4ecbacd5edfb4eb0aa8d77b20168dde24f43bd73fa2a4a7f2908ab25074c9872

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6966f781054744178b810e7abbbb4030_JaffaCakes118.html
Size

27KB
MD5

6966f781054744178b810e7abbbb4030
SHA1

66ac5e54c11b1f48482362a53c8d4edff80b6f85
SHA256

4ecbacd5edfb4eb0aa8d77b20168dde24f43bd73fa2a4a7f2908ab25074c9872
SHA512

b0b520f21d60082a68b9776dc3bdd6be03606cd88ec769ffb6c8dcca7ed55b2a2316bd5de921df2a187816b4f85ca981930e5b88ec9d7d57178c7e5650076741
SSDEEP

192:uwzsb5nwOnQjxn5Q/xBnQieiNnEnQOkEntJdnQTbnJnQ9eoSm6uhGAQl7MBCqnYH:NQ/xC56gGjSkvjV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88B0F1E1-18A9-11EF-8E23-7EEA931DE775} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9004605db6acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6f90836a747474ab4136390aab5ae5a00000000020000000000106600000001000020000000e38a6327c2282f6af6a76632d1dc8833118474df38a77eafadc7299f7df80aaf000000000e800000000200002000000087d849c3bb898a17a151e69e78d26c837db1376fd8382784ce1925bd4a85c136200000006f09b00206cbb19d3d0c0292007b5ae4e73120e92e045ba5528403a8d00cdf1040000000b05bfbcfd1518fb1f22f09106ddd2973df5894453374eeda35067fdf4c2c188679a62ba68ee7781bd417ad0be4fe6b0075f641e97dc55dd9da35e1bba8a6366e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6f90836a747474ab4136390aab5ae5a00000000020000000000106600000001000020000000f49346e5a6c308f28a808f5b997609a83814f7964a8e308140568f0821b4678b000000000e8000000002000020000000b7a7d80942c24f0746ec2292d3377fa329a6d35dc724d32a005b6efa99b0a90090000000bfb84ad488689f4ad7f0e51faf873c717015a8533e6b16c7e597a2fb836a854dee383b5d3e65a3c122bd518fc5fb08fb5771b2e64d8150a0aed9371b36d2feb86e847121c64953796b4ca49a65dc43dbbd7197d24078de19ae4e2d2db7c1f0e9c458c10dcc359006780b7e4fd956f9ba2415a3f8f9b4aade504b18836b44b73c601f597e120807e2a47f334a5512b21f40000000bee6de3271413e175df20550c5f9f7f4c656c23f5f1d26a44de3247301cea16fad4150e2ef912cce487adc8d2bfece8f80f8d28a08326c1a94d7b6f2f8463275	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422592056"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2944 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2872 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2872 iexplore.exe
2872 iexplore.exe
2944 IEXPLORE.EXE
2944 IEXPLORE.EXE
2944 IEXPLORE.EXE
2944 IEXPLORE.EXE

pid	process
2944	IEXPLORE.EXE

pid	process
2872	iexplore.exe

pid	process
2872	iexplore.exe
2872	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2872 wrote to memory of 2944	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2944	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2944	2872	iexplore.exe	IEXPLORE.EXE
PID 2872 wrote to memory of 2944	2872	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6966f781054744178b810e7abbbb4030_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2944

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3c99900888af96c870a84d4bbc670cf7

SHA1
d98a85ec01a8b1b1b60b7ab7356e15564303d5e8

SHA256
d0eefa29a161c7d0c7f7e584a72b573d9eeaeace93c9ccde10df2d195f892095

SHA512
9f097c004e1638c8e13bd9b111683de60aa2347a0640b6f6516519fa6a0a86957fed8abb2f2f8dd617d44e64048924a2eef31a1475d128b6f5b80cece568a15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
dd4bee5eecfef699e7417e248d8b396f

SHA1
88c8b9944c95ebf9cad495c253c889e146715c2e

SHA256
a74f9536cf97b3bbcca12ec5edbcca01212ea153994188cbc9abaeea093b40a5

SHA512
853c0ceaa8f9dbb057b735987aeb3c708ece7b2f821b3ae03289af30196aee5667ba408999a6130f12e190970e95f7181ac4788351a91d24f03309a727defa58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0cdd3594a4897745ad89c7d4f0bfc017

SHA1
4bf32f616689c1a0839d1c7558f960312697a6c0

SHA256
1dc2ff8d3edbcab2c40622d56d8d8860faeb675f89e1fbb903f3a2ebeba2f20f

SHA512
cca6f9f497701dcdfcc5797184fd502329cd7fc22d54a55108b88ea7deacd2bfd1aff09e437db82562e08388ba12fcc173191c4067f557e31a5229f6626dac1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0776834406a4159c3198d2b428b0cac7

SHA1
6d0c5d2733248eb113a324b27cd6f95fae235da8

SHA256
496dab7e771337284a9cd1a9278905c0e28e2a5f7e5a42974b2d0690e631377d

SHA512
70de5264cd8a4aa865b092cdf42efcd3ca1737b1a662f7957872024557d357ec8eea145a21e1d5c234af9decd381586856af3ed8bcd739c088c7bb51a07432b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2e183c6174784cc00cf591a8499fb72a

SHA1
17b19beabc6bdc46c7a629fc8ba187cbe8fd13e6

SHA256
f18ade72e6e0a8694871e744f5aeaca45d2ed937e65dabf7c43153a37594d743

SHA512
6f7509c693d5b7673d7d0dc5dcf5167b8dc36364cdf2414b4ef2219677d111ce9c1b8f1ac11c24997399b64952f593d14255c6197d20a5e1fd8758531b2d2961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
14f5baab942886bed7ae12a78cf8cfc5

SHA1
8f236ce5e2c6d40e1665204ba9e3a64e0d204a73

SHA256
f98b63bd72b2ed7794139c82b6b9d0cb61fa93ba711793d442270951f43850ff

SHA512
cdc84a576b162af0bfc7766de655d5a04e48cd6f7836558d7cff0620b427144fff2856c9f36a53f8d9c5db986e2baf1d592a6efc7d76b5033421a9e549ce04d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
98e3ac5d7522a5f97dbf36531a624068

SHA1
29e78a5ee006294e7aeb2db96a1838196d996761

SHA256
e4eabd1b3f3bef3e5a2c0c103eb4c37c31d333aec54a96c3be152e173853e581

SHA512
9b47961697019f18e89a221765ee9fc30f9b300a89f5e81482f0cf38f4f57a877941e750b2cd23323b7a59077fa45032340af69569a8abd6af89ad10c50952d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6ed9b967579d9da7dfc9e5093ba61f2d

SHA1
0a9eec7569b229310983c4351774889764079358

SHA256
92ab8ec0caea9ab832ffab960fcccdb7a7426c0f86d969ee12ac276ebba6d9c0

SHA512
0c84f2aa3568230b6da8a4ce4886c3a03269e0c2db2911faa542336dbd1cd002efa47449499eea79f850f97cc9a31ccd5ba32d84eb7a4c0f3b66d3a2efce13bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cd0a937ee2f39af786e742fe603368d5

SHA1
946921cd27eab8ea73dfd9a0c5d5c55769672fab

SHA256
7d7f548071f8e2d872523b22ef791c7709be9a53cf3700fdb75d587d3bb47ec5

SHA512
8a71b76657a15961d43a94c2b240d0b7c6c84f11510a7938188ae11a52ff1de3d52c57c9b28c736eb4af6a4bf124ee52efad6f2f417f2a3173791b659f070a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cdf34935c44988de3090f571ab304bb3

SHA1
9af957432e0a9ab783616284320fbc2d1b3ee7c9

SHA256
390e5a05e0beb5712f21b89c0d4677394969937bdf3802bae9e63857a8cfefa4

SHA512
4e92ade20267e52e055200808a0b9519e8619b08fab9e8ccdfdc32d367ccd56a6bacefa00bd9886aa40c5b134744fdf1f3fcd5d05e00485eef6d81b8f52619a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ebe7bde4db6507b6a28483b041b7c05d

SHA1
b265a1593e3232ddbad043053d1ddf0eb2d308c0

SHA256
2df2244ccd99c2c986264ad2866e9a1eaa926600295f9364a697ad9b80db457d

SHA512
fd2eaf107a0911d9eb970d8615bedb2a2f476ef28626161330cfbe38b36c008bce2ac0bf1d293350d29e4a7aa31432ac0181f6b8629301c8ad75811bef7d86ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c0dd1afa031e7588d7deb5a93558cd0a

SHA1
1b7020d64de28f302e118878fa939109a0ec53e9

SHA256
822f2edafb83e3e075bd2e7c9f2abd2223780d04937fd682749d84dcb58e0286

SHA512
41afa9ce43ecf0e117755f69d9868526bdd28697aa0c14d93cb2c435dcf7e1ce2ef7002cd4f9abdcd7e0e24105f23e7155b8642e68a129f772f1ac15a8634179

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab338F.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34C1.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit