b422acb3bd7be976b2047fb32c2f8e36d7dd2fad084a67c577f32811b53353f9

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

695cd5b01d9d3b59c4c247e698582fc1_JaffaCakes118.html
Size

21KB
MD5

695cd5b01d9d3b59c4c247e698582fc1
SHA1

fb40502e3f7cec7eb12a806a84aed19a592005d6
SHA256

b422acb3bd7be976b2047fb32c2f8e36d7dd2fad084a67c577f32811b53353f9
SHA512

523603026e14f23232ee7f4d2e8a6ec8da0be19a3585c84adcd01f678c47d2a70b89d16a69157e09b8e330cae2e36d3a262bde6aa5b5565e59458d9940e49d54
SSDEEP

384:zi8KhgefGVBD8cu3RQzgcImEfP4ycbp5yzVcrPDJZTO6uGy:zibfGgcu3mzbImGP4y/+JZTO61y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000000b85023bc75f74eb185756db5397219000000000200000000001066000000010000200000002da4ae978a4b72d9848f32ddaf99e567521fedfe4d77700ba7efc3ac65ab2c34000000000e800000000200002000000009def06fcf5955884230b93dbe3bfe53535e51ecd48e71b856b827f409700afd90000000d4728f410d9b6fc9cf09e362c14a138b03cd78e798d9f7ac3d944074557986f9cdbb8a07bbf72b1d58905aaedda3c8aff76813ba747124f4f0e88804f1e0201fb3f0a6ab154188bc7654fed404b9b403eed86d2fd1b6fdc98e22b925c17db81341a2d311cc9c4cc0b9234493a28654821ce9669a8eb186548dadf95a8c3abcc761f913091e6674f5ac680d5ede0c7be8400000003b773c785d0b3f26cc08d045e837a75ce141e09120734561b82a4cf33345c6f133909defba4ede8964a8157c78a15fd47d5d181bee2d88fd35a34dbe7129f94c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422591248"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A684E8E1-18A7-11EF-8A5C-CE787CD1CA6F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000000b85023bc75f74eb185756db539721900000000020000000000106600000001000020000000b9ca4d6546de769fc0538f1e35106b912aeebe7938539c69a353f655dd9064c8000000000e80000000020000200000007c757f65df1a66e477965c4b199f6ae71bff3cd53841eeb41b9b676502b7d866200000003a0c37895354db1490a8253281c5193abdbecea978748f0f0d82d4686ec4de03400000006aae092723dcc139c0a992e72c89d6d289e020a3b9604ebe7d14662d2d16f1861dd7859ef4c303dd47e0b2f67cb3ea3b7113049fb63ce37a5b80abbd44e2757d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10984e7bb4acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2080 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2080 iexplore.exe
2080 iexplore.exe
2096 IEXPLORE.EXE
2096 IEXPLORE.EXE
2096 IEXPLORE.EXE
2096 IEXPLORE.EXE

pid	process
2080	iexplore.exe

pid	process
2080	iexplore.exe
2080	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2080 wrote to memory of 2096	2080	iexplore.exe	IEXPLORE.EXE
PID 2080 wrote to memory of 2096	2080	iexplore.exe	IEXPLORE.EXE
PID 2080 wrote to memory of 2096	2080	iexplore.exe	IEXPLORE.EXE
PID 2080 wrote to memory of 2096	2080	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\695cd5b01d9d3b59c4c247e698582fc1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5449fad2d50f348f7257ff7e6eb42e84

SHA1
ce46ade44e9586bd9ff19be4317617f848b63f77

SHA256
1b14d188141fbc5b68832a1c1695ada39f3803de71353beafbdbae3c915610e8

SHA512
3426625d56ed457009deaba9a2eba2736fe00839352212ec20c1c0258363dd3c7c0c909d51a998526a5495696dfbb9777547dcea4ff14fb74e82a620ebd858c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
634e00d1a41c128ad65c0f8b6ae8e0f5

SHA1
e1c35d45cb6f1926ec1cc6ba57d1cf1e55ed3967

SHA256
3173d0011c665878fb5f6543d01316eb343f4fee3b6056054322bc5d3f7cee19

SHA512
892ee91bffcfb6208fa7df704fa40959fcfabb58fb9cdb05e685b36ce1d6f0704c3a8fce3d04daef283cfe9160bce0e00d8214dcc100ad3a4f79b541f657aa49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd00f5b2d0ab21c05ea7a022e2dd7a8

SHA1
87d4a57a4cf54f200dd90b40e67455e09e2a2568

SHA256
daf70ba5f3773ee16fdf58266dd1de4883e78a44ab3d825c6b9d92275c6fc116

SHA512
873e9621344c26eea1d9614f1719cee580f58dfa5cf9d266d31400a6791fc2b3ee4e9ed644b079b37b96ff5c6f76cdee402ae7ee521ea42c4c5b0641517221d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
761b6fe5623efa58e277520e6bdfad77

SHA1
d03ca7d03b5caa271fcd24d185859265894dc1ce

SHA256
b586ab77c068188b4135cc7556622ceed4ff46181b711fbfe7c628f5d1578ae2

SHA512
e9398c0ac08bb6990c351cfc071af8ef2de9a7957583d0eaef97883c886609dce93c5113cac17098bffac8abda287df5bb48bc450ab30460983710b23d396e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50996d292dc1a2fdc6c764b058be59ad

SHA1
5bb7d4cd9d592ede44d0c56b2e8ea77ba540baad

SHA256
63ab7fe4c64e9852a8bd3c700186502842444dfc15172fae666d15592d30e924

SHA512
49e39d5d465b414cfce4b5d6a2ef2463ceb6db8ae53ece7314c353a03da22f5fcb2abfbc1a4b23a1d5f68a4fd7579ddafca24b0d9aae5d49f0c0545c686d142f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ab52da7f62ac441e8b60424f84699b1

SHA1
9157e8385cef3909a822874d68954f75683a66d1

SHA256
4d5d25b2712217810bcf4c089052e2d950f71de904f5f7912da4a290553968fa

SHA512
69b77154d3096a0068223906c48da697496e9f1c0d5e96572a2941a523adec42d8c6f68780686cb34c34cb029e35eb6e2402a7fcc9f412e369ba183b1217a2b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95e75de830fdfa599de4891ef897c43b

SHA1
8bda280aa76ac646a6cabfc5d893f4a2e30c363c

SHA256
e89c0a09adf31253c502438aca7f4b5a1efbcc116655072f4517259c7512bce0

SHA512
9b8e31f6db921242a332474b26974a61ce04d53070622d4bc552138c95a5fd1eb4296223b250fe51b4e475b125702c231ab1d4e2bb17a6bd9eb100ed76560338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa4a0e1de6bb8d39fe2bcea4c865764b

SHA1
65bee652316f1ef138b0ce88b95aa4dcd25e327c

SHA256
03610c685afbdd56010b488415df57def2bc7d1fbe10acad50180c21e08a9da6

SHA512
acbda5247b294237d6854b6af70b4455a3878e7e734bb170179ab565c43a68605bb21ba13e52c47bebe26fc7d0d941d7bec0d6c303aa2cf7150991e30448750b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a43cedabb28fdaf30281edf0315c21c

SHA1
e1caf660419be7c3ffde25fd84586edd8a0f1cc3

SHA256
5aa2259f57603d0f18300930be6c4e94aaf228852b37b3c4ce2f804ba6f3f887

SHA512
3047bed5b3a9e20a6570a66e9c07a51c7a06263fa22c7a70d5ad52a2f0e7b2fb0cd33c3a60b8728ff8e23961695d2b5be7b5cdc0a69b18d2760e2e3d296e51ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
089beca215f050d1a94054c4242d611a

SHA1
d0ae903d0a397c78bf34a1ab7775d275e9935087

SHA256
c371ecfbf52a03f15ae8c696f146a4b88a56e385b23269937e07f1006d1a738f

SHA512
d499a119572e9a8ca815cd95707ffc742470cc39957f2f368b04241c7d5505e5b35529dee97fa918b1290d8074d33fe5471a778fbe8e99e8c557a17adecb555d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46ccd3a63ac45a04cbd8431e97aff30b

SHA1
2d89e4e70e17e1b4fc09fdaeec6a880c03d54c68

SHA256
4edb1d89026ab462ea528ad915ca911a418c11abe0060c27b639ad2053ea10e9

SHA512
8ca1d52d6a2052f34ab2fe11e365912986643b39456ef7b4ed087bd7b9f9abc79ee2abf98cdbb18622ff9b9e76860663f782ad0ea56f84e115da30b60d8538a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aadef5c24a088932d87dfac0e10d6d45

SHA1
47f97c4b036d78af22e0b937e12c8c1febcca5b5

SHA256
059f09989cb1f3ff0c0fe157f85eef5bd3614f57b842adc6f11f518f31298438

SHA512
f40b0be5a87968df1cdccb6d15943c5e14c6284e9ac9122b6bba187195357aaa1152ba8576ddbc62767f645a62bb39d039c04d1d95588aac1fc36ded72603187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dde89d8332078273fc5770ea12ed565

SHA1
2e3e3f049216f1ee35762f4a0120c08cfe6271cb

SHA256
06efb732686496d38fecddc0376751834d07856ecfc2d41311400c0f21974828

SHA512
fcd080f7ea4eaacd7574d104b1bacd111cbd24d4748f088c9157233cbc14f743aeaf6b0d478d5a553dac46c0c72c9ee064f32064c4dc0fa2f400ae8c3dc4191d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34C9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35BA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit