913031fb6362f2ff912a9d43cd96641cddc1fdb6b06a295dc4fe2a63e1f1591d

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

696ba9ebfa6541dae1ede6c758c5d1f4_JaffaCakes118.html
Size

139KB
MD5

696ba9ebfa6541dae1ede6c758c5d1f4
SHA1

8b2b24adaddaf6f53e1da4eafa91cdf3be504439
SHA256

913031fb6362f2ff912a9d43cd96641cddc1fdb6b06a295dc4fe2a63e1f1591d
SHA512

7281bfee9c94d2189c9224cb709dfc81e9cf1835edb5eccd0f91d110c8d4925b2833ce5714358fde7815d0db16999e7fea6da7817e057d75b7ed7a56eb171f94
SSDEEP

1536:SZfsTLnE9ClypyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SZknE9ByfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e02cc0b7acda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000f87993cd7817059319ccf8c90d7ee3260c8a546ed65fc355ee4f2e4f69aea7a2000000000e800000000200002000000027a171fed5888d3b5fe9f6d19165feaed0bf5a4352143faca480b333544ead9290000000eef572aff24370a8ad96b0ea9d19d9b2ed414d84ceada85a965b5e342599aa0657a5a9f3d2a16e7dbd76856e4364cf0c7333df71cb1c762909be7ac20b6484ec21054f889815c5951884604e1985713e1347432afcf95e0eadeb72ea5e0e4efe015533142f58bea09bc7a689bbb8d2732b766bb4e729287bd5f4fa0180f3b3413238fa6bb99a5ea86d59144c4898b699400000003adf9c78e84ec5fda699f4892b900bbf8dc15d09941e3bf510fcea1869531edd62f4c2edcf0ca460dbd83b9f4adf7a364735aeb333da271bfbfede3f913028df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9BD38C1-18AA-11EF-B6D8-6A387CD8C53E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422592542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004622ed9c1d94af92653aa42630631882423af799de7d4d20066cee4d923c2d90000000000e800000000200002000000054265f4036b4cc5833ef1954a5a449cdc4cb6770bd09a8ef8efa3436e67fca102000000049e13bdc52f7acd22daaa4579dd1ecbee6386d89aa48137b985983228f38c58b40000000425e3639a9bc517df590dd21514246433f1422502253220552388fe69731f3650b8ce5277bf9ed994e5bf8b40647d49b9ce3bc572e545dea71c766c63d7dfe99	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2204 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2204 iexplore.exe
2204 iexplore.exe
1236 IEXPLORE.EXE
1236 IEXPLORE.EXE
1236 IEXPLORE.EXE
1236 IEXPLORE.EXE

pid	process
2204	iexplore.exe

pid	process
2204	iexplore.exe
2204	iexplore.exe
1236	IEXPLORE.EXE
1236	IEXPLORE.EXE
1236	IEXPLORE.EXE
1236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2204 wrote to memory of 1236	2204	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 1236	2204	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 1236	2204	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 1236	2204	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\696ba9ebfa6541dae1ede6c758c5d1f4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d27012e7e2b693e24b7d9553189b0544

SHA1
c82c21600391ff172ba5b9fadc04ce6140662e6b

SHA256
aaf59bebdffc7fb4fae590ccceed6aadfcc710ce2eb7bc0822f2184b18db9433

SHA512
3d9529f4cbb12be11f9de3c37c263d3dd4fdf0ebddecba352a24b82d6823455c386abf9ecbb24a2fcc83ae990f96478656815040d6751e451b4217db5bf39936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5764f0d94e0b25d2fc27d4aa47c3caf8

SHA1
b03d122293c3aaf5215d614df4d5fbd99cdf6881

SHA256
def97d9ba6383032e6868a24f617413453d6b2b47c3ae4e25264fff225a5cc3a

SHA512
414417f77e9556ed31dfd860d6bcb27858f22e7cbb4279b8237c86110075ed1316435b3abfd7892f31bf79335d2d3149f7e70a4969f31f04c9b6898f3835eed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f7b5b523ab1c8843d06f47235339497f

SHA1
433c540164fbd219b9ea437318b91c18bc6aca7b

SHA256
ba9ff6275613e034590fa76c1f8c73f61fea722ed1b7b2c627f126b5ec5d759d

SHA512
68f9ca0a7d9a6260de7a79ef2dc0c3808fc375095b34c2677d0c1c3bf829d7f99ff2b16cf2b09f1a8d2c890c905b1f5ac82741550a0aa7ab2d4a3ccc67a94d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d26798be4d3efefd10d9700863551f41

SHA1
5359d5d0d401cd468c0f224832c004f316784ecd

SHA256
4f925760a6168b7df890bf40d4bb9385807580ff50d8eb3e5571161727414005

SHA512
cdeefe5a146d875f8bbc38f49db1e2e01b07af77ed616436c238c88555f5b6125e773630a744a931f64a2408567080743a101e97598c98d25a43159832b743ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9b75d2bf3433392c2baedb7d5522a530

SHA1
6d9bd4264475696e256e307363e59689b05922d3

SHA256
a9a9ef7d260c605affcb938bc1fab86364f75f5b29548eef7e14c4dcab52549b

SHA512
941e569ad825c4543674e3676a6883549ea6e4ae1c67c05ec4c5fc54ab4f7a2d739354100f6d1756ec74eac1baca5d0002dcba3823c58d87b8e0bf3d72a70184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f55d510cdd69952a665feec3d271d43e

SHA1
334c3eaaad1634f5835b33b9f3792c1ab787cd65

SHA256
47fd3c0d82e0949d18017f29f8284f73779d59414e8e4acf352bce9db34b92b0

SHA512
d35fdd3efcc79fb6283dc962daeb60b251ce20308e673bf2995afb67dfe8dce2775aed2004867642db84cb2a091549e95ec0e95c7a5a35bbd1f289616f911d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fa8b3090de33239007fb9b366e31e3ea

SHA1
ef0ed18b265e542f427ad5b0dea60620303a804f

SHA256
2344d1bdda3c8684442864eb510b26c1123859853b6983c1f50d49f746daef73

SHA512
f7323ba0d4e27a810933da5f28a0a0cedb9bd22c0da7f365e751171f3dd0ebfe5d31ee8d2f1256427f3fad9ee80bc2d7135a5bdb0aca442f6737805030ccdc4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ab5acbeff93591315545dcebc35140ff

SHA1
0e3d6384212c80b43e5c45ebe13b23f260dae16c

SHA256
2fc460c8ea3adeb05be59e48cea725e3b6881519879aa1b918cc3b443da6db85

SHA512
c872caec55fb498b122845b60a62428e9f90f9babb56d44125e1bd4b8d2a26b1c81bf8528d712cc15fc8a4a877bc51b210819ac4c5d25960b20bb71283a36051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7a7fbb93f2e3616f481d14a94d854274

SHA1
016c5dcf9415be6413318a6641ba059d3d207a43

SHA256
25a6a44e3af7a3d377b658163b748f824a6a1f1ac7af06ece909867449fb3d53

SHA512
309dabe9737196999592d3aaf805199eedaca09c654076f0dfaddecabed79d7bc3d468516f96c5b632b6a8d4348d61e6cf56f5e84f079510a22dd9612711829d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c231178c879262df9978d51ceb646150

SHA1
b365639f6db32c1a66057a7e59da03bc19de16cb

SHA256
f81967c771d6ea64a633baf7b571b9570d33b7a36c6c484180671c18e797a6cd

SHA512
4cf60a5a2c2a3eadc3bc380c82f9b34e85f6dd01613889512ee06e4e315174dc2153b1e56eb575c25957b82a18f932b0297324617b2f9c2d1197c2908eeeaa79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3b7e34509027995e0ad30a502e3139aa

SHA1
87dfa6329d496796853790728796b3c2e9f41d81

SHA256
a91055cafc0e2c1c6c0fb09548988fa1a61b1e291503284c6fe1698fd18a0921

SHA512
0b9bc7e842fc6e620c46a654ac57ea5d1a64a482b554808649eacdcd9a9acd7784d932c3600b981728e7f0cfd348f49bde2001571b03b3cf3017724b04785fa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
407a9177b8ddf215a041ca48c10594af

SHA1
ed0fe0d36aaed58c899b126469aeb1ed4d7ffad0

SHA256
462bf49824490053f8a18faf1369026b3bfdc4867d972cf864dedf5489e50337

SHA512
7dbf333def12a10b1d25a694f1dc5631b32832e2109641f8ca823eef20f25b904b0d0672a15f2ebf726ab93fc4c68b65728e7df1eef8d1a7e3525134fbda89b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18C0.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1921.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit