2daeedfb1a27d82bb01985670d04e87e7ab0d2e258700c013460ad4aae3c0f0e

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa5210b9c4fb7058bb3e7b710a5dc1aa_JaffaCakes118.html
Size

1KB
MD5

fa5210b9c4fb7058bb3e7b710a5dc1aa
SHA1

c4d4c0cdf3f9fbc547611e1e080c8ceabb8265d7
SHA256

2daeedfb1a27d82bb01985670d04e87e7ab0d2e258700c013460ad4aae3c0f0e
SHA512

ce2c55fbe49f7c61da222edf63e0a9c943579d3a3df7c05fa43b4745321237ae60b11817cd8c83ba8fd2447f4c6135f8bcebf3e22924801ffeef6d5a7c6d7058

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419692570"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A26B92D1-FE4A-11EE-BF06-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8006f0775792da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000b90b7e53b72b4e95b99beca4d7f80e5ade366a283ff14f81200e1f83f597c91000000000e8000000002000020000000582178ef05d55775f964be1c85de0fc06d86f77a10661aa20e42fa5a966a787090000000eebd4defc12da473867b88a1ed4b6539519517da7061feec0cdf45d4cfebed03285f6407c37698c309bc97365b729e4cceeb52144735e441d01867c4b505867fe294740408a105824f2167d8e40509abfb11650d1aa9fd5891e21fe1c525c68892781162a45c1f1a9ce04307944a590a8b671de3e0022ceeea13e7327c2580c92e2c90e9c784bd21d6576796295cb412400000006861307401a9aff0aa2d9a452e8e1c45cbb9cc8b6e34696456a045314af5915a27b8b6af28352c90b382949d3c3189101295ec6c094cea57263de955eea336a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000450dac98940b2d4e2d182da44a6e70d3d4b53d565aa6c9032c04798d4bbbe238000000000e80000000020000200000001b2b1d23c4643f5bb864f7a79335c970ba51ca98ff11b20d08ba41c6065ad49f20000000e15385e5ab938489765cf6de3fb81059bb0d7895d7a6f0a54118f6c83ecf770c400000005d5ee920c6a8f50ad95107803a8b8abba4d8ae37623c972652ecb5c7159e1cfdbb5c6b7dc83434582bb67ddc4ca2211f7413835fe0d9b69199de6bf372305477	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa5210b9c4fb7058bb3e7b710a5dc1aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
297839c95247281fcf502253ea51dc6d

SHA1
82e37acb50f294d4cd38ea3291cfb27845c0f6dc

SHA256
aee4465e39f51d4cd9b1cde1c137a00d8fea11ae60a1d8e5530d0016dac9e41c

SHA512
e9b97d44427e1827c2ed7e8c9a94ee20c4780a2ec68942c24b38791bd6a92f10f4dcd1c3273fa549e3e222623dc51245c5d9ee707cfb45afb8bff60d47d12afa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a08a67c492d3b046eb7b9dadcb92045

SHA1
9539886f72cdd4f11512b8ed1af728d3e0f55766

SHA256
bd4cf88ebf9438b58f9a679240d70f44e0d7bdba00c9164b636767286ce1b8e8

SHA512
41704e024fd56ab278449585cc022c26896ae8a86191d4ac7516dd0918698aae0e530a17aa5fe25c42fd450897a1f5b5fd805f4d3d6c83731f9522612214dc07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04a939a9af8d4042f95b2de5045175ca

SHA1
82bcb04950ac0ffaa04ba212b45249a244e7df4a

SHA256
f25d9b72ade49c55f685d9c0cfd6cb7c0d5e11e8141ff3e8fafe6414246ce8ae

SHA512
19ccad79b72000cc550389cd9019dc1c1548d5c59e9485af482ee1a5ee86dcf7344089d7e0874767f756253dc99e15fb84e4f9a1e9bd683ce596b5afb6797290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
399b097e38bb8abe67df47a1d6ed5e72

SHA1
600cf6aac0dcff1b978809cb98f192d8fa91cc71

SHA256
8841fc3ce243f6b8206a1d335221606ff2e8cb35e097f2c3b8865440d6bd0958

SHA512
1ad9e09bf884d40a7848ad0d30b09cc39d68cbd4118039597b9e3f4df85c333a14abf16a1a73b21b94f167ed0bc868a5c651ba4aaa26c1d8ef00c48ebe122f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf61edc656fbad03fb539f2fca713b29

SHA1
daf25b3833cf9881bb964bc1be0957481022e8bb

SHA256
db713244a74ef58a8ee65376c5565d7c4c97fab04e2a029f3cf2662b660f8de2

SHA512
55803c84e2deb4535247ae108c6f591200f2414d61ed469e6ee748d28f8da923b953637519a080c69b7963a9a6068277adab90064eef8d14169b806c9953f5c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cbae0a3eec8713104d187293fd30da5

SHA1
c594007327a4c2b07d3db4e6f9d0cd77eff859e1

SHA256
4fd72583483ee1bd202e0676d07378fe01eb9060ca2a2b1bbbf3b0176fb385bc

SHA512
b859ab821e26f27b4773a1822b1837357d0483c3c701f0acefabfd2c53a22c137f3ac36bfc5d801a0a3124509a58aa9ad4b5f68d4796be27330005f3046e808a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed3f0050fbc5b172500d4580cc9cbf0e

SHA1
f200985b06ebcf0619189c6daa00ba5b81707c37

SHA256
2b73911d8268849b22e329c4e04747b1362e4a6d7d7707e8709d49013da755fa

SHA512
6b3d90f6bca5d43f3b310d37884dddc33a72ef31171a168222d55d1db2e21dc52947b760d7c81f48747611a47ad71d78566bcd364258f369edb899127c1ee6fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e085f405c2b9d68b8c75014719d56b

SHA1
c423a8b88a288dd62d40ccceb6e881d9ab839f0c

SHA256
054429519b1dfdcb5c30824110f43bfaab30dbeda9aca18285b53bd9f8025171

SHA512
1e99eeb5242af9dbb84e7224ff2393c514750a6f67df52eb15c2408fbf53945db869b66b18744655fe5006be4935e207d5df65b956b24f86927ab7ff1fb17ea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02482ea2889e8b3f28ab574416e064a5

SHA1
cd02cbadd44b3762a9f247dd00fd4d4400044f73

SHA256
4a504e062c8e647e5c072ad2326c9a35da41734fe7d76cb1cd91e1255b0143b1

SHA512
58d49237c737772260c6abb7ad892d0cf695418dcca09ec117b62f91ea43f58285f53f8b33943ac145ba4fbfc010ee775ec02066a3104f470e6964cc1f2c199c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ece78b6617c68704521db9ee66ab030d

SHA1
64c2dd2d1b07bda0856ca80430dc5feb7310f4e3

SHA256
f9f17afe839dbc042d911d6359be9f956d3189d8676706ff46405d98a3941867

SHA512
0643bca582f16dafaf2740d1660df4d41c51bcaa6f581a515455167e470a7b10b0afb427c181a67914172f159bd8696ee0045a864f166a879cfe6615cf732cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e77b7593bc12c59d8838f5699e68c0b

SHA1
a2f45c8bd3321ee3b27f990085820b6df6f8194a

SHA256
4d68cd1c629f7520e119c2bb4c17d314d659d1eb08dff0d485a842372799796d

SHA512
1a598d434951639be4ce7f968e8da67548f09687705cd7ccabdc9da4cdc985021cb21ed508c39abd4ff7d7b7362082d4ea5a464d6c9747b32d6580ff904bbeef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57211ae8d85c89a60c028da1d6abd268

SHA1
84a02d9a2bb69205e9f8c22c488324dee3f49719

SHA256
6184db480ccfa6634d1c8752ccc9d468ad6b2babcacfb929a8d24e9089f57169

SHA512
9097aab599e9bf5c6391d8f0ce7044d85b111e1809f95fd7097fafde1d88b96ac233b39cb6a63729207bbac20b4a041adb9edf9208e9c742a903f0363d5b0e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86016327d957766bc8aaed829c0e2cb2

SHA1
43f3f282e230b77e069a66cf26364acda9355ca7

SHA256
a1b8cbe0283eaeac25d2d687abdefae7dd62e27d2d019593389020e3df6066c8

SHA512
80f71a48a91a262a55e49634b86ba99bc19b4aaed2be8b874931f33f379c8ca70dd5d7c1ffc96f548390ea6df21b8b9b80675ce50089c367771b6d5ba82b27c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a4b254dc7e0a4626b1f5849e00f9a63

SHA1
c60cc3e1daba2c1360fb6623f567552a0bf4394a

SHA256
86e65a4f591c73f598a04953dc1d2e1e05aae43f0109c5b6d014a616cc6a6ab8

SHA512
790e4de5fa660e757de14ad1d939b91f302afe3bd82173b39af26493b7ebc8d009e01bfadb9c76fce6a885af26094ff790e8d4ba942b1c2b76949a5add573fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9502.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95F3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit