d00f9c8b9650d5f13ea50d2f60b4ca26975f8812ffb5c7c1b22a83943ec411cb

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f97a26aed5172c4cd916a6c360daf43_JaffaCakes118.html
Size

969B
MD5

1f97a26aed5172c4cd916a6c360daf43
SHA1

bc0966b747b136fc0bab6d8b8ecd3e53d3ca3de1
SHA256

d00f9c8b9650d5f13ea50d2f60b4ca26975f8812ffb5c7c1b22a83943ec411cb
SHA512

c0f02d2e08676a4f853e0bf0952d8f72d1a1418c8c22aff5a91d28b98995194bc4c69d58e5c7535b3c1969d834e48dddeebe94793d890b98a820bfc0683ec44e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5275F131-0C32-11EF-8FD2-F6A6C85E5F4F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008c957dbfcd494ceb52fd442ed4e5e28109b89d6e276099131fb50420342e9699000000000e80000000020000200000006f30d699251e72688c2dd81a731b85ae380e50eb2f997c7bd543e661fbc3356b90000000a625477b299ff852452ec89fa0688cb183baa6451977e06c9d4e2ca6c683ca6010c32f407594aca450837983d7333eb81ee08ed18de02171888c342a0b8b6a10173621c5e8c7579f159ab3076c10fa1062bac7852a0e017c67ea5a6040220b169c8752f35375bdf49a0eba56037b1619677d9d6999eb6c880cecdbdf0647ddac42600d4c89d6031f438265c9c24f62bd40000000b6741b12b0a05452c65e8cc8e74c0466c6cac0a4b930c7358a60c3dc8b9c62c90fe83c4f7357ee3353548827b3e9bda49b4dc0a1e7fd5e6cae866c6d1dda97a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000b1da3e7fd211e8e3b2cb83fdb1bc1c585907913c9380cdb83ad783fe3d6136cd000000000e80000000020000200000005c83ac34c0a15d2569e493fe59c538af9e2959b6d45a1a2b169497b61affec8d20000000e4ffd9297dedb6d99efd771ffe41c61d981d05312f551fd9678385cb8d7a91f540000000b1c0a04c41acb3db1f028e3cb5082c71171f70cc076badc4fdb4ecee48895f15b2a2e9b1441c8f611432fca63e2a0b4c1288c953e12cb287dea18f94e9ebdaf5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d0ee263fa0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421221441"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2920	iexplore.exe
2920	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3028	2920	iexplore.exe	28
PID 2920 wrote to memory of 3028	2920	iexplore.exe	28
PID 2920 wrote to memory of 3028	2920	iexplore.exe	28
PID 2920 wrote to memory of 3028	2920	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f97a26aed5172c4cd916a6c360daf43_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98d0199959ba6e3de3f8bfbd55289a5d

SHA1
50f9c9cdbedaebe48d10cbffd60164b9fe135b24

SHA256
592067e73c2a9ebe6fe3ddc9ad0467e796d91ff224a265e9fc5cd0e239f3aff5

SHA512
2dc3b4565ef4ad91e53a00c1aad3c612350f75ac589929124f2f459f05421e01b0a5bc2ac176cf016813901928106731cf84a1cad05dfb68cae3f358006a785c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa3a060c33d20b7dcea99ef494afc983

SHA1
764e0a89dbc44b5c6ba9735c68c4a29848930e2b

SHA256
ca8996b39d606c9272647efc1442c2d2da9b5d2f13aa999d0046ef4919c79e58

SHA512
b8becb3880c076fced07fa3ce7ea6f8977dcf3980ac806b84efb8a49a90aec89d04481d685ef30fd2ac9d9994044b064b54b6fba658ca1050e1ba130489e4587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f6a542474e01bc783f5aca25546f5a9

SHA1
89d81b8e597044c66e1983e4f8dfca63f04abf45

SHA256
ce6ef3de99b6e77a4dc791896f71faf06d0f8d4eca1978fabbc2f52c981fd5a8

SHA512
b57e074c8e8092c7bf54445d0b0c238b7878a83e5542cae887554b48d8d4f98c0c96760f9b249088415c076c46d8a9f6895c7d93010550ac17021421cd1a822c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bff2e2e6108195de1e530e9213c04c38

SHA1
843c94c0166b8f700570cf12c3490bce03170217

SHA256
f78c3054dd0fca923b5ade464fb42c9a76d63bd289d66e59535e07942e9ae000

SHA512
9f3c05198fbb2cd04905ffa8f4163c24fcfc610d6cb86644f42133f1fc27c3c31e1af1753fa481eb079cf6b4b65249446252bdadf7fed4a9b0e321c677fe7dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
888abea4681880d674eb7764a30ef8af

SHA1
bdbd464f3a412d5246e998bf8bf4d928d1a2e027

SHA256
55cbbe2e93669e66bf2aab8219e66b67abd0f19dc1b54529e8d3a3b474970b63

SHA512
19914f2c32bf1b09e8dc9a447b1243b66be13187e32694b500b67d46200074b65deb7f4400631da85de6c715ba6c620a8605074069d61847a49eb2cec26b58a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0c3f505d6ca947931a9f1eae155633e

SHA1
e29dd712a8eb9dfc3bfb3ba6b486ce8709591b5e

SHA256
e93b9b73d33e8a85105a2d64f0d9820bfd1f184d3bb551d0d1dd7734ed96ac38

SHA512
8100bf850aeef4cc6b10f4768a3d5269aeca6685e02c6d95fe1e5bf79c8311fddb6aeecca1afddb494c8888b039642cc3966440513ccf3634943e3475c169a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf0abbac414b5bb6493e013442c3c090

SHA1
e3035a319696c477496f97305192c0bf8cc38e39

SHA256
d90e16ac89a6ce394083f6e695af066b028a064e9da374d57f5c6251e5abe330

SHA512
ae306a7d75c8461f73b71b2aeda4a9792b165492684881f24badd8c00dc7a7a2a7db55bdb5331e45c969b741cf7891945d1273e0cda49e961f435fc46d97d76a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
781f0ee685a9386169fdbe08cd34190e

SHA1
09340e510633ac851e5bf91912226fdb53da9fd7

SHA256
f6ae2e2794ec7df242aafaeb0fee84a5a4e6138e318624416c34f19a9122d5fa

SHA512
44692314447bb531b3722300a7afabeec7d997274b625264ec8d5ba9999717bdffa0275ad4b69057a7bdbb3e70b0e92d3c7187332f3f2a1347291daacf02822c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b309d7bc76029d400e20e64e5b06eed

SHA1
9a955ad4b0886c2195532542f823a9f8cfde16b3

SHA256
a863df8b45685f87a88749f499f99d9fd4ca02e868037409928665c5cf735077

SHA512
a1c3dcc10491ac23ca2e9864c6aab2eead8a3d6e542f85f7a000da21928b5ab0c3248b0381e600ebbfecfbc7d550e80aa22c237a174b21bca188662664fdc789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7263a7dfa62fa2b0a8d5285d7104b983

SHA1
0105d550cbcd4e61a838d475cd6228640f3f471e

SHA256
fb3c81e2383c0cbfe08f3c1bb9e19e01bd6ff35cf4c239d21883669297648003

SHA512
3f402519a16196ba05b66ffdf395c15da8c9a963938fe63d9a625c72cffeed306eafc4b9e6a060910bf49b21a9d90bda04457ff4223412fed4ceb5eb5fa7bf67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3bc5f796062d6a6d898d6abb661e148

SHA1
029306f2bc293377ae09326b16de77b442d4258a

SHA256
7b9574caae5602f03403e7df669e9d768b041cc3a65134bbf4def32a9d75883d

SHA512
edbd234f14e8f3c6ac1d410c95de0636a02e589b66458d8c173b8d0de3e9396c982da32ca7117fde427dba8f5782e4f6e1b00b6b6d25fe972e402733e2dd2b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63255662a8879e4a1c05c624d7c0c16a

SHA1
6b5af456f96d4709694d4f1da1b945bada0f4a9b

SHA256
debe5ec648d9130361701b0187dea8a0bea790513d539d31da6067c4c8ac505b

SHA512
8d31f15c41076968216f4cb119da33c6f16b5cb1e574f81754fd2f21fa6fae4c85eeea705f00b0134092f93c2cb6a08d76baa8ae3125487d3a246dee7fd090f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e53fa7fbee2d8b7ed28904434300a43

SHA1
0f75f08ad8a52a25871606adb59361b541f35166

SHA256
714202845f3d7374eb3a1b105a292e2c175ffeff3ed436f9b8f0fbe068ae77bf

SHA512
be370266cbdfddf066e64e25135c0ffff6d4cc48e8597be5f4c3804b175eab83419463816ec3fb3ee52d828701771156b322a90f625b06da09cb5041256e3a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d97370afb1cefb1c9b4de7e871ed75a

SHA1
cf9682f418db30b52a2fadc2b4891de4677884b0

SHA256
b53fe1fdd7b7603f98104c17e5856d0decd7069f56250b39d7ce0e889442b81c

SHA512
7351c3bd35d0fcf02d1fd1997995c9d774a2053473c407e2f4976e32d9736a02d82a4ac2ce59ea8da06a17568ae9fca43950626beceb020dfaf59073d5a97106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5c580070f8a26b0c624465e68171d0f

SHA1
a639a1ddaabeb47672a8cea7f5e05f084685bbad

SHA256
be2e119dcfb46df12d50f7a63d8fd806150f6931d703b6ea44583e7ecb2ae750

SHA512
db8bdbeb629db2c0653b67e47217681e85fb9dce9fe975da2267be75b6d3b7a24cfdfe0ee00d723176b031a4afbbf2dfa48e0cae6563a7d6e08236307319dafd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2a329bfec919e0a1dfda88c128b9be3

SHA1
acd7ba7657607899e224dc23737a64ea30ffc075

SHA256
73bd48c25d4cf8211e35b13f8bb13f70bc5d20cea4015d08fc7d9b014535752a

SHA512
18afde7d383a6276fae247ea813d11bfd3214b59d30c26200cedf6baec912e79ab3836e80d2bd2734c664df81a5ed08747a0ca39f9c00041f53203270fffce28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a933de0e44cd4ddf89767da4ef580d76

SHA1
8f85a82aede894d60196e301be9f22e7f56025ac

SHA256
852062d09b6fead68abc693d7b0259274563d7ef06c6143e760494a5ce04098e

SHA512
d659b71d2e2f0a6f91a30feebfa9f40efd18e1b42533becd8591067fa7f4768ea6b671a9b55e8baa0124d775b4933068ee88f22dd3f3fcfb1fb9afc62c0d39e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D79.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EA9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit