e8294f7b23b87f706f05e0d36e92df11dfe34ab5acc57d275c8ee2bd8d7581d7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fdf92f33b31776e03b7f2110adb21fa2_JaffaCakes118.html
Size

432B
MD5

fdf92f33b31776e03b7f2110adb21fa2
SHA1

d8670ac7103d64603ddbb723b31205a548f44d40
SHA256

e8294f7b23b87f706f05e0d36e92df11dfe34ab5acc57d275c8ee2bd8d7581d7
SHA512

c343081c8002aa17b65913252eff2be2d23d0ec569b325800cc2f67599a82a26ba250b9e6a364c3335990c08f3f01db1f6554a66bfe61f3482643c5fef626318

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABC55BC1-FF73-11EE-8E7B-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419820173"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000051fafc8ad8997569449d1876eb5d9bd730779cd414d4ba4da8150ee88db80f04000000000e8000000002000020000000ffd3240e43ad4f46a664f8a75e18ca6ee16fffc45f78a606408664a1083b04c890000000a3a8a4b4d4ba182e5c4958289c56acfa3f72263ffc814a0423a0a65c7d7e1cecbe87d3a98cadaccc766ef8eb0532d4be0a393e12d530b32b632c7d0acf984f1a02b96812e4629990d7891b96daa6b236a57acdd9d5b15f5bcd7a352c8f6babb6bab8ca06faec3efb7e151e221ef27524a3a448f5a9ab9c9b40b0b00d19b4fb02cdd45331372a432497729dd0f8974ea740000000e60dba1c67586932873f7b2280df0b2a8ade42024d0554230de333a274111ab3b31b347cd6372efc5f424541798400369a690ae70e41f4e7e418718e7bbf027c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05383718093da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d35002728c5561048bc50ac894dfc319e44ca088f4440c3b9b3b9fd1e4b4efdc000000000e80000000020000200000009d203ba32ba084b0b3e5fb6ece77eb118867f287265f8976bb69ae3e27a4ce7d2000000040e14bfdd6828c492bcd1cf9bce2b4b07b5ca7999f5a9bb574c29d1e9882a4d940000000ade7a898ad1965890c1965e816b0ff6496c59d3fead3b756a8d9d03f7d45282965d57413971fda8577eb38f1aa5654beee8f7956496b26806c625e573e76982b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1264	iexplore.exe
1264	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3028	1264	iexplore.exe	28
PID 1264 wrote to memory of 3028	1264	iexplore.exe	28
PID 1264 wrote to memory of 3028	1264	iexplore.exe	28
PID 1264 wrote to memory of 3028	1264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fdf92f33b31776e03b7f2110adb21fa2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9089f7787a403ce98d3638e1ae966642

SHA1
59f89d2b0a857e79f7bfa87faed068fc3ded504c

SHA256
335a52f4bb0804c68d5929676616bed7cdf85b99ded44a121fe3eae40724a73f

SHA512
348fb0f96c83af9e781ecb640c16dd4f45f9c361bfd45b57f006b2185848cf1a91efc7fea6836003e8983073c7315382fe97b68a6659c0c4dfc453a682950db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7b618f5137fe9bb586eea787ddfc8f6

SHA1
dc4a7151df3d8a241367478083caf7fc15c502c7

SHA256
39c271a8a783f47347b3f1cb95d3407225bc089a71baa0e01cd78f30a8577268

SHA512
17ca2ae8065f4e6104a30c438b7ad4f8581e4006f26c01e6d7370bb13e1075aa7bce00007714149bde72ebbde59d64955e853778fde9f1c86d1d30a8ca4bab1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4f35ea68e7501b462a06a3c24a3531b

SHA1
2179f59dee9f9fe2e5bcfc1d66cc35345d5d71e1

SHA256
253e21dd4a035d83bac12357f5836fa5c406d1d696ce7f9e4e23aabc8e839ceb

SHA512
9b893b6be25402a29373e0f84051365d53f8bfec157eac85819f9ad902f06bc25f9fd36d2983d26b9fb9be166067b82c8c1efcc7df804534b99807b7f2f3ab92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1c1856706d54b47aa9143e6ad979658

SHA1
760bdfada08a447f7c95eb3a28c2b80a578c2e2d

SHA256
5f20d19024323d2170973606ae1837e4cc4dd9fb6adb4233922d7a2e330105c7

SHA512
4cb9591cf5650216dc1daf09d6f2a8bfececd148db91310feffd63c6a47d12e8f25cc59c1c234295f2b9d64e55e0a28ad957f1900e0bce88bad323cc63604da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18b3cec0ff2c72c4860b25b33353866

SHA1
eb62ec5f62d4e72860a1c5e84c22368f4b824379

SHA256
a7b4c2604c0d0520db3c6dc64ebbf01facc4def717a5f29664f8e529d29790bc

SHA512
91a65c9a8a4d3a693272a966a3ee0a6157ae13db85e33699ad6602b21c800904500f32cff611a997759f5ada0db2b7a7e16920e324619671350e4018e3be255f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3706978d200f5eb244af6d0f8d02b9c0

SHA1
25849379f8ef66fa04ee9682856804b70083d624

SHA256
8132e1773e60553e5258045e918d3b77a76f7de847747fb6bebb2cf7af58150b

SHA512
47e0b965ada8c2eb0fe1685f5d01ffd317687610b1bb62a9745c11d1c0f61f5e0ff495b1809745794a84babc7dc4ec21d2f3d272531868e4eac884649664d650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3d729df8e2265c37ce8568eb468aa26

SHA1
5acb5fca74a2d46e3ae8bca311545a7951ebada8

SHA256
812b8f52c7f8358dc29848c578e226a5346d6791883a4976f44bc047e684bf8a

SHA512
ea1606d7901d0a289cd4a58a1f5b7cd0e386d618edb48de72b6fc92a50370ad435a6fc24e684ade39b514edd96ebc97ea1c797ca9757af77bbd608d86cb0bae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83dbfcd9a3ab2144bfebb024900bea1b

SHA1
00ac76690d309cba72647acf0e081375bcb5a617

SHA256
ebd7a1596d94309942adff895bc4ca30369c95570edd57217e450d16df8fb7c2

SHA512
ad606c79612e04aa0017ec8e47236a60a35724a76be18dab75fdae61b6b2e309a674fe8a335a87f4e00e383cc0cd19570ff1cd15ea8f104d9d17fb599569af12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb768c7883c07fa3ae85640bb2d1aa0e

SHA1
6991f9a2b6846c66d12037860664d8283660b3e7

SHA256
b11427e03a908dacf1406837dadf4043824beb467907fef243e27fc60a607a76

SHA512
947d48b2c3f773fa0c8705d1bc105d7d2f49f349e57a31b1da71a3bb562278328d3affd0572f3a3412fa97d7af5538f8c651e42aefdaff5c41d31154c1e4579c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a8f83f6d7e22f794ac75bcd04db31d05

SHA1
b0c7e22b0b413babb3f09a28f713c3c3afa59726

SHA256
1c3a3facc33f650fbe27468de7b02f7e0952be9fe2083d4eab30260618cec905

SHA512
04151e4356ff276611d9f3a1ef8dc34f8eec7744fd7de675b17b1eb900580ca2f126f0cdb05c71416753f45249f8ce6b3e911bb15d8eb79d4e0b8c92a970d75f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\re26ad0\imagestore.dat

Filesize
1KB

MD5
9a7fcd2dcc46b1c8a344753e3ada184b

SHA1
25b81c4010db5b942f9ee3815b98f02767ad3b9d

SHA256
ee514f85ba223ce1119dcbc9c5ef78588d5b854644721cbafb903073c4cf24f2

SHA512
662459f2e697cf25933282cdbc27ddc348c165612f5ffe82c05e60146a2279ec42083c5fe06ec1fed2bbf07272103f48bbd718f962d16339875e9ca60b8a322e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2445.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2601.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit