ec91644f708f0a8f451536f9861c1530c387c6c237bb8c222306e2069c04565a

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6971687708c8b8d9705eb089d261a0f0_JaffaCakes118.html
Size

23KB
MD5

6971687708c8b8d9705eb089d261a0f0
SHA1

be19b5dbd3694530fd889bf80cbd89d90be353aa
SHA256

ec91644f708f0a8f451536f9861c1530c387c6c237bb8c222306e2069c04565a
SHA512

aa744824aec33895f2f50f1d6c2a06d4c7f31c2ce38f76bac60047958a8bc9d202590d41bcb734fd838870c02f4679746a9937e480659f7ebfd48e03be19a6a7
SSDEEP

192:uW/AIZpcb5nnenQjxn5Q/enQieVNnSnQOkEntiQnQTbnhnQHjCnQtpwMB1qnYnQ/:oIZpWQ/ET3s

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003b32d25d5a79d4e2f09db291bcc9372a50db3b230c5fee8ad49a1914b2c4d6df000000000e8000000002000020000000131e62770da20aa89b778b074f65a5e99781675d6e5e45fdcf9ab03f8180028b20000000ac25b71ac2803a277ab27cf913a4c3ca12fc21f88e146908e9d902a6770fd7c040000000ef5d321320478632904c4bc79a4a391f282260c643a9d0d2dc9e01bd3704099a53442b9a94d53936198d3f9f9c2fc27fb9141bcdbf898cf562c5a050932a1ff3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3964251-18AB-11EF-B6D8-6A387CD8C53E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0926788b8acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422592987"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005b3d03f3dcfa30a28660a36f2d9c5adc45b76dca83614095c6f12fcd9894f0c1000000000e80000000020000200000009ef87920160f9ee02958e61cc090419a2318dc40e15fe2c88a1e7fac4d7ef83b900000006e7e99f9a79e3817f30325f072d6fbd9ecfd7511dcabd67dc522318c52a3d9d3bc63364ad33bf1e46b2510d4aec1018aa1e34bc546e51b1ee84063a1c92ca803b38664c105d4d444b6e2a7e176e003421bdb7f9f8fc92a7cd12dd65c9f3ff3ffacf7553752abeffd5464ba4a4591e3a8dc3e506c50fb49847241c0866a8cd31b76203cb90b94f74a92559a08e887bc2b40000000d368e17a782383645c6412927532388bd9b860c64d42a6418c58c455b3e5c5bdf7cf486f11717759503928265770a470ebbb75cd615eb62cd2440aa39359ffb0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2228 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2228 iexplore.exe
2228 iexplore.exe
1332 IEXPLORE.EXE
1332 IEXPLORE.EXE
1332 IEXPLORE.EXE
1332 IEXPLORE.EXE

pid	process
2228	iexplore.exe

pid	process
2228	iexplore.exe
2228	iexplore.exe
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2228 wrote to memory of 1332	2228	iexplore.exe	IEXPLORE.EXE
PID 2228 wrote to memory of 1332	2228	iexplore.exe	IEXPLORE.EXE
PID 2228 wrote to memory of 1332	2228	iexplore.exe	IEXPLORE.EXE
PID 2228 wrote to memory of 1332	2228	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6971687708c8b8d9705eb089d261a0f0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1332

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
453aa288f9b7d037d01fd0904427a217

SHA1
fb15799770cf3b820603f4097f776f51880fffe2

SHA256
26b5798df5ce82cc8bb686cb3d59ddd9af86b5015b385e25b48461ba280efd61

SHA512
babb474c3c2b7bc22c8fc562826b2a864d9369ca0406f2ba19e72f03220f29ae5f4d79b3ec21859524752a381827d927de01374a0c4a03b5b5dfe5a35972c4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
86d7ccf17525394c0a7a92b4ff3c60ab

SHA1
83aaaaa0d1dcdf871f6e0dfee4ece2c856ab89cf

SHA256
e93a50b35ccd37c1df89eef5cbb3ec100ca660bf02b3579d0f70ac5fba739101

SHA512
f2dff468b4ddd5f985c6391c62656fc163352f39b8c5819501b02f0e4ab6e587cd746c0360480de088dac18483a2cf266345368794feb78b8730e7ba38ffdf9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
db12791a32a7ce75fbdce5401bbbf885

SHA1
7390b15d3ace73a7c3c09fb96723b83d84cf1b4e

SHA256
6070d0d3a2ae63331782d3640489855965f798ffc31c74c0d4cf23a34bd5f345

SHA512
ab8455257accfd5b685a0421c6c109cc45100060ecaff4ed2d0e0f31e3ceaed2d3f759c7a06d78f8616e4b5c3083f7f0b67e238654231a9dd94c3b72d051992f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d21a1c70d5a54248c919080dbde52f93

SHA1
08073e9b8441aa9c43ade77ac7e3ca1944c4d8b6

SHA256
0edd4c0dc90bc13c5c329b2f85f2d15680db961449642ef4a06b16535b063f5c

SHA512
a04bf3f588cad1d14e62372c37bc4baff3730764b9fd0b6c26348bf35e3fa6e1e76bada65db147daeacb0d4e8943e15369dbab40ec4cb99d1378ba001dba8f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a8adcf2429ed14261452cd3106f8d0fa

SHA1
11f1d4a63a73f0c529dc0e9ab428df99a13225d8

SHA256
43bfc37d91c3e36e7e9f11ee9d9047201c58fe250635293ca010f73f76e871e8

SHA512
1d401cc9fc2fa69aa23b76d6f1f7f08f334a7f8e202c3d35bc1d869c0d5ccb18aa01e3b25f692e5e3e625a6663fbc5a02c82a3dbd96830b4441e69c944aa2b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b58f35c168c406b7d638f5fecca37afb

SHA1
c9a39af187ac52706782c428c6b43f5447dbd29b

SHA256
e3e9ebb40347756cf95526cbd7cf6dd845fa4325b4721db4d1ad5d7c1a0f0ce6

SHA512
f3675eb1683d71cb323b36f5297c65e1acdfdbcf8187064d1cefa900894007a8a078aaa25e7b1da17dd2cb04a30186e4de3d38775719b507af44403c4eb22fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ea89b3f101f67d7d4f5156ef0b712a1c

SHA1
ee6f817df7141437aab5e5903cd5bc5fba8ce02a

SHA256
1220b728aefff873ce70b4165273f84c6210d99491a2d08a62bb331f9548aa9b

SHA512
5541ef558f69c065d469a711ece38afa1bd602de35e2d32cea747b85c67e396bfc36429b3ebd02968bcd898e05dbd6671d215d9c4a37d246cd47e9803edbe5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ffd531b127eac624c4dc426afca6c15d

SHA1
07a8deaca6f117e8801e9338f7c1c0907c250f36

SHA256
ee57a984e6538c41b5c836e00ba7a288690f7c8433311be8fd0aca9d38d4b938

SHA512
d2c1bd2170e73d30ed4b537c876c52b1ca2c9bc14841f79b82a8cecbbde523a37883e82bfb18b91cbecd0146a6d1c7f9b4867e87e93bea8991e546db82aac22c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
421027cf5a9def9f44bb7ccb444d35b3

SHA1
eb4cb81263e1070f07e6ef63e593753cee7c79f7

SHA256
33a0bfafb1ad575ff2988fa261c5465149ecd29bcadbeedd44a5dca2e2468a42

SHA512
16730343836f1dc4ac38d64a7a4a8be9c635eb1bf610202b073e99be855bdd335ac07b98579b55c8daaf47865c97b1916accbde7316dd3dec2c9eb405ffeb294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7ce95c802f0ebd24091cc0766c9685f4

SHA1
ace78cab4b78ca4224d8bf0e506bf38ad8c79c9f

SHA256
0d4a175aedb23b46cfd886e7b6824b3bdcbc3ce90b30d9356be44c2c218c9c2d

SHA512
4b2562bf9cbe79ea282c837f5b23274f2faf595cc6ca559095ca7dab993d42083d3723ccd2e1aff43a0a8a3e642b638e8b76444a9ef26383611c93a2ec5f56b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c5ca81beb8dcf4f901f745edcb980b04

SHA1
42a94026358907431698c89f9dd15245e0df9c10

SHA256
ea7373217d647efaa2d9e6e57d6e969ae34d74da3e5bea8a80e2089d17aacc2b

SHA512
db80bbf13f092425e256a19e7d88cf57fb947a70319f2925c8de772ddf3f34b41b7b9710c5585e4a893d04d5824801663d45c7f49a783aa76d6bac9c3bc24831

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab31BD.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar320E.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit