771c438230cebb072158a98700e77c43fd306783eb535b1a71e710c24d2a71e3

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

697151d8b9825b79e822177b5c4b7b9c_JaffaCakes118.html
Size

3KB
MD5

697151d8b9825b79e822177b5c4b7b9c
SHA1

7895153e4cfdb9dc437eaa8007383ee347ba4bfd
SHA256

771c438230cebb072158a98700e77c43fd306783eb535b1a71e710c24d2a71e3
SHA512

41925c749b9d75298835b721100e8038e314c9457eea9c2c4cc1da8e023e4d6708f130a0467ffa6494baf9b90053d68b19e7c6131ac2fe9acee5ba5cfb4ac646

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b9eabf6a2e1fe4ea02214ee68f02b1b00000000020000000000106600000001000020000000601621e6a72b7dcb6cc495a58f21a6987ef04cbb19a34d19ef46a8ee16189d66000000000e80000000020000200000001c555efa87dcc30bac1f9c3ddefc6798521aebff8f83004f3c1494a96e2c2bf620000000ff31a7592ce7466a1cfcc03d1e0c7f4162d00c180432d27defdff13a03b1de0a40000000bcc9a9212e50f50b3f7e91a271e794e606f624a273be088ee5781fa9426068cff1d0bd7b596737656d3ca334ee8862b2d076210f97e3539381712201a3f12f8d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B09A86B1-18AB-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422592983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b9eabf6a2e1fe4ea02214ee68f02b1b00000000020000000000106600000001000020000000e5db73c562abde0901ae7596adffa50933f27b49ad6ace1c861e4343b7bdaec1000000000e80000000020000200000009c26705603aced5adbd7a23485d10f178e90023e69ed34d0d8f6692a47c082b690000000a3e46805c6fa8f5f3ec7f5860939228ae658bc55b3e1c29146585c4fa8b3ea6c683e8d6d0572120cf89b85522f2329e5593b8ff41888ceb5dae5d4144a9a2da861aa9fa08f7d9dad12f58a9c2e51b1ee093ed2067b8b52f65427b25bcc9beb0a0d1921760f11945faa8ccc9bd2cd61295bf850cf0677866063d7009dd7b4e67461a28d7aa737752ad0db6bbfe4b829a440000000068b32eb69be9479fa1a90c41e052d9dcd332932c376ac56c7b9ae812ad0c160f9c2e0e94257640e3f7df6f08cb7adeba66d7bf33e2eb4fe3909a7e2dc1194b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e42488b8acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1936 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1936 iexplore.exe
1936 iexplore.exe
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE

pid	process
1936	iexplore.exe

pid	process
1936	iexplore.exe
1936	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1936 wrote to memory of 2552	1936	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 2552	1936	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 2552	1936	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 2552	1936	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\697151d8b9825b79e822177b5c4b7b9c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d22864925e78f9208e4ee1e8ce0ee779

SHA1
d76b12dcc675a686e34782649decdd6230a14542

SHA256
c4fa8a3026e658199870fdaf7f44064867e8b112e76faab2d5383ca1b319405e

SHA512
d99b3cbc704a876127097634825e747c1d7ed67974c6b5ebeaee47c1a49a441163e61343a24dc1f94dca80be4104ee873bea35daa9e032e05da32c0edebbbf1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7afdc5978a1c61120041aec5f07c7b4c

SHA1
4efc9462c36c40a82d357ba66f4b26cb7bfe4734

SHA256
5614868ef6dfdc3e9038f6a3d705642d270767b3a55b441d5754bcd6de910f71

SHA512
2a253193d1262233e5297931b501c438e5bef422e01bc4d8efedebeb227600fc898445d5402809f1f8e85a369c26404a5faf869bcb61b482db11521bf674b85e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
93086a3653162306dd3bb5716daf6786

SHA1
775cd50b0d73e5134f635a6a3316df2527835ab7

SHA256
8866ef05a02f5d4ba7e2adc4fc1103bb8bc3b03290c24c52c2e0b8acca6d8b93

SHA512
2147e017a6b7be39573ba44d2e19d3bc441fca4e11c9ab8439a6b03aabe75eef0513b4ea2a9beabb9ff6837724cee93794c4463db77b33933188d6c77b22c164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8bdc561ece9e3c3959f1fe4c33255be3

SHA1
136b49451df13c2e5bd96ffd13bd07b7a21e081b

SHA256
5632ea280fd26542acd254bc3e2c088f08e83c9ec096b432f538e4ed2583c6b1

SHA512
4fda8ed07e114f2a8aeaddbc87c0f36c786cf3bff35e3d2b1cc5c189ce73413eacff8af60499afa49d3b941273d0cae34f7f5cf93f2cb6c9cd61824fddbef51a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
598f6412ca349d1e7f6a37db229788c6

SHA1
f41b24b21c386ce90bf787a003d26c143303bf4c

SHA256
527d89918d44b104983ece1d39f71e5f9e1a3fb4584c5dc3d0ae57a254a8503e

SHA512
5dd6d0e18e33ea3bad931ba9fbc74f1a500d7e8905baf08238384147e6d3f48aee440a6b1a4198b317bdcf3a1f18079c16510070141117816c900e0eff49eeb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7f4d6862808c3cd5302800c63dc1ba84

SHA1
f2e5206a5d7f83fe12141ad9dc33932a484608d9

SHA256
87fc9e802e6ba9982ab7afcfa408204e566641ce7cf163bfd49bc5da9f7ebcbd

SHA512
5d662932c90dd1072626c247a04e30873718141778fe4a401a0a30c71ef57bc6b326c3a6efbd1c2bcd45871e0f62467f11760838e734eefc2af9c2bd740ce5c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d83a3587622138238623054867638748

SHA1
83031c3969d909a9110efa3516381639254cd100

SHA256
4988ec97c6dbf2d8ad5f8d7fdef11354d1e86b02644965ddb4773b96b6bf68ae

SHA512
87e463cb289a14a4e57db4fb91843fba57e479264e4f33384e2a06340485b96e4b07927cfc17299cc1e7e8a08add0b3d5f574dd2832e3c8138bb46734cce7950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9211d8fe1009c174eb192ae9ba8caa03

SHA1
b4c7666065e99424295bbc1711b32764c6a60a13

SHA256
369810f5acc0b72970859cf2e9b721060cd1bae163de47e3b065978002278411

SHA512
ae83fefb16ee313c2796116749ed5a28b7d1411e05bf70d8cdb5fdbc4e326ef4fec3c293c2f7c0e117489f9bc7d1b1f8e7c2949078129535a20d19b08b57ddb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cec18c5e21bf28a6140eafeda55044ee

SHA1
e5a281616c8c96ab79260372e6e61b193c3b8c32

SHA256
921ef6005601cdfc2fd60361e9f7cffaf9c59dbe67c7d1e849808ebec34d7fc4

SHA512
7de365972183fdaa76e60a8ac89bdd69b5e5dafb836a7bca98eef5571f8fbc20d1aeb894f54118c412745848fbcc57d7884fc435cd2a792f37ad3a33e12b3882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
205f18f7e81a46e1e1cc0016dab3c96a

SHA1
87d71c530fcbf79fe6ed3692f10f4ad3230eb4d9

SHA256
517b4c2f96007ea2c24a7c68e653dbbedeaccffcd261674aa2a3548a54a98b5e

SHA512
6ecbef331cd176e3dc8207c85402b87d428088c51b680d3b4f5e941efbb972ae417973b2d6375fc78f527e22518041d43c262714b0a14fc41fb5cbd14cb3a716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
507e33e37b7aa57530a299f30a0c15b9

SHA1
aa28617b81ba684a843f577a9430ea11f67f4806

SHA256
b152a1c024558576d9cca385f11a570a2ab687d6d633f8654c478c458dcf1d48

SHA512
ab0156438a22fd00862220505afae8249635133705284b8378308c3269c28e4271480deca81b73c559b03657bcedba475f40eedfa8fd0fa1be69c5fcb2c4016d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ca8dfc481f033240330032cf0eea0179

SHA1
3407e367e6a81077409ab17f95b26ef3c680d9d5

SHA256
d1bc96fc8a399bac8f3502919539c2293981e8abc18f3703d3f548e90ea98418

SHA512
bd6765dc18af449be6089b1a1304a25b3dc110e4384add138f11090c6b5285b25e39b41d829907b2edeb75dba936c3fa2da99b932f7662c8c3ebdd1ab9ef1b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9dd32dd98a3d2dd31e72f0ed43f6d734

SHA1
9d2b629bcd93197a8ed20cac780f1af0f0167e04

SHA256
10f858bbc83ef3fd3d97ed8113a7967074ae74ab681e2c6b3148e40e7cd7ae28

SHA512
6c57a66742787e2d4cd450a432e3e746683f89d550d4df491ad8a182f7c9294576dccaa01c0748d2cfb9ad7a3d1a453ec1b76c89b8419f860956dfe6c1ab3d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB37.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC57.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit