9d6ed4495f546c45c40d5b4cb8b0924498e1bc05ef45d8abd0e27cc8341ce256

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1745119ec99560c524d883ff8b8c53c9_JaffaCakes118.html
Size

1KB
MD5

1745119ec99560c524d883ff8b8c53c9
SHA1

1fb633db3d9082c5c24d581af489e0adfbf8e37e
SHA256

9d6ed4495f546c45c40d5b4cb8b0924498e1bc05ef45d8abd0e27cc8341ce256
SHA512

790dddf81ed149909d447d6da25fa74390a34f49ca6c703b9fef1e358cb544ff992575008a85b231b55f4f1d9e7f39e2da36d6688baa0c514eef2dcb08abe4fc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421066986"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70394e83d79eda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEC20871-0ACA-11EF-8A74-66F723737CE2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d6de57f2c5e29f41904488c41d4b352a0000000002000000000010660000000100002000000012897c5e547df7094a857e594353d0f11c6093725c7fbfe01b7a8209d4a2510a000000000e800000000200002000000010d91c5935a8a0ae0a15fb6290f1e49e23d4af5edd33de3c6ef51af75eed7b6e2000000005aa0732d21366647839814474f69b95141060bda1630f1e387bead4e19a75f0400000002ac5e03023658294db49bea57a57c29d443032c8907db2b05b3f7ee09dc25c7e298674bb3fd47727b477a954e774d487ae6b47350afff381bdfadc544526622c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d6de57f2c5e29f41904488c41d4b352a0000000002000000000010660000000100002000000028e841b3464c8298b18f3464bbe8e63b4174615e3ca536ddbec9a04d479dae1d000000000e80000000020000200000000facd1008452cbb0af2b114650b6272b57638c366990686038ad68f77554548090000000aa074f0c896699cf72e1544824615c9ceae9776f2c438692cadb515e150179ff7dcf5d176937a780468f89d78108575b6da33fc5e8951bc8b533d20ffc64d7932c241fa4f0af025302131144f0cd8ea1f28eec3868d7be4940bf74258e6bc2c144b58bc4834a285fb614e592dfb7acc40700dae777ad8addb85d6c9c810f94286f05c6337e79e3ca167185f7f93fb8a640000000e914719ff1b536c65badf5508be221b687f5aa0e01a6c3efb106a8be41d5b0ddf76e8856126702a77fd6d7c85e93acb285db0dd895f556b1d854cd55005a54b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2980	1960	iexplore.exe	28
PID 1960 wrote to memory of 2980	1960	iexplore.exe	28
PID 1960 wrote to memory of 2980	1960	iexplore.exe	28
PID 1960 wrote to memory of 2980	1960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1745119ec99560c524d883ff8b8c53c9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6c48f5a2e1f2d8f3bff866f02d76caaa

SHA1
e2167539732ec0e21c753c75ddf2c5f394e38424

SHA256
8bc0e05edbdc18e093da4d7d5b8b5ca4fdc1be01082fb7f404f014abeeef83c2

SHA512
395f19b8ee753b5928170e1e823aea2f39f678fd555841e87b93a5e1de4e191af8296c9284dcdbeab9774e0f2f2fba1ef1c9b750d0298a4ec359b64306683263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec467ca33bbd72d4c3f4dc4de9fafb82

SHA1
847b46fa7a4e1cda5d6f11ea31cc9523e03559ba

SHA256
ce758bee785e145778de206a5e2af93376187fe6b6e1ae97cf649288b55349f6

SHA512
8cf5a2c86b478468afba0165f2aff434171c14751e778582d45cac3599504f26fdec13d96835c8f8b44920a0cd606f6c1034a5e992b5355794bbd18808e5ad1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89632dbd73a4ab22fa78389dd5786b48

SHA1
f8e79742f306e59dd7982ec0b5b92f1e76768d4d

SHA256
6a72a0398525b04df9290e88bf980fb08c5cbff45f3a5b6b45ca1586233bedd6

SHA512
135de42ac137fff869fae2189dae670e65e11dede1d80181c0e78c674546b29ed5ed46b11eedfaedd28ceeeee6fa80a6cdf39962c3f79bbeb9826a50407cd58a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7135bf93dc527901bc4fdfadc5f6ba3e

SHA1
df5277291e757422d09d51b1ff82e0ff03cb7dc9

SHA256
bff5fcf70cf9c5702efb9922c18c0c25e1b8a21940ae0f029034e33943269602

SHA512
132d105e1871a19f3ca0bae6f9c6096e5175a30a772c9e9cc92b99110d2682b620f1610f1bab3f9357581534ebf2113d3233a1f67f0e061eff9196f8f775c877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d93ccaf07b9defede15e0ad040c04903

SHA1
cd34cda693c625848c7b31d76576e35dbe1504d8

SHA256
23fe75966f585bc6fa28af66ae154b0eba90fbeab84ac9ce48c8228eba116efb

SHA512
5904236270f7a753fec152222444730fc8271778f90b4c5eaabf74d5b72191e93dccf6adc1b7642f83d4cd8f71909cae20d2ad735867376d2bdd9589f77994b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06bdf181e71ecde85ac069a206fefcf2

SHA1
e0b1ae383acee2e1445a1fae15cea62667e02ec7

SHA256
ba784fd3e1993333aa886bdf548a42c60be8ae066e51ceeb89b01b311937be03

SHA512
592a91b20972276617f9109b92f8889c82ff158e940af26b2d5ca29cb3c80574d3977020251acab118ea3fd23908716af7fc31e588709357c917ec3d899160ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ada38cbe8301e62b627332eebfd8f4e5

SHA1
69e0d1ea5a630a3fa0ea4b923e4c935c61dbd6db

SHA256
429d0ab7d9d4d912acf12d6e3f4ab3f9235dd7d8ae580985e38d6c71a495599e

SHA512
333b9d48a1467fc7b904a5ebaccfb859658ac2a5db942278979d9363ae2f06c0da288257232146092b7d9ece6a87e67420c3d6e5b119cd01a09d092e182a93e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f44b1bce0e1585133e8ef48237ec160

SHA1
5c99df703a12033866e18d280e10f7946994cbe7

SHA256
16b57eb0f32c96748969e8fe8afdaa6e72f7c8ad30295245168cc412ff41e298

SHA512
9cc16d6463c86d2a037cca182b0992d01cf7adccb6ce79c7ae6854b8d25b699ccb0657f9f0be6ab172698a38f6b0de2c21f2ba6b9820378a98f38e219a279b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d9770a3b1525e1647c5edf0b1472d07b

SHA1
191a9b4949bb9b0e30bfdbff56c6cfbbd76adc6c

SHA256
a76ec1e8bdafed01f321caa5f9b6d7ec9c80c61dd99d44352febffba987cd81d

SHA512
40f3b50e08bbf24820c4d1e4915a344843dd2de925aff0307f4d54c0ab95142cd559c2d4ed26b25b2c83f635fcf8f94bb94979e3fe16fcbb00485d3210d5dfe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E12.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit