10eb27836331f808959c207f9ebb34d27554559d79f34581dc77a3a810a4e3b5

Analysis

max time kernel
135s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10b7dac014eb47702ce953c7d4b572e1_JaffaCakes118.html
Size

1KB
MD5

10b7dac014eb47702ce953c7d4b572e1
SHA1

2cf7e90d45a88a6ef8aa4305a4eab3eb2ad42fa8
SHA256

10eb27836331f808959c207f9ebb34d27554559d79f34581dc77a3a810a4e3b5
SHA512

428f4e08c4d91210dde74d794dd45bc3e45666fedd3f927aea6f1372a18d35fdb57307b13cf8ea32a9e0d2709c859967ff154bd6d13f7a3325c662840fdd3527

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f10102dd43fbc81d1e16b4dd06584074617e3225ce1347419511ddfad9a8a865000000000e80000000020000200000004d0cd884564941821f338613da9f4326534a46172bf73881367b52457cc54c732000000058290f4e9165cdad7d01a3722db5637a2425a9a217fd8e7bb321ca5ae39087194000000079801d3847afd77943cd5dcf28288c99158aa028ef7e81865645add97dd9c0578815258a814e23660b0e1805fd7b30e433f0d31d5b0ae1092973cc078784c3ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9A85421-0957-11EF-B54F-5EB6CE0B107A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000002aea6fa262a90b09ecadd226f09146533c093046f5cbbdfef6feb7bb9320a44f000000000e800000000200002000000048f264f1cd9bbfb959cef5709ebcfe53c4c7308294fd24addc524845b8ab649f90000000f033249a6b6899c0fb80e2cf46e2f992a0e484e65343f23971ed5cb55bb919153f482395e411510f412e25fae14a14350ae1f25a0314aa87bdaae92a6dc3e6953404639bea57c032763eaec1ce88a77d3c72f1156a04edfbd79e45ccf0e16e80437ace21013d522c3759eb4f4a4ef5005e5350bf297fd6cf554622609119a08b95360cad08bc0a644ba80581b04535704000000033c31d76dd0674eea28e7ebc7b215052d3d370847eaaeeab85226ac8f1de643453fdee8c9b725b517b20c38b4fe83b74d4f02b0e8611b5060b8a5a8072341733	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420907654"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b1198e649dda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3044	3064	iexplore.exe	28
PID 3064 wrote to memory of 3044	3064	iexplore.exe	28
PID 3064 wrote to memory of 3044	3064	iexplore.exe	28
PID 3064 wrote to memory of 3044	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10b7dac014eb47702ce953c7d4b572e1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2974ee2d18bca26c77df72189e2d993

SHA1
e5302edf9022b5a4675752f6bfd8d226418bb3d2

SHA256
a66258ccb96dff4a4b8463b4896a677a4147cfbe646f0d312822dd6a1df31338

SHA512
c4839f07adc35edbfd0d1b0c19ab7b4217cb9fdc93c4fe394d0e293d886ccd77f1d69b8b3b9956c801727345c2cde7051363f3fe1d2fcfbc0e17d8dfdcf5a026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d57f1fecfbfe6aa88cafc2db671e7ba

SHA1
52b42fbb0ef08d77fe407ce78ea99871c292e0f8

SHA256
9d0bc1909837210eee7064ec5318d8b56905838a11266f6a44b838d03036bf48

SHA512
b774bdc184b9fb1890e0d49d0cea036ada7a993cc1cb284b3b4909083feceecd5237ded7ce804b8d181ede2e209faf045ace4e70bca8c4aa0f4ae9e1a2db7ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7deff45acf0f93fa1f8c019af2f8361c

SHA1
4478226ece41e9ca8244400d04ac1a50069cfb1c

SHA256
ccee5f985e27c7038324eef5c6f06eb81621669c20f8bdbc09cc613054d17bdc

SHA512
e734abd9955514816e38b2759cefa0e7b54c7535b841a1c35dff05afbf5c134734ca2f1008f90e53faf3b7b6b1c86bd459d8e7f6e26c2bd80fed0ee7f29813dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61a919dd2a2cc5c767f73df848edd61e

SHA1
f7bb297c6717ef6ef051ecde0b136fe4184a919d

SHA256
0e175ccced22ca85b6f867d220753c2d2fffbda65b7ec9de98ad383d645a3dfa

SHA512
618d0954f0ff77fedaee44174f9b6221a2cc5fc3f9b33933e15f7cead35a3d6ba8a5671b782d712f46d67588850940812037b47cc39800774a1b85eda7fb52ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df6aed8764b25ac4d55f049f007a52a

SHA1
1dd8f5b1e89dcff3710e7d06f736fef20b129633

SHA256
b76624c7754784218360918b12565321dde35a8361db571a493ff6ed723fa951

SHA512
667ab131dab9e691ee027ab72e4391ad72e0977e87c21cb83868ab95ce31ff7548ce2cd80c8642fe02e5fd8f68ae8343852c651a637dc70ea95d1a001798ed4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d44cb0df1e9973f4ce382395be798b56

SHA1
29dc3880783ba37676957b1c4ba98b8ba5980984

SHA256
2524fb4d583cb85dfeb4ddf4a905fc1a0e7d8e4150f5da10d1bf20c7ddac67e9

SHA512
1aceebf0264d0d537c5cba021593aed1f0137449fc33da23fe49c00f092c039f323c87db82b6b3d114390fd4a14d7295eba9ba4524a8e9327cd188ba72f01cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43dd369cdbea500f31f32f3b6e4ad700

SHA1
f4e2b9cf87b79f4190f2635bf71148d18cf52dc5

SHA256
807e542523761013378e0e9b19e57e293210624aa21540c2a98b9df3b55a68ea

SHA512
447ed6b4e1abe61466e88ba8fbb18b77c40b2713583c1e4b32f3ca6e070da87b2b248145869cd68c33e4f688da2f8b67c478dc3715bc62add89b5901b7162e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81664c4b9e8e398cdc35e3624c66c1ed

SHA1
19034b5c867f092a8d7f8864aab5c2af09400e57

SHA256
2c112b65b02297d41030ac73c59aaec1d8c03205095ca73743cad1c1d748c7ef

SHA512
2b707b1d23ebd23d0ef94380366b1926a6aeaba4311b230aa962a0a441102f19908da77d5186f622fdb7fd58588a50e113f0da48da3d65190d07e0f2a6ad61cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f200b8aaaade41b9b7649e5f976b0372

SHA1
c51d04700a40b008a1a46ff36a42aea1a710c29c

SHA256
276cfc5a17e1d34b97ed12becc107ff1047245c924616584cb54f90f3aa85064

SHA512
e02d6de20ae915f207540a8b5481d121e1176c5f6a1acb033ea4584a7c75adab1c71cfdfcd7618ad7c06db53a46e72c3b66335cfb35951dd748b09320d06ffeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
831debe6b947afcf789a9f60e08a4ff4

SHA1
255034ff3f07d909ac3d729a8fa97ea826ff80bc

SHA256
8b4b087cfc7801444bf2dc46e33e0015c9383381b10009e578251c55a9a5f2e6

SHA512
0b21b562b33060d624eb2a347ff01fe469fa6ad64c6abc30c83f6337192f03dd4efeb78e441de3c7c11a07967e5896a1c74abb390636f217e5f428da3af22d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6576750a4251ba1c4b596651ffcf1f42

SHA1
1caef2344264a3436c48a88e5c09d1d7f7888cb0

SHA256
b7132c318c4443ccc76f554bb4e7ce64d2272070c527c2aae93292f43c295c2b

SHA512
0d5f8435c01ac14cb8f37fa846d9c5b5a84d6f78b5e1b53ce6f81a703f62744b4e429bb410a68cb3e9b9ceefac00a365d623ec85223d203f467133e09e184aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d7031746024e01f9bdfc84223db9349

SHA1
ebfeaa38df78ebd2ba5b11f95dfcc0725f6c7657

SHA256
16d8215abf73616edd8cdeef1d94e3bdcabf3ae41eeef1db8beef81797051ac3

SHA512
48288b7f1c0ac80946ef10fce5882eb028c304918132c3793b1f36dfd16f383e18a3143f2acc80555ad9c0b9c5678c0778573717f24b3bf69e0168f979249e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc11b2bc5a1ea722716c620461646f2

SHA1
0575a094b5ecc344b45b31994725cbdac8902377

SHA256
08378f352ba362c30bb6f1a7a9bf559c53d8d86ae2fdbd76d6937dc02f8432d9

SHA512
c50976fdf88f475d49d0f6eeb6ed2cbf94a796386e55b79fbf52fa838d4d80ea29a7b797200f833586c79a70572e5c2ab2c3256d751f5d08de5c80bfdccebddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bcb40645107645a2d936c3eb24fc14f

SHA1
6e0819657bb7f92132a7f716a7ae51767f5a8830

SHA256
1cf65c7ba64a732a19eff27bf144c3ad5709f1fc5a5add7b22a5b3557f5f73b4

SHA512
d89d7662402bb8bb61bd7197b8624a5c95c7c484b4b720f45f2978b787c42fd58ad73247a5d1068f08618354020d9784c9d4ccb74f71b35a4e9d1dd4415ca531

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E9A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F6D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit