c8a9c51c95542d26ef6e4e9ae915b1dfd04f91cf57fa12c7120a352db4f4d6aa

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fafd984242f104e93990fb1dbe266f5e_JaffaCakes118.html
Size

2KB
MD5

fafd984242f104e93990fb1dbe266f5e
SHA1

b0fa1df4b404210e7753363775a0a343c36c4ab8
SHA256

c8a9c51c95542d26ef6e4e9ae915b1dfd04f91cf57fa12c7120a352db4f4d6aa
SHA512

9d9db3b7957ff917600c0dc10ae41f8549d2c4b84173779a4a8059ef47800cd9d61606322c8b95cd6730c0103a20e05dd433e7227f5d2328203d4c1b7a896381

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CCD0F91-FE81-11EE-8B6F-CA05972DBE1D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06a5f518e92da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419716129"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000006e249931d0592f1953600866316f4f32e3b238b5fc57ca488221e69848ce3d8d000000000e800000000200002000000033907d6d2cda2182302854d2063e726187be6fade9680fa78f5317c135dfaa8f200000009fb2350e895ee20c4b86088c19776c67be24934945f2ff9978b228b6a70413ee400000003f69f32cd8108a69e4003ed2aec5a983270f2c9a1a594f8e5da101f840b14c9ea03d929ff67a66cffa54da7c9ac05d52c285c94207ff2f62e3366974da4f4c66	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000eb0d29fc5ab93b55a81baa42996c53492ef14a7c8e924e24df18c1b0af466269000000000e80000000020000200000009e8fdfd3167516e9b5a88032a99c4d79a0ca212b00d2febc84f5292bfd9a6a55900000009139a582aedf7538a51ac0389fa4a362fca43f9f9e6834c2f52647906465566b3a9467ade339d99d508ec97fe76b9b5bcea74f811b64cf6edc91f65422e74a4b294affa892bf5a530ace7147ed4c8b4c69e06e5af6c5a13413721a7f0980007539a9644d3ed74114704a340f778574678bfd3414b9d4873040284c155a18fc2152deca27ae51c28a1e7885253e5558ec400000001134c585d14aa20ba714c660ce7c35e0da0c8e9f6c91a76bc486fc8cc1a5f2ba08595b50f47e438131ff911f0bf160c368585165384540e583ed1cc2548390a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2716	1956	iexplore.exe	28
PID 1956 wrote to memory of 2716	1956	iexplore.exe	28
PID 1956 wrote to memory of 2716	1956	iexplore.exe	28
PID 1956 wrote to memory of 2716	1956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fafd984242f104e93990fb1dbe266f5e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e14e1f54cf3ad4bff4931bd90d9bae

SHA1
a1bc86056838acf51be7f8581e9d2b2a0359682e

SHA256
a9a76d09ee739054bab5cb261f38f0d55999490f99a37e8c7a50c05138ce5d9e

SHA512
a6f98f7758f1c6c564c02473149db753021f8ccae1d0e45a078641d25a93243855bf7f373061c8cc76aa6aa9feb03717f6feb0eb08dd5740d80aa5627a8674cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7d55521b88768900be161ff822ee766

SHA1
09889bb696b4b1646d852ae37c6208afd4982e55

SHA256
dc41ae68f1e4a8c18393c7b632f4df97eaa3143148ed2c8abf96f3230aafdffa

SHA512
a4d1f79a218152133176729a6669e4d877ea8ea9e8554398f236da47678fc8f64f17801c25ec70668495808633ed12f345bec07fb8135bfb296bcb956294cb69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4911e4cedb4953b32123cb50de9041e

SHA1
24ffc6fff24f25d19d7c5208c4c2ab06d880acd6

SHA256
db39ded520a3445bde10ecf1c4ecb0bb3839d04fe0a2bf10c59e3c773622b9f0

SHA512
dcd9eb258f94a169277122631aa1acc3368833e0e63a245ab5db5e35bce3d264ca9909ebe569a5fbdd7a717110611454238b5715aed729a2d1ba3ab6bbbad9c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8478b7646e0b70a786d799d3ae31d865

SHA1
c1a53f9d04ef13218f55a5cda3b879aa1e988ba0

SHA256
b9b961e1711c686446343e629c8afbbb4e6f0fd2b467ca598f4b82196660c2f9

SHA512
6c5097bdc97356f3e7016ebf7c75cc9ceba4b801823bfd414db2a4d38bf0e82a3e9ce751faeb5f82328fcbcba15a2aa7252425cbbdc0f6e101eb2e703feb09b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b662ee7cdbcf42abc2d855c5c4fd07f2

SHA1
acb6881def229439bcbf7fd01c1246b818182e95

SHA256
85a66c9776fe238c839ddf10974643f484b5136851fde935d84e67f3e83d8d16

SHA512
bf36830f747c0bfae57f53cd92f79afa6a17a5bdc416f3199e0918d3ef1fb68b98790335757d5b52e6762363ffbe95a26be544d4608443890acc460f4a8fc083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ba08d6b4a2426df44f7d96987d7d194

SHA1
0765f354cb23246f095b0c80c2d88aa041e459b3

SHA256
c59aeec7c5d85db444571b6332236f1158c6899e603926596939758640cdd941

SHA512
1f44d83a98ee7ef01f1e1a329c307d8ecc31d92a10eb528c160387f7f31dd6d36ade75b40156312f0fad6918e47046d3a694e874d07f598f869725de1ca3369a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e6d8fafcc64bdb5e148e4b9f31db51f

SHA1
7d80ee50686f6ee848ef351fd03bcdcb920d541c

SHA256
9c8bf2b9be2a73f9d6f0bdcb07d41ad79544b0aa95696c5840c9a8c803e9e2c6

SHA512
09c9fcefecb0d9bb9ce88bf2ed4b0afb63c255d0a19838866de6ab19c5869dceca742cabd10c63fed5189c1e1577a9a5308fd3e706cfc55566e3774425ab4841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d77373c36f73864cb90de400b1fb7f5f

SHA1
90edae7ccee9b0f9290a8a44d45a1424f0b9d96e

SHA256
7eee3aff3b649687573319fcd9192e64844a186e1372669c5a172e114dbe9516

SHA512
c0c4f9c67115c8183dbbee6e3484b2b9091fd91be9aa8bc4c1c0de58f42c392c7459c62a51acb66d583f8626b07c8bc426238b7d3fde77f4b9f8cdc725994fdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96ffb1f0b33b6429a4d193145a9776f1

SHA1
a4a62cedb553b90022d1f86acda33f0064575212

SHA256
31590d7128ac857855c39359f1b9bae6b73328a2a89ec914f1fe4cf9d433517b

SHA512
6afee84252bfdd8c7beca238611b579c4d4a4fd132f822f0a1732fded7ddfedd55ab21b23b4a3c39af2a1dcee9edb0ab290cb02d674842577443905345d1cbc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8752c11e2a819ddca8923bf71d04e308

SHA1
fe2eb026cc141b5d83f63213169670d294467d44

SHA256
7adf5691742c725b0b4d36a269a66d7bffa106ce7c8cfdfca589e92dff500a3c

SHA512
894e551bea31c42781d38e93681ef4ba00075a5bf53a92f6517e73057184532551e4b4a0ed5c2f89ca83fc678217bf0b9d5846f3fb47154daebfb5faedb4ee3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bdc43037a2746685374bdc5d1cac235

SHA1
73743d27c414eacfb5beecd4e17e54397b84f098

SHA256
5ba2a8270559481d122d25af0e44ae44a57f70ed8b9ea44518874b3633c46139

SHA512
a07bd5788a4bca35f0ceff514d006791a27f52899ae1c58dd24b174dcc4a8941a4e775cd39c15f5f69ae8ab0f18b78b383230b838bc37914bf34214277a79ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc26fab4ce0fc792ffcfe21a8916585b

SHA1
8bc13357e80a13454eca35fc501dbc0f5c770d10

SHA256
e7308a8450b7aea4428f31a9608932b15a0ebfe21cc1dc038215dbd3d525e6d4

SHA512
eaac656bce8aacf023316b61698b6ab426e9fd3342e4d239e4fce0e8bf6a0a23b533b09239ca2c93d61a1b51f768a7cc23786a75ba5ef8bc5cdb9f18904fabad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bead49e1d47eff808daa431118e6e7f

SHA1
119815b529cae4e784962a92d4016e4f657015b7

SHA256
67711b449db7f151b6ba09a86707c93f09ea04e1847e5ca635a93a109eba6616

SHA512
ccd2a50aa3e57df285b55bf0644de1b5a42b8d874f49210789924f9720526b7d2db9fbd43fca14c8bbfc6d24f093b20631e1c4622a9daf8dcbccfe4e9e1e23c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44493efc9a34b8b7706d36268d659e39

SHA1
47e5acaa47b97a68d890dfd23abe8ffa39bc5713

SHA256
e90a89699c3b743ccaa0f9ae4a91e930078e9802b0093458c80d6a243737a26d

SHA512
d502bc4524fe789440b7abbc9e5659a95ae5c53702ea2edc34563dc2023a6b4952d946aae51e03e9afcb020ee1bedeba78018f2252a147073455f4294f2d583d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2427.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2556.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit