742f11edae4c82fc6792420a2

SHA512
0c2a95e067390f3b471294977b8c45e77d8743caf1a20211f41264db2bd019a79020aa5226567a94e7696fff56f4a506b184dce601d045fdfa809078c7853ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fedbca68433ec3bf705e26a9da849bae

SHA1
26b1200a927bf57390bfc995f759775ca7d0f63c

SHA256
19b6f7b415b24ab25d878dae610b7ed9078f3cdf11e36beae2693ec1aa616ccb

SHA512
ec5cff55caa30a6af7e299a6e535b9f68e5de3a8fd2f7b167fd5570ae39c99359b76543341f2a40da22a8620eaf36d07ea10efe4eb27884634afe960d75f4e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a276d5b01a2307ee5b2af4a06e9ca9f

SHA1
8cd44186ca56d7201b406bc56d0baf735fc48944

SHA256
f61926f051b03e321fa371188e1ff17ca52215b4a76f1bc58528a0ad4a4c2c79

SHA512
62fe38a7ff2b5609bdf89909ee49565d52c7a392dad68909504292195567704fc1d5af065bf112c99c656fd454f3e097bc0cba6c6b36f0daaa8c171320b27b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e9212aac6f5175adb15dac37e855039

SHA1
5b339971fe4668f04b51a262e3750ccbcc473b66

SHA256
b20adceb27a3b4f0c2312b832a707f229ad39b83d65f1d56ff72b65521633cc8

SHA512
3b9bab8378d8682090e84550c3fd0dfcebca7b83cb081aa2e9c5b701a9db31bfa756306310d3ced594c2af4083e2799d27b097d5887517134bb81ae10d89de15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4e3b450afef7ff9cebc44ab619b4090

SHA1
d82a75cb42fc0c28c55ef8be048162a0673d7722

SHA256
9a5aa71b3390385d0ebeaa8dff3d1e1e290c72b9b23bb7b29b7d0076ae7c7051

SHA512
486cf7eca94cd0a336bd1bff84894f270e7eec69db2990d829211c4a04cdceab217311ae5c8a19f77e2a30296c4a02658649e83aa9db70d87b855931cf9d23ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdbd34fe6db1714d72f3b751ebb6dbe8

SHA1
6544be8e6105d8858550ad8f2f175e78320c3ee2

SHA256
da724f8124c1e27370a47660f2119cdf02f4701a4b65426b3af4174742c217af

SHA512
593ed9bc0e2879cc3b8fed352e5d4214b4a7ed8a3a574b5dc5a0a64edfc3f2ed9d09f0052e73169ff2eb223d167208da0d63b934cd71e4a38b9c0030fb337745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13da3f86c3338963bdb9bb4fe012efc4

SHA1
2ef99b90e7cb52fc5281c0f9c9eb105fd985bb5f

SHA256
49f712e2c24044fb73a08235d6c2889b5efca9625b6ad2fb3fc216bd337c97bb

SHA512
ef2f1f223be0e0f02110e4b218360249f530d7d2dca58241bad9a234c8f79cfbd1dcd34d6ee9eb59e8f917a58b81b24ffa0ce3ab4f0e9497ffb713c14a4a50f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2057488157c4811b18f09b275f0a95d4

SHA1
0f2f6c4e4bb19c3375d574d3758cfb27a9884b2a

SHA256
ce550886d1dea07df9169d6e3fa09c12760fc2373902a77b7b050f7ff2d6ff7c

SHA512
add7055db21f4f5d6a01ebb89b013264b70e856bffc56e97568c20867f8e1a87b62320b159e368302b8051dbf0450f0c6438f7eaee0538092569f741ae0dfe90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96f90ebb9cf00bc72549918e3df64a96

SHA1
24c4d539523e414957995b62bd884b142bea4435

SHA256
694a5102f6a6c06344d6538023d55fb0e6a9955072d9e65ac9d03c050d8c2a1e

SHA512
f9b97766428efa389ef9e98801b9994ca3163b3f9e5750d811af73986ced1a47ca4567bd6b9e1d247071ac623995af9ebabdda5250d54d2e6e7bff6cfea3ce94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\cb=gapi[1].js

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IW68H88T\3604799710-postmessagerelay[1].js

Filesize
11KB

MD5
40aaadf2a7451d276b940cddefb2d0ed

SHA1
b2fc8129a4f5e5a0c8cb631218f40a4230444d9e

SHA256
4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2

SHA512
6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NVDR4C1U\rpc_shindig_random[1].js

Filesize
14KB

MD5
23a7ab8d8ba33d255e61be9fc36b1d16

SHA1
042d8431d552c81f4e504644ac88adce7bf2b76f

SHA256
127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5

SHA512
e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58AD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar591D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit