850d288b009b6e90943e3dca041da4d2bcb171527c5aa81643382be96d26fa46

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20136b004ff2fdbd41cd0ded83478412_JaffaCakes118.html
Size

1KB
MD5

20136b004ff2fdbd41cd0ded83478412
SHA1

f72617c47fd77f7920f6372d131b48837cb9eaf5
SHA256

850d288b009b6e90943e3dca041da4d2bcb171527c5aa81643382be96d26fa46
SHA512

07dc624cce0b0a3b67f1bb7beab28d6dfdf7846b666c31bd8937d0c78f3dc9422beac23e5292fb9e3371984725e7a13ca40f2ae79d612f54f760bf35785f05e6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d3f90f5ba0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421233430"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000018c6bbfec9f125b176646dd100d5dfb0a2156c9e7731637cb0c7b641c535e074000000000e8000000002000020000000c13e3087e6afdf7fa8e82942f0e2b0d4cfc8b8b7cb667f9974472acdf8a41d37200000006808ac6dea20710689c6941874a626ea04577809c4b6cd263efe6e786a73f68b4000000041d246d43dd466e9d7a47beb47463820f97eaa472f1b5cd6c1de6726a3b5a46726a5ce1e213386f426cd57c5528709f8c65a9fbb562e0590f434723c361fc1b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AFA0931-0C4E-11EF-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b9c09f22c14ac1dc2fc4e6c703114b9754f848f6d813a895ff064b5fe9f36c83000000000e8000000002000020000000ec03f98b5da0b5d6f9e9c63d1b0a603a48c89dac41ec9acac4d8d17a044d52e0900000006131fff7f79426f832a5e491cf8025c464065bb6599e3e63ab7fafa80ab269c816157e73f350370343a5ce6d4975f419a28bea7660b5480ffea4b42b02e37f273d4157a26d13143295ec0929d27f8e1c6c0a223c85c0b36011396608cd1df703dae9a8f35aa47a8730a4af22335a00884523b7f12dc465db9298dd3c53162c3f0be6a4a2407f901cc0810aa4de6f75ea40000000ec47fd30dc990007d3307e27fd72ac0ce3eed5d533ae60ed8783b8cf9852bd2c2d13ddd33071de8dadb09acc0d2fbddf72501d6b42c8b1787777d3479cad1e0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2828	1368	iexplore.exe	28
PID 1368 wrote to memory of 2828	1368	iexplore.exe	28
PID 1368 wrote to memory of 2828	1368	iexplore.exe	28
PID 1368 wrote to memory of 2828	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20136b004ff2fdbd41cd0ded83478412_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d2ecb4ef7ab6e34c9c442e724ae68f

SHA1
ea48f4060fab8d702388ca4cb9f61d519dab3fbb

SHA256
c98e8514a12bc19d7ffc9bc04eaad35812364a78a133cc1941665060191cec5c

SHA512
8ceecf52ab068033a44509b70d00f7d84773325a2295c49078654d3d3ef0b61c4dd20d160684b524ea79d7d2536741e7bd1c70c6321f8b11a692b9fb5c2723cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e0514d0ba83d1e0da604e0806bfde46

SHA1
fe5f6e5d5ac3c9405f7298a6b9649a2dfe8b7899

SHA256
6d2ead0c44a3a734f57047de1ada32631631da4e99511306b137afc5fcaacbdd

SHA512
68de7ae0c5185fd139b76f4424239cac0d0c778d8f91631b0ed63832dd8624d1b5c9d41048aa2bd82234a429871f768b479c3686947e6b07ff9dccf965232489

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0026ecda85cf9a754265167c68ebb1c

SHA1
59c04a8e91bddea334303d3019874ac3a1e76f9f

SHA256
c69b513cd48b076f662470a872fe58a62a8c96372fbb8c6ae3c06ab665c5d78e

SHA512
cf6185c73cc45c7d5906528e09d39825d95ee817b96cd3cd4d41aabefdafcbd0ed537b94a171d59e1a30666d879c1183cb46ccb81044a37bc75c40cc5d877760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b4b616fd7bf9e7af9404c8fee58480c

SHA1
d6510e4616e4041a1b1544cf98c815c08144a540

SHA256
2d664ff5776d733e754660f739aaa4195c0489fc1b2a06c501202631446a56a9

SHA512
5999467001b99af093fb7870d06b60b096ecbf1de7eae4c4f6929f53d67c9d82ce27bcbe770a19b435a12b907b20c8960436b2462477aba551c4edb312de3c82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
993b611d042a5c282b33decabec91434

SHA1
fdf405d25c5d8a11ee837f6fccf5cc32bf9e549c

SHA256
7ad9f680e72ce83240e9833dfbc2a993869951b2d6f13ab56b07339b4950484f

SHA512
b806c145d4446199e11768436e1f0e3c18fe7064b560ad740e6c3a04845ba40fa3815aa05b3f80f4a93306af88642488a07b0738ea43e8de7b030a02285507c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb871b81f117c030b30633d42873f111

SHA1
2e4859e8bc0a4d604f0b6cbb74f2e63f9d6a045d

SHA256
62ade62089e44ba8d3dd5820e04b5095eb419409918e1b3a46b72a15d32eb2a2

SHA512
76cfbfeb04c50dfc09e50752e6fa827239694802a86155101151dec82021a21dfcc8e189bb156cf7ac5548e0fcc69dfcf72aba6f9f89579d7ba323391b65d4bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39458daeeba839e72f37a859ac341b91

SHA1
c5c1b3003ae6306536deac3630729a3a7ceb6641

SHA256
8b09b5a969d8d0b44d005ded265315433025cd4dab5da826c462fc15e3ce7c4b

SHA512
7510f012320ecfd0b3f784a9416d648c5853e5167da67c784ae168bacb11179e35f032067a28fd5c56ef261d4a481722080de7655c38bc3c46902467f3db203e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b67a5832eb38710cbebce5d9a031344f

SHA1
b1d41bd64e895129c1a828b225e63d56bf79eeb1

SHA256
cdfb422da1ca9fd73c5e6ab4e8e8672a88d71cc51b524e6634ff95c43dd9f95a

SHA512
a4423e3b8449547ef1d921834d300f57efc1904f8c24d27af44e342e07728f9391c1276289c9b78cdf1ea3ef921fb4f15d25c81a096a50deb505239d067cf44e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5272fb9433609db1c377743cbee49693

SHA1
64ac1a7f61891f6d2e4be504fec9c81bf0bd157c

SHA256
155616d91d7963c590b6b29f3adbb5f679d7b09534e12a2f337a9330150f105f

SHA512
bada240332dac81f674503efe35990dbe9017040fad856241f9596db34382f582d21a1452a55e9648cd50a1ba3fefb755cb12c3b577cdc98d3e379cab0e8d20f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9eebb175ae1f56fb570de46052d8ce19

SHA1
c0ca626a132825b02761e8b4e525bcd42a908acf

SHA256
c7e88f0fbf6a65e3355ab0dd01de77b531c1bb20255ce3965eebf48d4dd74825

SHA512
2f12ede71c9a25fb7e1b72fc00de6cfe30207759763ca0bc9c37f3ce7aae75c19eae3f18462516b572cfe23daf3dce24d67c49910fc8417fe6b320d6a864e141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
835e500c6f281b598053b20d189aa894

SHA1
a77c30242ab0a1f7c8241ce80184be17cd967556

SHA256
97d50d30a8c6f2439b2924db8eb5a4473c6bcc9663a58d778b1cdf05d4883b49

SHA512
ad5a4f82006b062b477509f790fe5579112090c8ee0acb35ad2939dd8825459e0099c54feea2614798ffa5ada089c4f5e4da1d06ad3705dc2e162ba4e34b907d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19c44c0139574597b4a9cc17f2e25c17

SHA1
b20c6748ba1224b4c92b6f644fac6446a64ae550

SHA256
90308fbc04c26ee51669cf812574329e927d69e0f436f2aa681478146056de05

SHA512
ee6175e6251e6fc4b039da4ee4249a91fe404fd384ea959e3c903873e5ee8e5cf36d56abeba6f108a69c0239e4f814aec801f651bac74c1d4b43ca094e7df41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4a7225dd3cc739e836b5b73a6aed8fb

SHA1
5d2d331fc0b0e1a49df4785626c98ac0cea3ea0f

SHA256
cd52ab78ddc685206168fa099944aa3758ed92abfbab6b1dc0b288bf755b8d35

SHA512
0ba98dc010bf3406fd065df0e13da28e529b275dd32addc3100bf55b359352652f2721b652009cdd7ebfbf7816cebce0c93fd241c79f0100fd47dfea21519a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b7db82073e26a495eff9ad44ac1012

SHA1
b66753e57808035be1ba1f838c68bd18a643ed68

SHA256
2909b5ebbbbba63ec761b92986fc58790cacc65fe0b80e88aaa017f2b3a64c56

SHA512
430291761fa865a078c34fc026ecb842c7e8e038064c5aa4a40dd98bb7da61caae6070f4e20132117185f3499e894f68d929787e3370d556f050deb027fcd492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e18139747ed2724f3ee0a0f6fe6a437f

SHA1
d2ae060117acfe514b46ceaf5637a9028cf333b2

SHA256
dab30a4b5081d97f7daa7c0c9ed20e35dcbc5ce145ebe19e8bec1ba65955c3f9

SHA512
335a8cdf6eaabff64d885a89f90a90218f935414b90f59188846004c391c705eac00e2831a481e826df79c045bf4cee01ad2f03baf978ee34ead1bf043037de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16adbc67adbc585688b9d0f84d658967

SHA1
6fe79cd8effe70728984390a7abefd18ddd28950

SHA256
3b4fa04f2b0ce545cf727a627dad6f077e2e5e7fdb8063928fc8b75bf65a06d5

SHA512
c4ddcd66937d9db27325473e4a91d0a2227824c629a6ee0ae9d2e70500e0a3b7db0ca2f6c332530fcb622029ea5cabe1d8b8fcf2e066b794869d670bbffdc7b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA278.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA426.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit