0cc41425a2f003f969afa7bb777ec754920219edefc4610521d636612a693b1d

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02ffcb0cc95ca9c40da86ebad0020896_JaffaCakes118.html
Size

852B
MD5

02ffcb0cc95ca9c40da86ebad0020896
SHA1

49d8032ccaa0aecb07d0c85d1ada0a5651d8fc8f
SHA256

0cc41425a2f003f969afa7bb777ec754920219edefc4610521d636612a693b1d
SHA512

208b54d9a0dc3e70653430c78df5a34ee2f64f6aebb59a7f45b928ca2f1da89d84f16204c8a4a2322f6a8201b41fa6c424f76228988be04182cffeba6cf81a5c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420373947"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000062962aecf8b13b556e16e027d3f11122e6b7057e2c950ca11e1636ebbba2d1bd000000000e80000000020000200000005a2602dade0c7f021b7dd07680ea1276ce5626bd361beff23cb150d19816a41e9000000044d2eb8a2fd76297a9357f15a893bf90409fc67bf3a9a40006499ad1ac7f93c1254dd22e675d8757e2e37ce3508bd6588a53916c0c35ad0e3bd6d71952f15ba427d78975d725ccc6f898b1e0f12428276789a68f7d682ffe21e8e7e268a41427500203009ed395a9ae5086b758b0838360f8066fb6907846c010e7efc2a4b521f76b1d8c08f45eadce8ba94b795472aa40000000c2c350fdaaeb660c6f10101181a3213032c3b158855d4d6f17f8a56ad0ee239cb8e0346f39af8f09ba12f256aa3b43e9b21660e17973d785b2e58801a2f9978b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{181393B1-047D-11EF-9966-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1084a5db8998da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e714b3570f2bc2b08ece663f5c7abfc3e1dcf1de617424ba223b222e3c4e45a8000000000e8000000002000020000000a404bb03087861f8f2249e0650a020ecc46582fe5b64fb90e3e4380af9ccde6c20000000cb3c710742db5b5de3b7b07ba11a3c42f894a7c28e6964fc843d95a67dcf62a0400000006fda47928ee6cbc73b22f23aea6eeefc5ff6b81b74875b1146d55f5ec023650c8a5eccdfaba8189dbe5c934eb96de14cf3ede7c3d2d4eb2b5a115dbc6f1706e6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2528	2164	iexplore.exe	28
PID 2164 wrote to memory of 2528	2164	iexplore.exe	28
PID 2164 wrote to memory of 2528	2164	iexplore.exe	28
PID 2164 wrote to memory of 2528	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02ffcb0cc95ca9c40da86ebad0020896_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bc1405afc9cfc9e0e428a22b0437041

SHA1
6fdffa42d69d7bd0db40d0b90c393d7c186f29bb

SHA256
045d42d52c6a42b8e341b977ee0656a670da92c1367abd53ef30096304c90c47

SHA512
c777c7b4919103b49d39fc6b67ee7aae5776a27a9a34264084e0f7eeca70f3d2b84bee319b0b35067be2bf78cfeb08af350eebeb55ab4e4dfbe76f60fcb5ea32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d708a716d1e632e1ba11285a5d5660eb

SHA1
ec865f34a2a4cbf03740b9ae9c6b2308cefb4763

SHA256
48ec927182c566312bcc8df8094ac88e0372ff13c4cf94ceb3f053cdd43853e5

SHA512
91a2ea497d3d3727151d1b9a4627aa4df4a3dd4c15eda68065deda7e922b0b69860655012b45a85f7d05afd77565e1733d7fe114731073dc9b49c2d610c8a6a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a184f39bdefcea01d8dca9760df16d80

SHA1
1805f3778fd0c156797415d256efa3f87f396f06

SHA256
5e242623bb02a9ef666c45f8d2ea63104a9b006699a188c137b435eba4cbec03

SHA512
43d9c5ce8efe94e99ed224e632c4cd5607c8a995349233aaed38b87b00c3f8a0cb9ec2e351c0adcc07429be7955295901229e686a01f6b154f967293d83b5d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fe8c00e936399673bfe6ae5a3285299

SHA1
68092c32dd447aef3cc0ba2d9190ebd42f715f92

SHA256
2e4db20d0ffcac5224674ee4a769bdda05f3c78857342e4cbf48aa3a4763feab

SHA512
fa900b6be6bd19594c08b669a327f67edccc34d74230380f2e6cc6c1a9d7913963b7d42c9634e4bba0c627fd305b635d737e99b74bba404a37498b39d3ac4a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7691a03efc6439302270cc43182e69c9

SHA1
bfff8f93dbaeb73117b5c7acbf0fd2bfcfdcf198

SHA256
6f4f7a2d1992b886bdcc721a1ff2545e88d58bcd1e0f3d8ab128b7e0eb968a2d

SHA512
dad7eb7b6dd0a81d506518410d39fc1b9832dd4823f71ff73131a9cbca0507530d01e0f4546ec26dcee2e5a4bfaca4eaed19b8cf398de17f17c799737ca4e9fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
717efb60a8d9fb2c79363b8acb9134f6

SHA1
e4ce1712a67f6bb8eb5a34b01e43d307d953e7ce

SHA256
84e2027ce552899ed9715a87c5177052183eb764d2b34cb89bd180df524ae09b

SHA512
b1d7605bebf5bec1400302b12b35dd2b0f386d0ae135910be36f2e36061292480a82edb09520b8c5f1d9bbe07f9b3c1938bc51bfac1ed48d49ae80d89a75002e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e80d448989cbaa6d35a0e7bbb5a5aa13

SHA1
1e577a3aaac502c033e0a84e8ece6db9803f586e

SHA256
0c4cfc02dce34d9dbba0801e33547778d677e2ff95f09923a9b9173093a0ad4c

SHA512
afe0bf06dc1fe11503a79e9a1a6222fc1693a9324d598c93325fade5b7dce2bb33d6aad8886b36e2b2422abd52f7fe70f906b50678675c75cab11f329b0c98fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c43e5073915b68e3350d5d0bb6ccc40

SHA1
0ed7a50138c74ab28cd5cbfa2d9702ac93fe139b

SHA256
3f3b9e3a9396eb5328afc9347b800464af3abc29bd315366163b7e006186412d

SHA512
40321658fa81cf5d90acc967321a446e5141c8e31df6fd22e04eb3af11f01031035ae9affd133c80c6301c467c3f7c3c540eab6b8bdde075191fe72f999e9632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b89a4aa3b87c75d1a2138ddbd983e902

SHA1
145e47339b2e1319ba371dab51d143cfeb2d8022

SHA256
80e1fad7f9bcd60dc44a15bb82669532dfaaf794506d7d934f1dc009ce7a2222

SHA512
ea283adc9ed830839207b4e5e649aa7904e7312c447b1921934b3712e88e4f9eccb0e846bac1a81b245e0f2bd11c7341f6ffaf6d7f185d7ae7a217c9d1f5b0c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eafa20722d50a791c7d9da494f54b3c9

SHA1
3c597eaa56f024e8ef6f2621ccc438390a37c503

SHA256
0c9ddc0f0dffee41b9f6674f8eabf6c7b770e43a9163096ba75eaada3e7a6c27

SHA512
4f40e926b9492f74a55c001585b0ba53190122aa5b0fe8b7ce33268112a7a12a068bb2338b797bb3040d5d64ebe124cc52510f7ecc9f9a81b3fdc681bddcab8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed96297b0d10ce5af74720ee83c51d06

SHA1
696e4f3500ab244a155687369f2f97e6267c9400

SHA256
63c403632a455a88a17ed1a5caad831c52f3c4c32d59601e09199c98e5f67570

SHA512
67e75bf7826c31cd4ab8d8dc1e4feb414fa2c73229a7582e2d397118bab83e9699cdfede7ae4329746828482a0c9f2debfb1865ca7ac13653e8b82def5e6f5d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f6899a9c0625f0098467f06d06764aa

SHA1
0e5bdb6985f27917339950fd9e998c21b0cae8a4

SHA256
4d00c66e87d14e65b1e8087816308cae2a05bd0563829759f582a7d713b92284

SHA512
5a54896e359b537b61e5490bb869b146c4419fd57b95db440fb88ab2e0ab2e7f6ca52b92f2f6bd68091399083d7ea3a5715ce125cd6a54054978b6c983e5d835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b170715ce7304fd08b05164fe1ad2a3

SHA1
6888de86c132276e714bd9d5f824f0fb33de12d7

SHA256
6a3f2d49d8bc6b32a386fef8731d5a32d619310cc0e3016f996a6505fbae5d41

SHA512
89147e04cdcadc32dc2737562940fb948bb07f5c28e717b8a738e1dbca62edad41e1e5a8cc235f68f86eb24bd685a24508c6fc0eed8fb7500c76ae84dcbc922c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4bad9d2a69cd4eea9ba5a00c2662f4c

SHA1
761436250f3f0a0e84a8ec3bae64b53537ceda80

SHA256
859a5e8b2cf7559ca0d6321fb58d22a5a35aa3b35f0b6e89923f95ba22565397

SHA512
0fbf29e19468ad989e3df214eeb53566fcb11ef8527b41fd7998523dc4bd45f0ba583f6dbf958b7ce604feee8c03afa716db9800185ffd3ad7de672acb99098f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5c58e735a41b8b34237ee1996b16cba

SHA1
bf2f5c8d0a1b0446c980c7fc2715394e2308d00a

SHA256
5e0d377b3b1d16142dd3cd6d04fadc9975595c8a6e3a7748c7eacdab9e1a8104

SHA512
04d1c72a0047fcceaf592253451cb45ebf97de7eed47a0c8c7913f23fa51bec232a7692a8513869492b52dfbf8bf6414f55d5af99eba3b8f85acb0e9371cea03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A07.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AD5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AF8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit