ee0a3d9c38f77a5880aad30016fc068a4bf42521f3741f14c62409f7a77b6d5c

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e87b77887f60f76ff64c6f02bec2bcd_JaffaCakes118.html
Size

3KB
MD5

0e87b77887f60f76ff64c6f02bec2bcd
SHA1

35d94de3a12d6aa2fde5c631b2335bdccf8dddc6
SHA256

ee0a3d9c38f77a5880aad30016fc068a4bf42521f3741f14c62409f7a77b6d5c
SHA512

f1c0348f6198b139e9b7e51196afe2d20e22e82bbe07afdea59b4a26dd8217e6df13d7004438f052a357478635f08eaedeae7e137a8d5e80744c8910d1d89232

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60237ff68d9cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420815486"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013e1f04ec6ac094794dd0007f6866bcc000000000200000000001066000000010000200000005b779ac9fc544871593e12d9b140c652b9bb62fa97a90398a824f7633c40f865000000000e8000000002000020000000df4e4fb631921965a27b62cd41135d230fe9e37f757437d69a5943d2f9cbd3d62000000031f50d4b4e836511c46a950b91d80940e1828e5c4755b0b874e1663911a3f27f4000000066d95ac302b959eec1c5107b08d9e3af057ddcac11dafbe3343eea066bac6b514e66c8ef35d6dce047af0210beb101884a586e0c07fe2b254910cca866915214	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013e1f04ec6ac094794dd0007f6866bcc000000000200000000001066000000010000200000005750bb25782aa5c5cc99fc6180525f8da09c3f1790f0e76899d43379c93b7b9f000000000e80000000020000200000005334effbec46c98b4a5c3c88c7a70794699331ea0ec52b0a415b7a679d166aca9000000070b0fca126e06e166f68bd11529161cb79221fe24f589c6fe449f220a2be965762592d69c491f303792cdf87c24f4446eb4cb92462502087af8a5907569145d2b05e26aea19dfcea444407dff9cb72884d70b22e010e9d7095b1f225066eb047050c73433ad35770e0a70db33a50fc1dbb5e827facd4dbab58c7b8ea956e70d56dae9b9f72bdadb89c48efe2bae2dc324000000070fda23b6ff2fa52ac16b16d6e47a22534392d9eec26f89ae87417e743a4ae3eb5bab429e71fdca52fd02627257ae39328cc8cafb5b7bcd14e9767c44afc310b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21D3D1A1-0881-11EF-910D-CE7E212FECBD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2372	2232	iexplore.exe	28
PID 2232 wrote to memory of 2372	2232	iexplore.exe	28
PID 2232 wrote to memory of 2372	2232	iexplore.exe	28
PID 2232 wrote to memory of 2372	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e87b77887f60f76ff64c6f02bec2bcd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ca90977f042ab2ab6f97e6840fecf874

SHA1
1d1cbd60dc84607c37065ee27fe7c83ca30747f3

SHA256
8f4901f600f60946d83fdee599419a1f381166f4aebfa1899ce75697a593c43a

SHA512
41db7638521cbd8ea7fdcbd8fe29915490447860bcaed33ff68a09fa10ae33861e93bb68f5d330fdcc4f8d5adcb72959499bb2227b53a33c27b297f061c4199c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a664240b0b5987663f617e5a02dc8d3

SHA1
a07a884b626b0d1b502eb010225d4579b0e903ba

SHA256
c82e0c1ff98f183e7960e8278474755d9e6cd300283d386b723145a54a77b7cc

SHA512
dab78d35ec0412c57bec823dc30bc5174a9c7f39be8dc0b8b11202913b37dd2cd9f75dccae46a3a196fd5cfa9ae0ab07131bfc80fa6897abe0aa06f872db814d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62ed79f90ff1ccd2238f91475ae94e5f

SHA1
976fc63f9673ecf11625a0d4ddb49d68aac0e5ca

SHA256
ec778f182ac3e14fd75c2a3ac05dc9ac7bb3d43423cdddff8688445307e83b3e

SHA512
a8e9207e5991fb4246f5def6577d6a72589ce5ee474b32d6c329bd268acdc54dec38faeb877b9a1f058cd9bd6b380874b6dbcd895a344723c9f2becb0207b979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
698d45e96a33643b3f0acf95615d89e5

SHA1
455b7c27fcefa494a7b35ebc258a27fe7a252723

SHA256
efc95cee8ab19918b3cc4bdfe2a3ef9f47cbbbede6dca2b0956a10c564d125f8

SHA512
74fc65cf78746fe344da5a583ba05b4d90f2f999bba5bb1f7f1e7719ac6bd8cc08fd9c8964234325f52ca9d4510db97b20b3fedde0c2d2240e10cd4e816087b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
372b9923af765c05ac189fa08d6dbc53

SHA1
bfae7babe65c02fcdc9d307a8371e1e700fbf369

SHA256
78bcd2757f14d73871aba3e8eb4dbaefd447081a0ec15eebb07fa0864ec4c68f

SHA512
6334865feba846b75a2eb808471571de128cc6ebe917ec6638bd68f8dd4fb40612009022c92049893da6c643001c78a445d21ff5d4cfb37a58a0cae4b8e9ac92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6741d4c601a4caabf0b48ece04925ea3

SHA1
ca1de17aa2721a438a6681bfc23d92793b3dd570

SHA256
b7e95b0925855942ea07098ddbd49c8bf6bb0a6d33ed54155376d2a3d4af0458

SHA512
448a31223f9a8d2940e939c4a5e5c55f8696f3686747f278953b2add747304a3ae11ab7d496ce8eb6a8dbbd5416d83f09fff0f78eb9093de29ce3d145339e0ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01f3cf573b64bcb6d584e7c3c709f138

SHA1
332b7de8e1723aabbe001b01047a98fcb4bd7f2a

SHA256
c031ad3555324b6317e0654c3102d36e972d96cc65cd7936eb7877e5538a375b

SHA512
ae4661e6fd2ddb8f24abe7c4244dfb0c834dfb3a55ac14a249b6f4e54f86c39ddfa93465eea9fd4f5bb037ed47a0e773e1c33323c8f492896e6f0347b30955ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7911304464ca6678b85de56024ae44dc

SHA1
0bb530ba356ad90d0ecc42a8152d4bc4f106dde5

SHA256
c1e706a61d7c45b587f49206d4ce99d0eb5e806c45c7e32f306b0168fce827fa

SHA512
752db3de95b75728f41d55ae50f6749796ca720bba59e190cffbf5b61b71506d9ed27c3fd0fa6912f83ec200b96dbca94fce2fca2f84d77c9991df57e2ba0161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bce57bd69822753dab50af21735ab24

SHA1
90f32ad10b57c198012dbd641569d0484b5e6770

SHA256
ce74929c694c6e5c355a240da7e1777bfbf320bb6fbad6d3982cc56f87e60018

SHA512
87dc31511f5fe05699a058a82373362b1364bc68ff0cdb93f3286a1eaa98f54857284491732cc86e66e40c87c1a7d91786570c70604eff672b24a1396e38b38d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e336a6386a6876ab09faefde0cbe2b2

SHA1
50869548a0b27f37b4f87af8e2e711c1840cf1b4

SHA256
a70a92652ba606ef474527e3f6b3a4fbf69f585017b15aff26d62bca293d0b62

SHA512
85d39a30e9f6409be55616b842e28096299e9209e1ecaaf06bdafd9d6817cd7cd346312107539b98c6f7a9798ead3652a5ddcbd38fc79bff173616b43915255a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
43ce5b1ba9c9d4a6aff1e8f51e39bf81

SHA1
89e3ac1c35ce3a72c8d6512820b116e87e28e320

SHA256
1c8c8d72054ee3077ec43456a1ab4dce4720dbecea017a56b75733598d03b443

SHA512
f90cb04ba9c29fc6e773caca94ed4259582e60c5bd38f68eaa542161201db499aae467b46ba792be56ed726c313fd0c22f1e11f035a93a2a156a685664e84631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BC8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit