601f475222875d3a563a2c20ccf62dfb5c91714643fb00057c5eb73895e99528

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69666a4c3be7cf9162a2eeb66eab610e_JaffaCakes118.html
Size

19KB
MD5

69666a4c3be7cf9162a2eeb66eab610e
SHA1

fbc52f448c78dae21b5f11fad2e39204e654f042
SHA256

601f475222875d3a563a2c20ccf62dfb5c91714643fb00057c5eb73895e99528
SHA512

91e80ae54d025043bd7dbe5c70b80815182470d31a06ad6f231ac5b5925fd0098ac43f2ceae8c0394192841c4bdb035e015efd47aaa1b30df682c599e97a4c91
SSDEEP

192:uwH6b5nSu8nQjxn5Q/xnQie0NnJnQOkEntbrnQTbnxnQmSgHMBUqnYnQ5ZNnlnQL:gxQ/YqCLR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20278832b6acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aadfd100cd094249b26515cc84a7f5eb00000000020000000000106600000001000020000000b2b642672e79df389737a3eeb8c72a0606aa22c6ad2ebf9c05e7691d76702b10000000000e80000000020000200000007264d13e6106e4e7ff0fc6f32601f0fc87fabaee5d99920c74e966f5009c0eff2000000092d534622985a6cc8647264a18db5ec467cfe4d2e1490561c0157b45784d628e40000000c5091e6e850074e30d5cfdb885e8f3a4dfa66c801059f117bece747c5d1e3c346b63a989430f12bddf5f9b650d251bc88b1b226b0f7f16bcc9330d7c576d498f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DC7E601-18A9-11EF-8A04-E6AC171B5DA5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422591985"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aadfd100cd094249b26515cc84a7f5eb00000000020000000000106600000001000020000000a307f30580120c8bb198bc742255ab4e2ef8c5e6db51bac980ab38a4b07c395a000000000e800000000200002000000050d1bbdfb150c112d32ef6b383a682b203f62d2f263ba0e46dd4e73f8322d70190000000f766b214de586ba55ac9a504020dda0df0ea0f3454b71bcb79f4e5215d042724f1c33d0a238f2fddc88f8e2e66d88334975db4428224e9d3aee6675e1f47ee0801bfa98ae0cca27fd9742e65646ffa01e28fe2dfaa8318b69e07d4abd40d8e1d6bc08bf219c1c02317992bcedf9c53e1169f02577edf39e65c1a646f36f5859cbd497b27da497e771910538896eb3ce9400000006e2634cf29cf57ccf4d995edb17e89f2033a952c5a63a84db120b7bfd41d104453cf50d293f049759148c01d5df0b4530a45d156c1bbc2baf51c71470a67f943	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2360 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2360 iexplore.exe
2360 iexplore.exe
2104 IEXPLORE.EXE
2104 IEXPLORE.EXE
2104 IEXPLORE.EXE
2104 IEXPLORE.EXE

pid	process
2360	iexplore.exe

pid	process
2360	iexplore.exe
2360	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2360 wrote to memory of 2104	2360	iexplore.exe	IEXPLORE.EXE
PID 2360 wrote to memory of 2104	2360	iexplore.exe	IEXPLORE.EXE
PID 2360 wrote to memory of 2104	2360	iexplore.exe	IEXPLORE.EXE
PID 2360 wrote to memory of 2104	2360	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69666a4c3be7cf9162a2eeb66eab610e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f651ffbb45f9273d02ca9aeab0f329de

SHA1
364adb24a78de149ee26ef6f1b34c43a3e8a06b1

SHA256
92c6001ece73208f0607eb944ae657cc061c3d197e7e33e3c40deac22830d40d

SHA512
5572c0e6edcb1b0cf7ed0169e94557731d1349085a3758c1767bd68824d427fe8b339e27c3d8fd5f2ab97d4dd5781dd9b10b3a33cf6d9629ffb92cb6f2596b7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d9da956981ad39496bdd7fe3eb70345

SHA1
cc12db083ad239e68987c715cb7fb32567105211

SHA256
894d1591c95ca7cd534284555a25e565670e50b3f395946a35cb550787057943

SHA512
85479e3ae4a640e80895f734e8d28798acf6e3694c5e59d8cd3f09a4feaf5fc6feb433fe2e5323a8ee47defc6f0b46abf316fb10634af41b253fe913822f6201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
238bad2547e09317bdf99ef77b72a595

SHA1
3f3baf7199357804dff6e502201fc4f7020a7fb4

SHA256
c00f902dcb9e202b5c7b5327c756269561580b9050853d294da943711f36e615

SHA512
93e0a78d0cc90f729731d214f42bc06b46e32af43d01faf44eb688f4ee831f3aa699fe3674d6bef0edabb65e465b40ed05d4dc988d51d6cb18df5d637d8e5202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
048ec16cc29414470152432919b47ea2

SHA1
64de98e32fc2e2f3862e3ccbd4ef3620d0889c43

SHA256
936755952e4b40ced6444f08ba406f4f7112a7f47a8bbf3df5eeca3349e79b66

SHA512
e7dc4abbb9b1369dbb716acac2aeefb2b35c95a03785215de9ddc1bdc8e1a95028709b07c2042349f04713a3da1317f490322308bad265195f8d05b7855f294d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f0d746c5ed5aeaa69808dc6015fe7fc

SHA1
e2aeca48a232025a5d8832d6023b671b0e034205

SHA256
137266b417623e68da76e43bf842d69372bed3cfef50cf8418eacf517a920818

SHA512
39bcb134612176ec0c4cb5dd446b6a994eeead8ae96df733f235d9176b65b53635f250806efb987f851aed7a3560e56e3d388139c7f449003324c8d9e67327be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed3c0a662524084b6d0785bfd419167c

SHA1
4fffa5dad9eef4066190a7a5e2cd21f76195d405

SHA256
4b29cdbd224b15e9ccfac82ed9a09f6472e8e70c74178a3e9e84da99e62c8eaa

SHA512
baa5e64302f71c9e94d94f1d91804e527100a0ba5def6a0af3ca624b527510f8a00426179e48a336180276f0f0423fc99f8c8d87ed717afac99e95badfb83c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4c1a9cc52cf2779396e6594e5f790e6

SHA1
786be4e341ce9039ebe638cb4ec1de47eeec127e

SHA256
3634baa2db4e815306121bb4b401f3d694db3384cf8baa5a2cb52c0b10b6cec4

SHA512
1f4591d374122d997ab549ec370114b642111d52d0ebc5bc07edd4dfe68e8d11e8df0c48737d8924d884fb95b749e5e1e002cb246348f84629d5f66c914a091b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d884a5cd27a7f4758b02a8fff218968f

SHA1
3bcb8fb9297b79c1ebc1cc8966ea36c3acc77adc

SHA256
e123dcb24f1aa4409897ce404f0bd0e8f1e35ccbcf53c92e9d45d250d56e681a

SHA512
efb149a16a54f63f2afa4a5aaae308f4b4e04516b8ce14d4a51ff29b6528e679f37dadfe848cc581de1bafe637917bbec4bc8604e6bb8b7065e9bdd319e59ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22FE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar240E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit