c215b8ef13f3b16360f15884ca081dc44e76b7575f3c59538a3b9bab675d7d21

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

696a56a635fc5e977df0ca9ebbac886d_JaffaCakes118.html
Size

17KB
MD5

696a56a635fc5e977df0ca9ebbac886d
SHA1

920941e58382410a02ff0619afea0e0938f92641
SHA256

c215b8ef13f3b16360f15884ca081dc44e76b7575f3c59538a3b9bab675d7d21
SHA512

47c3f13dcdb221885ad49d0a42203b14813e39e737b2ee5f720a39b534dbd6345345f4e2d9ef076f1e3a0acae743d2009ce51e6b1b51a52c2a9f8954c0dbca39
SSDEEP

384:a7YXPI7xP7B6ghoBvNAfvdDdiGLT46DTUrI86iXkiGYNaTOEuF:AYfI7xP7BeVWvdDdiGLTpcxdNaTOEI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000ac3b363ef50d4e16f3908ef3fb69027a0eda06ff0b4b27b8804382858c21d7a000000000e8000000002000020000000dbe79940e2f621cbc918e1b00d1a0d749378a6e1cb2e8e55edc988794e67a28b2000000041077b8c6198753bd25533ced22f67dca949b32794620c5863df29cc738277f84000000004b3f9ba9963db6586089ee7a87fd1961e87843f171a6ae5dceaaf8934ad73ef2c7464686e1e7e549b3cef540bd40da335c8729a8c473aa630eea3a55c690913	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d9972db7acda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008db046e37524f029c10c9d8ef9168815a7dfbbd991cacdba5756996cdd81db28000000000e8000000002000020000000c8d02aa41ce87beb664e6be8d6c74583ea1eea98a074052ec2ba04f0392a954790000000ff100dc4145c80cb755fa8b565a67f13223d775d6bf12e5cc976850720e99a482a81fcb58502ffbd80f8fc8209842fc469f353973624e7f03e16f24e42402bf6dcda09dff79ffe0b0716307dd1738b2c32a98a58ceb0162ad5af7dd8b69d70ffb8c7b2628c840d36ad67e4f66fd784d2ba60cd9498027fe9516811f395add6585e35894cc682a642b9ebfd7b6dffb1d44000000047b92840ec9a44748ff436ae9e696adad6ad54d04ed4ca31ae3cf745fbeb6029beb59380f228ddd02ecefe37100178d0cbbe1279a0b75c1be39371c8cb854826	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422592406"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58B50521-18AA-11EF-BA3C-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1088 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1088 iexplore.exe
1088 iexplore.exe
3048 IEXPLORE.EXE
3048 IEXPLORE.EXE
3048 IEXPLORE.EXE
3048 IEXPLORE.EXE

pid	process
1088	iexplore.exe

pid	process
1088	iexplore.exe
1088	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1088 wrote to memory of 3048	1088	iexplore.exe	IEXPLORE.EXE
PID 1088 wrote to memory of 3048	1088	iexplore.exe	IEXPLORE.EXE
PID 1088 wrote to memory of 3048	1088	iexplore.exe	IEXPLORE.EXE
PID 1088 wrote to memory of 3048	1088	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\696a56a635fc5e977df0ca9ebbac886d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
66d6aa52d8d1f0867c12e13a97b14fb2

SHA1
bbc5de55e8e0cb435dd275b37df1314f80fffd0e

SHA256
6ca759cbd6575caa8699cdb47fc18f4bd07b070524ff32f0d5fd8463f26dedf7

SHA512
60c2cbb2ae4351999c2a68bbdd25666239346e88203bcb84dea4a8c5d7162a3158f94496ebd2cc6c00c9c98282969c8581f2a92e56247d42d8882aa81aa02a62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
76935a77df989edff55023335ec574a3

SHA1
a469a237b3ef6727188e5629201e7ceb2543077d

SHA256
b6aedf29ed9c6a43a44f2f834069c70a382ed53bc635a7f8ad5a1e390b3de273

SHA512
884ba9e2cccf81ab054b1c33f8823d20f4c66ae30ead12d48d6fcd63ec96f37852b360e528475d9fb3327cfbe5f5d002087b507e0aafeb173b6c8f171afb5e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5473b651edb2f33605d51b1ee9690202

SHA1
f8cc5e134c8e098a29a323a53fc3214a85834774

SHA256
c67173d571cca60842419bb5a7a6be80accf297a5f90f68e84a54dc6ad0dbdbb

SHA512
6065a267dc26bef3efc5f04da3146a2c405755ee2b4d68c60d0d61cd744609104e02f5b2c7945da67d39002c64da92f873804dfb842ea5cf3a9241116fd61e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
71f621ffc8183acb736e73df33e504b3

SHA1
b013e3bd0ab7662f05c08f741a5a8b4d443b702e

SHA256
eff97db18c2f4708ceeb4cc8ad14b675dc15c92e51e783aacace7fe753e81c1d

SHA512
b783ee06c81090699fce59c3190294ffd68be248da3e89a0e93da14be6cfb975509d06b409f4425864e5337db472059a87f3f8491e8d4d256da52c12e08b6928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
998ed74f99ed33159c2fb3c1768ff460

SHA1
d2bc6d2d47b14638dd0cb8d5e55e98225943d1af

SHA256
80be7c91c36554143d2779071de1f05e252e8f33287ce96e3a13bb894fd4775d

SHA512
2475c2086a39357127a81fadf113e991ef32c34959f2a3bc57fcc7e94476d39b83a298bc02c58def8e597916a0256a99b9ab75e63314e3c939563e3d20f373e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bc7a2881ba05026232da23e72c73ea29

SHA1
74b417bd76770f54a287bd987bb772dae9809b11

SHA256
d3dceb3dc48a56a02f327eb6de69d83e34f96f649371323997bb748723266a40

SHA512
ae8876d46bfddaf2187b89d7eae8468690ecd8a3feb08042db11779f111b6125136efaa20598dee8fe64cc9d0f0da2ec19f86e2c18abdd2ef3922d221994986d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
500730929a62971f037d7086aff1fbe8

SHA1
47aae5cee3a5551dcf371ef4555291b637b66f61

SHA256
6404de04e8b4dacdbfd3671ecb981a2bae4bad6828bfa46ab9a677e574ed0e43

SHA512
b1c4d6771bac3939d5ba241fbdc1bd1990f17b315ef977fd245de84b4df27c34857c4c85ffe3ea40baae0b96139f9f52a2b59c82b5b92762913e46bc066fcb08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c845a71d345b949c60e721b629c5061e

SHA1
c80f554439e8b83bec90d3e9864f3aeb1abf7fcf

SHA256
27b4a6e31d3d412c14ad0333ad91854dd07eb5bff25dae20a6cecaca76bdac92

SHA512
4885a0040c852bb932d7999245c5fbb684022b98425fdf5aac08d8b5cb1fae19adab6fe840048dc7d9f9faae57eae0f462a699358c5397c10211e4e75f386df8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5705c26af40bcbcd4f59a820780fda38

SHA1
cdf7e3078ed5308b37dc30853faf0b885c0c4f74

SHA256
f30e1bcebfee749848b50613b4d03341457421722f054f07d3b3dbd304518380

SHA512
43ec9f1b10c4d26d7389e8c1e718975dc09a26e010c70ce0a5b92818d8eaac89e578df95b60ad7b5d7710e09864345da4d4162721b696ec72e67acda90fd2016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
42dea06b39db8bc13bf624e375af4e15

SHA1
e94dabf9787a5237b3deba59d723d8f312600b24

SHA256
7c0ec173eae4efbca6c4c4c5374093e2e69ed905cae842ac483321d8fb0fda72

SHA512
7e6e432ac23c317de8fb97278f4efb11478be4db2cd5d9ca8bc4304d06afc3e1cc5cea6f62926e57f70f6696bf478a077be631be08076422db96393051cd1416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52G8PVLC\prettyPhoto[1].htm
Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\PT_Sans.font[1].htm
Filesize
125B

MD5
dbf7c41b6a155f3495dc39f34f7d2ee8

SHA1
0cef04db5e4d6df6265132c1c5d9695d766dd697

SHA256
e8f1538ce9e617a83b404093ce3b0104f1914ddc38c1c82d702f25b979144446

SHA512
2653ec4dab95a386ebe4b78d3e14cf3293d34c23189e4bce4f2866216675849ec5d0632fd778a31e0e8a04d607e8066b4a0dc2d1be17c4f9a291048919049708

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2926.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2996.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit