db62d6f0d8162a21d4228285af69f95e598c67028b936cc7a67abb88989fac49

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d2222cbe0d1eb233a204a19e4208cd1_JaffaCakes118.html
Size

2KB
MD5

0d2222cbe0d1eb233a204a19e4208cd1
SHA1

33a77768c48b06c5d74c728736bb8223f7ebd4a2
SHA256

db62d6f0d8162a21d4228285af69f95e598c67028b936cc7a67abb88989fac49
SHA512

525ab713850c76886f285fcb49ff06c6920e9af56736e0769a933c1fbfb3e344ab184ce5c7d4254b45920f9ac4edd31e2b936ed3117c78f8f24b342efb087b04

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20185bea319cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420775951"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d4fcb744831bffde30d8599ee06d2ae9b9fa674d9b2a0216a382dc43ef508a8d000000000e80000000020000200000006d302a3df675d078dda06340961bf548e8fff95f2aefba5501fc740fdff4465120000000a5508843abda84f5ab2dd3efb024cdfb03703fc8e8f121ade13f1b0c5a20cc72400000001edec80416ea8ccc7327b6bf6cfd713d386976ca80533496464de0192b443060f6b2d69235f508227b6489124be30f546c41aec4bffbeeaaae4ab788c79b06e6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15BE0EA1-0825-11EF-9F9F-D600F8F2BB08} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009eae4c1e2ba7bb81afe778d17ce383db420c473e17b8ad8ab09172fcea2dd7c4000000000e80000000020000200000000bf08986799a0a4d07c31344a5bd51cc230df466abdc244fb26b27d1ff67e0ea9000000012c041b74101e520618fa7c3ace0abc92397c886154cd8c464f04686d9a8752c12e412190a3eab17d4038f56088388eec85087bb32f7239b58d48ebe021636e2725bac2191cc3e6ea4635c85a174fcf5311aa1036491b257b1194ebaced2d99ef50d7bf6bd88620784dcd90bcacbe49bbee9450d56e0f853c6819ba8c8aa54b03a9697c453e8485f241d2e12d3f2df3540000000b5b82c1d4f69c092865644e0d527ff2c58e76e05a0045fc835d879114953dec33b17b517818083b2a8b72b26f1f4db48984cd8b0ccaf530077529579df73fc8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3056	2424	iexplore.exe	28
PID 2424 wrote to memory of 3056	2424	iexplore.exe	28
PID 2424 wrote to memory of 3056	2424	iexplore.exe	28
PID 2424 wrote to memory of 3056	2424	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d2222cbe0d1eb233a204a19e4208cd1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fab4032c10f0b2e36b0191d73955c955

SHA1
0aa7dd19c71005bfa877a7196603835760d1ac56

SHA256
f665ccb02b5a3c1415d041e567adcda1f2b50b7471220070dcc749f127068019

SHA512
7cd5871b9c171589375b5bfbba2b0820b8c2627c7b5ab7bcb2add6f6b59579ef7214866f33c92b410083973d1efefc9bd4d5066acf27860a9360f7464e619ce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4a7b19d27b109f569c0b352f30d8cb8

SHA1
1732e116af90cdee183516ccfbced6f11d624bdb

SHA256
907e7aa5ed3ae9279e19b56e1397f7c50ab233e7f74a9388a8d2d4a22329e3c2

SHA512
b57fdadece71de8988be209bafbbeb2ccbbbd1b1208c52aaf14f49e2e58cca599ac3c34e5918513f4d2bce6f8b4f0db71ce565184fb0b3633269c18c4ce085e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcc26ce17efde98a86575a7c24808c57

SHA1
ba1a2848b51468fbbce6242cb34cd544db60fdc7

SHA256
770313ff19b8caddebd45f54a9ae745291095c884b0f74497848e9679f766940

SHA512
1a82f3cf007380c653bf2a8128302c2d9b10eaad7397d7df9e025b536251378d8eeefcc0b3878e088f64a8de32c018253ed775a7b518a6ecd19a19bec6c9cb26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5f3df31bd832b68463c7bbfa8ce6e10

SHA1
3f03a1587a39133580145fad3b207e675cf7f87d

SHA256
bcdf3b5da03753abca2dd0c16d12f89560ae99695362142c0941d333f2e41edf

SHA512
56474ac91e25b12c1597be371c2a37d3ddf6e9946e0f83e3b935913bec2a3e5d0b535dbbf8ba85ecf6632984959b1a05b5cc7c2865c5e14af770e2494a027715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
949d50e4552de0b2c0577a6a619cb535

SHA1
d92f087060ea649bbb4ab94623f27ffbc6a5f138

SHA256
ea2ed0c0ec79dcf126712ffc37ec3d2cc34da497a486dbae566711821c9c62ad

SHA512
a61620b62137b9c3fca5704bdd91b8b721a1b732763f75082cb0ca4cc76aadb0e4cd0e49103b3f314f8f4e8b8c4a7795b50378bcfc3ccf8ea935b3f3b1559f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e63276bc456a99e4440400acace3392d

SHA1
d5032c106799196570526139440250d45fc7dc7b

SHA256
9568779a54ee88b7d1f11e37a7e9462ce15dc7d07bcd3571d9418c445071aed2

SHA512
40dd51c8d04aec79969ec966fddcd5b6a3beed81bc63f0b54299ffbbbcd305e02c10c16ca6a0156703e313ccdf17201444b18bf11f7be38dbf3836377e4190e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a3fdc40c925627bf52244765763fdaf

SHA1
e5da343a49ba7c0dee0da93ac7e4fe318da6fc83

SHA256
a745e69a2c9b71979e014d2e5c339f822d75a3e90d5a3d72f28e403acb30371a

SHA512
5d173809df79cafa3100efa6bfbef7ba640f65f4d7411f078dd1e1bb8d52fa4ede6eaee9dd631380dc99cc5ce63cb33b07bbb1248f7ab20294f986a89cb243f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
525aa3b2212ea54959aa8fec5166a01f

SHA1
52f60c4188e4ff6ae40712314660c88ec852006b

SHA256
3659f2ef890a06fcb2b22da7ac044638687c596089bd79353c17274fa2387922

SHA512
a309c80d1e0f097e0e41c262bdcf2a4586821861f3b20b77c72472b3b4cf364fff0af844366cbe38e085c2145cf909aff01facbc50219c1fa1b36e54c16808b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
032dae4c7a3068447724b9f55774b932

SHA1
92c68943c3e859d5585e6913c923d26224847640

SHA256
25b6db1ac1906f04f562870fa57b3191e5f403e12d840eb51518814b5c7c8323

SHA512
4547a8ed89f9323e8eabaa82442b2b8b0b49d5d7340ea5e775cb2b471e48873746a944164af8a3163d2b4fa06a151d9cb1aab0b3a197c369f5daed4431c84998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a33eaf68aa42cc439f948662ed658fd

SHA1
923bdff61915fe6426692cbbcc46b7ce9b3d65ed

SHA256
85df7f271f129b6f61038202fc5e9085f85c3653bbd6ef9e9a3e55eca11b4165

SHA512
8e9166a5aa316494c71b40c73613b6c631438a332ec86905fc54ed38b4e2234feb71874d563fe9b239ce7026df1ab2af2623f54a65554ffae311ef516568ddca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ef56ef4fbed978984161113ffdbd391

SHA1
334ef484a65088363a7b4cde8f962eee3ccca7f4

SHA256
065c8065e1c0e44c53faf741ea130683c4cacee10a2316f95013ca448d6594fe

SHA512
d87f3889fc5fe2fefdfbdec5a041676dc7e261e6056bece20e5e6054d73db1a31dbb3a158d61096964f43e1ead98ad457f51a2cff1b7435ad9fad30b6689bffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2713.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2793.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit