17ea67e0a7380c89d9c659063d462fa86c14ab66f90d00d749f529e8fde8fbbd

Analysis

max time kernel
136s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc1aae364f9498fb17907632688ea17e_JaffaCakes118.html
Size

1KB
MD5

fc1aae364f9498fb17907632688ea17e
SHA1

119e26b1641cb7baa74c73c899cfc225bef0add1
SHA256

17ea67e0a7380c89d9c659063d462fa86c14ab66f90d00d749f529e8fde8fbbd
SHA512

310e76516ada4a3a822eb2d7b5bcef923c68a063b3be2a3d64efbea7f1a6b8f3bb50ee7d06c3d233a7acdc98d2c3239396d630c8b5da75f7beca71fdd58b601b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c79e7755a8f6aa40b83860ef4477613a000000000200000000001066000000010000200000003a16822aca155020162ecc96a622fcbff63883a31d6d5b0029cead7b08ecf29d000000000e8000000002000020000000b1475f377df79519d1fa7a505f0441a124141da26a3d073272911a0bcb156792200000006720ca9e3dd78af47ae76419a78b703fef872a541e9ec14494a0d5f8bd1a0f9640000000ac506d237adc1f6f340b73eb275729b04f0d562ba3fd9f8f0d50dd2957adeaf726d246f37eb8d4398319a880101268fff763f38767362a7668d523135b705d29	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c79e7755a8f6aa40b83860ef4477613a000000000200000000001066000000010000200000001bf784e882dce4c40b032c2992808c37f9c3cabc9fd09c7364bb70f80ad04a4d000000000e800000000200002000000095a5582a1d7a9f219488ee0f9800ba557ac233273fb1ab16c2be91db2bf9cb61900000007c9dd7cd4e34797d030ff9d1e75c61d728701cdb722fa4f130518bcd1b4db80c8e0ed2eb20ea67744a63b6281bdb609ef228d2b8cdd2b7eb1b3a01510356f95eb054eda5e4cfdb005b8e924c593267df0389b7c71b5e6de0e884018d3d2ecf889ca5874e34e20f970ca7549b9d260b5274c631f3af76315c5d7421a1874496ca5eea405ea2e4b0f9440a90a17ca2c25f400000008c7f7d3c012f9540b213ab71b726999ee529d12728a4945ad498902f1d15f9b3146d6fe0f50619f3a32f07489ab0a8072470f95b4cc4483a2d8a29c0e53a3e70	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9063eb9fe992da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA2AC971-FEDC-11EE-8951-5E4183A8FC47} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419755343"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
948	iexplore.exe
948	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 2336	948	iexplore.exe	28
PID 948 wrote to memory of 2336	948	iexplore.exe	28
PID 948 wrote to memory of 2336	948	iexplore.exe	28
PID 948 wrote to memory of 2336	948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc1aae364f9498fb17907632688ea17e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6fc867af8b03abe2f82b3dca9f4be166

SHA1
78e776a6cd7dc026a47f4108b7262481fe70a6d6

SHA256
a2de8cfde8d38be6127d258bf5b1d527b5baef0f707e16ddc3551cd7966e3be3

SHA512
b51f1622fefe03a50bc2b7b0590a06d9b0dee6c23140c358e44ab3934c5b0955333072ad6f9978c19c14ad5e3178221710da42e3351b01c4a620c66ceca02e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f16b2a507264b8c8fd7524cefc42da72

SHA1
a1634fd7a4e30bac1b2cf89c524047dcf88d29b4

SHA256
db8ce6cabf513ad37baa2a65cf4f9d2ccba8add3abaf992c5b2087de73a01ff2

SHA512
681e8e942f5be0c8da0b2dc99b8e5b320b018e73efa6c5d8c92749011c8fd196b4d95060cf532919d7e0b44359b956cb33299e5e814eff784913a42ef3cc75d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48f8bb383b3a6c4a036f89e5cfff66d7

SHA1
b86210f0145ca9afefcc917db39293bdb17002f2

SHA256
1798cb7f2dcde5367f23d47630ffad50ea6fd787eb570e848a56384db230d563

SHA512
0399803389a2520f18097f6fedb2cd95dc1058ebe9b5e84a3c3fbf534c7c90b2b87aa364b0de2b34714337f3efd7c9ea5d3befe7f61a55919c0b791e796baa78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7325ce8cce6c24b56c536e050d7860a4

SHA1
da1ec2e30c503e6ed096c176c517d281d6c940ca

SHA256
67736ac6873ed46d3006ce33324bd073bdb889016a76ec3e88964f4027c0e166

SHA512
d2ccaf50594571b0b2cde63d962e49019dd57b111eabdc413739c29b1360eec138fac514c643cba9a1d76c2510856e4d9a631090a5cbfd6e57eb8ee15d9f44f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d1301ea8792e152e5bb45279e403bb6

SHA1
5f7a233694072672a31f8182b36e199ac9b55a2d

SHA256
275ed5a1353b1f9b59f9141dc41bf5bd5e3a76531ccc71dbac7327b73a3ff011

SHA512
bf1b1e289b651ab2809ead311411ba33062465ee10392232ebbe5223bd661da7b01f08164accfaa2872ad7f2f0ec04a116d30b4e5239fa8fc3e8c62b33ddbf25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80d2721366b97ecc550212ff3e669839

SHA1
45b2876cdc38c747620d008d42b56adc24713427

SHA256
92431c830ddedce3e5bc0ba76bd43513b00966b6d66cc48ed7d96d6622139c27

SHA512
9933be50726574486e03428176fe7ba6bfb580c1cb1e020457d3f527e7a9949dd2a62342b7ee56c8c11df099ad0201b1f836049b0916abbc5745a49c6557585c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
879efeb22dc86af9ca950d697b7bf694

SHA1
290e69202857d0d9eeef9228efeaad0d0b7f7fa9

SHA256
9898bb4671de5c47f1e23b80fc99ea4d793591c048973192f80f5916358c2457

SHA512
f5c8d60ebd5de0a0e0fd8a8eb6c6e17b93cb3cec00b5b8e8900dd2ee112e93060859a3a0211fc217447cc1e79e8c7209824fa2532298285d6cebbc64f70429ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
040eb91b8d1f6304be58cf9ff1ff0f74

SHA1
a30426666df4974a6d5dc16dee7fdc91b9c81565

SHA256
127866cbac617f39deae326a4af21bea8bf991fc32f4976d2028d8f038cae882

SHA512
ccfc462f18f409a61fdfee733013af80ddcc763889627201bc853b37cf8e63fb27dc49bc10065f3b0c4dfa740141a009d1d465593a09a93333edf53414d403f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
621d6d6ba96c1999d1d1a03c09d000b9

SHA1
a7a7fd44aeb75d392317124894d4d79658827c94

SHA256
a826085056d66fdb0f1cefc3695736d99aecae1e4057805b772bb839871283f9

SHA512
2c279a1991bae9387dcc8a353bc31844a168fd0fd039e67fdb513e6a8e1560535b131f79d9a8c64c50e6be2950a4569ec44799f67a99625e9341cc3c0f98ef4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5037806c5442a121834d50da6daaa62c

SHA1
a5bf063ae578a6d87fc639cf7dc82b16bcb97884

SHA256
99b73911e781bf81671da8a63bca08b39eb9c8b4f05f454470da59e783d01ad3

SHA512
4964874ae770f7c1d2de7c85db44238c4e39028e6e59a2d2ccc7571c8426f86916d4a5a1002e37f5d8b47f8406a1fd162fc13b633461b44d1bd935b3620d7d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90cc2e33105e69398b401f5bd1df3036

SHA1
597a90d7ec832ec8189d71278415799ba988ce4f

SHA256
f02b5482da834eac76d39913a474b8bd2ec9f90362266a35de4596aa1114905f

SHA512
7463ae307027fe3ec62722bc62339fbcf3e4023bae21ec08c75bb43732481342d3a59d7d0eab16fd115cedb4041dc485092c2a3c377e27ad88bdc4e8a6398e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f39b11866cd52c3f481899cae8765a56

SHA1
d3373aa9748541f3a4a42763696576575eee6625

SHA256
346679006e54e4a7591a74ef9d3378eae9876218d7b89b9b7e42107b820ee7c1

SHA512
39ca887f7bfde06b86cad0f9c7ce42d4636d93417cfa50d82f6e5f4b982812835dc5ad1ec83d198a648ace3c3dfc0a5985890c016f5b78dc14a991b339e69cd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b6e4e113f986441e60433f7b8d9e9efe

SHA1
5a0082f38a5c8ff49d6e627eb86e09c899e38331

SHA256
225c6bce94eb117248e28710940e50ae79e1f82016b1cd3bd37c57739f2e35d1

SHA512
9152e8bd4698240184a13938caf3851f6c6b6dc49d554227abc6e61a64c892e00802aaaf204df5364ee3f4479daf882c08d9780dab6a8a2cc5ff191f95a8ab09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32F8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit