11202e245a105527b7359da10a1fb48aac213fc40fd3382625045fb975b3b027

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15985d437b38ad6a613aabc3453a2eeb_JaffaCakes118.html
Size

2KB
MD5

15985d437b38ad6a613aabc3453a2eeb
SHA1

1dc87fcdbced2646b2cbe324d58e10ab6b794458
SHA256

11202e245a105527b7359da10a1fb48aac213fc40fd3382625045fb975b3b027
SHA512

1591ab9bb0f99dad5e25d5db2125e38b8453560798294432fea8149cc58595120da05a5e38bfd3cfa72ab0785e255ee02b7ffab483ae988e6c554c1a80fabbe8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000038fb1b5f9127f0e2ce2c7c14c99da73d272a559cb2ce315dbcd6e83eac534c22000000000e80000000020000200000008d8baec779328d61622fc3e39fa03cd4e80d84dfa77a443695d0fec5ab48fced90000000643c2466e3138a5e463bd7414be1a4c0d8c7785cf78cbcb9307d04f0842e728fb1185b7b4f20343609baff3d8da84746febbf5d65ed645636e7e46f7f2af69ca88e2ecd0320999d3ec554881080def588e3fd114435817aa28efc15626b64bbe67dc277849ea91c0b9693ee33e61eb59ceb97601038e1da36a09dc8465d029f0c933e38a175c26b29b66b7e83fa6617d4000000083f24ec518558f43e0ff446b4f28238e321ee7ea5137a8d293aa90bd96ecbf71589483a7632e950d86f247b9844545b7ad265ea506fd3b197fffa5fb6a39454b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000001b12654d09c73dcbe17b962ac650d7b154e17c71f38570d138a2bcd950a57f3f000000000e8000000002000020000000ca80e5aa29936c4fef27cd997d20741c68fe608221bceffefb2a09dcbd9cbf6920000000277f36eb861c1f5858d46c9215f1712b4e2f8a6d7edb57278c71708e631c4431400000004c8e1cf924f04a92a0491293d1e772991784ef19d98b5874f21e5b9e1f39f473a227465c92ebc17321a327284ed8908d1f30a57f79c0ca8936ba26f87f69a1ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8B16111-0A8B-11EF-A7F1-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bd2ead989eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421039990"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1256	2352	iexplore.exe	28
PID 2352 wrote to memory of 1256	2352	iexplore.exe	28
PID 2352 wrote to memory of 1256	2352	iexplore.exe	28
PID 2352 wrote to memory of 1256	2352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15985d437b38ad6a613aabc3453a2eeb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fd076b71ab87c2541100bf05e62cc44

SHA1
a59f965c795f192c543847018e2932e5f54d0aed

SHA256
8ffdacf5faed6d0d2728da796f39ca33546efbb4a388581ce5241d537da98fe5

SHA512
da3528c964cc61ed281ab7e9cbec57ecbc3b8d233b720113c63462623299859637ac69c495c0581de826a0495cd45b8ba2fecee66eb9e9105f60b678d4f97c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17d46ac1e7ea0e5381ac7229327a732c

SHA1
365346a3e4d219c5b5fc2030a47c0b9cfba0ff06

SHA256
f2ed963374e6f604c4445ebf12c8a1adb8c2febfa4c8cc0b87773b8bf4360e00

SHA512
e5f950ca12a46a070fe2114e4f1bf59d9c97f378b348fbbabd581edf14b73876908fc6f34303180e489494b33ed712e51d7ecc07378d79e9a524b6a72bb350df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0ae604274c9352238b5764fd354da50

SHA1
7f65a5524f635690c22a14d26c9f1631c405b5c7

SHA256
edb510dc4f50e4dc1d54ea99170d7771bb89190098b23c9b99d233a9acd8795f

SHA512
64c07c1b84e0614df99c768efa2d9a98d6783bdc71864614b35e943ee02edeb0f7f9b1f83e429b9b3782c10e2e3bf5b702f655e1cd3d872de94e189efe92cde9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb2b48ecea0f617496c0a595243ec3ae

SHA1
aa0631525e027918e1c63bbd9e3945b7afceebf1

SHA256
f8a98d2d269b233465619f21ac2d5b60c943b5008114ea387d91ef18ce255b67

SHA512
8a9df0afaea243c41618cecb7eaaefd5240d3262f04414d096ec8854bb3a691361ead1af92b8158239bceec5a4a35ffca342ea41b3f4f2c7bccef39060b332d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06a57a391b0f6ab600961c9473322deb

SHA1
37796ca68bd84ff43bfbb5e3849e78fc798a9a0e

SHA256
380ad2da7b37e0286b7fdaf513851335ffbf0a87bec634c9e2687c4497893972

SHA512
0a124ee268f9dda4405c4ba2c6d6dcaf9da470b8130b9e1f9a43e0f13366c4a32f855ae015ce8f8db2acd41cf369a50c8d69bf40689acf5c27dd4dd3643adac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23ed5cba3349fc8b6315d08b1498608b

SHA1
625a93fc5502965fbe188cd390fd56b24a4177b7

SHA256
e95e4fa036040e9a0efa90cc389b7706a117be3d93bbdb4310dc4cbbec2d608d

SHA512
4e1cb1c1d671480d4f2029a6a91b5b4d558bbcf8f75db6e8870649aed45bcf0a12d8b1eebd577c74e4b89ccc87febcb8061c7c9294bdddb9d0210f1b28a136b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59d712624526b619536a16ee8fdbe2a4

SHA1
6e1da05ba96eaa2a34166760ab0d6e79dc100e07

SHA256
f46376a657efd95520379e5a522ae307c2b90b636df4ad6fb5fd96e9ffb8ed92

SHA512
7c0b341124a72009e409c21d6173bebf428706f857b44281db265920988e321161dbe9c7f06ea5f6ce4f4b8015355bce2c785047df939c752c1b2ebf5d04a335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce793c3f47fb793741ba1a08eb9051eb

SHA1
99a934d0053d21ec28acbb8f9199bfee5e7c1150

SHA256
798d135eb6c8e79f6779f1acc37950f74cf7d249d9f6d988a9cc41dc5c67acb0

SHA512
65ccd3d0ee12a6ef61436ed320c9826978c8f48fce42d03e9585783cbf5ee08b5647a92ef7e7fe4b701e15e454558721c900a3a5174c4b14d82aaf5f84637759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
138dc80b05535d2cc58380381b1b5c4d

SHA1
6c8e9d7ac62fed4a1bc87ec2cf60d0e4e4e0d3d5

SHA256
f1b9cb219a6dd04095cd683cb91e320b67ef2a9de3253c7947c466853860791a

SHA512
1ecb38dfcbcc2799350144b3e03d26ac49cae694b0c0449d2b94244e5c4c83c53039cee87e40332f801ea1b5a3f7301707e6213bc432a382cd12f9ec89bece2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d625591d4a112ba9dacced862635760

SHA1
635468257cd22f4313102ff22dcd784c938c2776

SHA256
5848fd8f13bf03af9e622ede264bc086e367f2ba3d2b5c73c9f6e1b10a4216a7

SHA512
44a8c361b14e7bbad7878bd120697ca7277fd1b9238ccca4afc5d4c63e2f11b17f3aceff789fd75befaaa433eda3777ad6315b446287c3fbba1c303f1344f785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
096e3edd2c346ccaa13d4807a59d208f

SHA1
871dbb80b17e228f089bb574259f9e764031a52e

SHA256
e54d52cf92a999fcccf0f65a4f14ee3264a97f6c3a850cc71e6a9536a41c6add

SHA512
fc8017797820e6373ee7ac68bfc69c259c933192f96bb1d8be951b6a7aaf212e9d3f124dee9979994080271b67c9d17d3ce6657ae429956e3b1a258ccc9b1df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7540a59ea6d372f955d58af94843080

SHA1
6f918a4f2f5b92fc1e991ac7933e272d231dd338

SHA256
1ae9a0a646af391dc1e0c18b63807bea0a6a2b680bbf5787e84486fd38e48b60

SHA512
3ea0a30213591f5c32d6ba096626683310d5299cc12e1fc2507a2a24c745ce8fd9821d73f93be67927204d594270971b20ec4ce7bef85bef35aca439a68b2083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ce79edabf18c56e2539137a369cc9c8

SHA1
777a830310c08db1dd3767bf72a86b99c4adf16e

SHA256
63aa8b9ed97a927200592f2c26c6e6aa2832a0921197648f0898f9f546ab6b6a

SHA512
dd21fa81275cb42221826b576f5a418bf34f11f4aaec7ea2d3c6af63b5709c8ff4754ebbcfa1f844b9ca464fb98ece4fcf927c4c4926bae623dacae65f35dc64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b2bee5159cc53f2363676255ecab6d5

SHA1
95765bd52797c27951b2e46b5a9c6e56e58c68c9

SHA256
62a7c9928c5f97ef2277b4b5b093681aeb2eb59191f47f10fb444574019838da

SHA512
c3fc800893afb8d278944c09f0ee4f15f8756d43d613b9d4f9d10db66c7c002880ad3076e8cff4173bdb2eff936909bcef7001cf424ffa9c892ae9c986033d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88222b35954631b331087e51ccb79fda

SHA1
3d237554b1c400eaacaefbb7afb9b5919349ad35

SHA256
866fdf3064b1015ef91ae6c5547b29635ccd10c614529d8a1057c01c62691d35

SHA512
ebe11edc0bcce0ed4422540563d8803e1e05bcda2e35d3449ca065c20f338c38f57f1865b5923948020f181ffddc3f835e4c75d649db9999e95e53069dcc7d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdb87366a830f6595b06c5dffe5b52d2

SHA1
8b2f35235ae72bc9b78183ddf18b85420f9fc0f4

SHA256
65c050ab31b999266366751d031d9a9d0269220e6e85084dca7004d70737a082

SHA512
2a639b4e367a4eb9c538662c0817fb9bcf61769276c87159fa7da5f8198901985dcae0cc0e1f96c4f9d12e82f43c8e9787cb62fd302e6005ca6ba6afaa492f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2530.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2602.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit