522f6c31b81110980aae6a47ccab3ae4c400caec79febbab50e3f6d32ebf22aa

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe274ffcf595ef9d43bee3f142b3c54f_JaffaCakes118.html
Size

1KB
MD5

fe274ffcf595ef9d43bee3f142b3c54f
SHA1

060f464c88b6ed09c2cbe5cd62b20583cf4aca48
SHA256

522f6c31b81110980aae6a47ccab3ae4c400caec79febbab50e3f6d32ebf22aa
SHA512

a4d556ba5bf14b741a35bcaf3d376883c84e2711a6e48e1407c223860a0fadfc26605a739c507b8c794a22aa0c69bf790597bbf30bef296e90e6e55005eff9d8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e1626a75bae3f7ba2da812de87ead6ecc06481287558e9f3d85f5a8129f530f0000000000e8000000002000020000000161baed64a37824c96a0e221540a2411a69e75010e3a345ad6aae37c4c3634c5900000003645441edc069c8676a15cbfbb9cd65d2aae864f6005d787d4e69b62ca19ea49719126adfe58b9b4c79764aa393a800595cbbcba1345a681a45a892aabb28161aa84c05d6a3d2bb7e17bec07c72e34a285c8e310adbd8b5139aeb31998e3005064e08427b8c04889d4783fc86e21de5b0c843982f569f9802649f7f768d97e4481792d8c765dabd2fcab2a8fc6cedd1340000000a7a3b8e7f0791b8986b40f1f6d13c657724645e87985e5a05c58b84544e4c7256340583c7c06b3d08cc017bdc5eef36f3fb889c66e2ad3d5f1036499157e0927	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419826174"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5018dc8a8e93da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000005f26279b05c745275856ec4c6b46c0c972dc1913113773053c60153c036406d4000000000e8000000002000020000000db941d7597463ba56fa95479ee4225106c0c097166b01bdc4b6cd6889055e6cd2000000045a83aff13915071707c2bf8483bfe0833c36e7b04e70fc963fb8ac7160be717400000001fea5597ad46bd9c4476ee4762fa89710d3cb2f31996af62fd6b498ce2db14f894d356018530aa48c0d6b0c3a5b96393866b17fee3d5cfb17b685d24337d76ca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4B98FE1-FF81-11EE-8CD1-FA3492730900} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2200	iexplore.exe
2200	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2288	2200	iexplore.exe	28
PID 2200 wrote to memory of 2288	2200	iexplore.exe	28
PID 2200 wrote to memory of 2288	2200	iexplore.exe	28
PID 2200 wrote to memory of 2288	2200	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe274ffcf595ef9d43bee3f142b3c54f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47aed4d380d5018f04eced950f716af5

SHA1
e57732dde44ff110e41c76bb885259125718b235

SHA256
b7ef1558cf2b1e10376f73217436faa833e4bcb0f5cdfdcc29a25d7bdb8e0b08

SHA512
2f70b9bb3277a404629a795ba0a2cfaf75a6429b1a74f48afeddaae9b9fca68d9d03266f2f2d566fdb222a6d44c1ca82861cad2deb56e0c3810c9262b6af5dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3625d973a87f1d472933ee5d3fed37

SHA1
494a8ed1677955e5626017a8694dccea0cb65958

SHA256
53f9235a672f25547ecfd4db8ddd35a84a2d310236ac8facdbd8a9450a610c76

SHA512
891f42c92f52dc040612836af57c2045799944844e3060d02cabdb3479faa63b094d19b46553fb589326546b3acc26fbc076213cfe0e6e3fb91a487b4969dc10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fefcedd2ddb9a01958fadcb77f227376

SHA1
7a201e3d9ec64731709ce21584bfccdc89d0d4a8

SHA256
8eb2341bd04e23102846de37178f37934fccfcc39335bd47e67193c6d81dd110

SHA512
a8c6ffbc3606cb396d75c44e1b92fb625d98f82ec8f7579a4a61d3cbd583b339b9e51a29f44f57502874aee16c3f76f622deea332cfb28995eb2607d2ba11208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5e42693819a62e9d448c5de55413a59

SHA1
f8d717570e93e862ac9b2872af486918e4d25dda

SHA256
7950ee59cc0058eeef7d572029ebf93dd76dda5699f68390bc1c403d4db1e6a2

SHA512
ec2bf24098dfdc95402933bea0a5f3999c0f1ed3925b402823d78ee010ce1d140d2796e2c283b661758fcc5e6eeed3558a2c5fde9ba1c43c22f19c0309ebace1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67d6e0f486aeb7c50c1a8c6e45e5ebd8

SHA1
c34b496594081dc729d7476d7e94b407a219678d

SHA256
54ffff34ad2de409d818de90e05a47659f292566e9b7f2959b0ea5c3583b47e4

SHA512
c7a1d1b0eb3d815d34388f9c4062fb027edf73a114aee2b23154a14d2872e408c508de8dfafffd99325fedce83e9a3a8f90692838a990c37e19dd68191f4d7ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b681a94fb8bd3616785ad0a254755a9a

SHA1
e01913a4e682c6b882eb1c32b543e086f5600ed4

SHA256
1294c67c6550a7ab32e03e523f48097f4e3b587dce971668a3ceb45f034977bd

SHA512
5832af80b92ef1b894041e46e54643d14fd1bcadef36742572cc154740383498f1aff3dd72d13a58bebd8bb443d0b4d9ea4b7cb80e49f966c1768a1ea5bfa40a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7beeb1e200a3aaf336d9ed5f5b03cd69

SHA1
b52b6e57e677a0548c09ab7f08d8e593d4c078fc

SHA256
66f115238432a67760121fafc3a4ba943c764ccc3796f62e61306b5749cb24f5

SHA512
d0c1ea51a9d418bc7863fee62699d01e702215b5d10e9dd9b55fd4b47d799cd2ae1365847aa38177f48e1a63fecda3f735dcfa8fdf81d30b690de5d208b2e5fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8478ccbc09335794e63becba348b463

SHA1
20b40be211b6e272497f45fb807239a77825a124

SHA256
b10bb0f70c977abe33581c91df481022953a5d7d4f690d17b0ce365502aa9c7c

SHA512
e4568bd5a67e68ed53aa4ff20be8e07aa842102447e590bb8eb1b4b9061502c0935b384d4dd246c9ea4f10c02b12c13bbb4a1da9066216f74098a819434ac52a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e24b8692836e9693c7049585cde99d

SHA1
fb1516a63c66102cfc1e61c74af95e4f95d812b4

SHA256
dd691caff4732dcda0bb150882d6b87432d693228af22740bd51f36799e6744e

SHA512
4917ad4502b3740d1717ffaa68d658f09def5942c0b840c547c4b90fe956f4b9773aab5224d96415dca3e81794462532b00a8dbbabdb02823fc5fae1a21d0bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ed528d4d1ffe554982d6c2b5273d520

SHA1
96bd60ca7193a6468ad0d5e4fcb63101ef36d063

SHA256
7eef9fda379cfe1f143ff97ed41a6757f97a7d703c95f1b04d664675d47c1300

SHA512
7fcdcbb8204c097a2cfa0ec36632d9da904d91e4889addbe430ce8977bdc4b9412cae691dd391f76dd2a0cd578f53f785fc62c4d0f297cfad55f4af820dd9d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fccf5c016edc23dd1dcafe9a094e9a8

SHA1
c235f547e29e1d7394ae7ed54a78f5edbb75d36c

SHA256
2b6706567510a08cb362aea79eff61f91fd1d84771be1c4bbd5ce22e0ab9506f

SHA512
6a2811a829390b6be3c5c70754c81c5037023b6cfd8df4270467aeb8076def69bc3256fe9827eaee9fe0692f07e1c25163c16eae5a0054ca6cbb30bcc0e88860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
775cc4312eefad793c1d96283087e46a

SHA1
453c31d47f6e9a049cdfd6ba45933dcb84a3cde2

SHA256
380949c3cba714e0b272256b6bac75d9e512e6f2bf11fe2e8f3263dd4ce866f7

SHA512
e06cdca76164975d7fce70794fc570b9282c7452f8673d8fd03233f5cf360d782012e01428cc58fc43f0f8154d0fad02e9a6904b81959c198b23fe9371e0ce35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da18874ca393ff5c58d5e1522d682342

SHA1
b3aef2008be9e43a86a80a92857314f4fb6bd2eb

SHA256
ee84798eaa1b878fa0bc49c244be84c6a4f91985cedafcabc893f39ee930b429

SHA512
ca83e916e7050d2f6c38820089687f7b5cf1c650564bd602b0d0ac7ded6024d2337d569bd6ac8ca553ab6804aaa0093606dc38bc13002f381d727a2b1b63c6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eb30dfd956e17d0fbbaf537acd348aa

SHA1
01456e8fe9263dd0ca24bafd894fc603655969be

SHA256
4210e32b7f37d3705ee65dd8c38e2fda9948d84455072720648c301d1962c6bd

SHA512
f38f37bfc5f2f67609e21294230c39325ee5ed89d426f8072408844eb76d5ada70098d9e04a8844e11e7625a98138e697cbc11886dec0afc4ddb564f9e71ce1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c460bac767a2dc26f65fd0d6190f5671

SHA1
a1a2eb3df1b2dd999040e5ed2841154ec5e097fa

SHA256
8ad5460b48e3bbcb22f8f21eb23a60dc5ad1d4ee150cc8cc4644b6ab0a5cbc92

SHA512
a16cd05456f7df61ed3f55919be94272332301e06205b609eeb5cf410069cf4dd43f0476afe02101761850c0256d6b14e1757a634f71605df54527fafa821868

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D0A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A2D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit