4a821d508ee9a641abc7eb89ae8b081cf716321877e479e5c3cce1a1998bc0f1

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

272d399c4c774d7403b86d21a4adaf50_JaffaCakes118.html
Size

994B
MD5

272d399c4c774d7403b86d21a4adaf50
SHA1

0257c71e1dc3eead5b8dfacde2552372e59fa5a7
SHA256

4a821d508ee9a641abc7eb89ae8b081cf716321877e479e5c3cce1a1998bc0f1
SHA512

67143bae4d2a5ab8e6adc63cc6a7f2270e26435ff17bb063687f7b3adb6a534b3f0a37d89a305f8524c36598e95e8f4f5d15900e647307e030b067e552cb816b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bcbd129ea1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421372162"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002eb5dcae3f65d02a54b7004d2baf59044cf984b19d5b757dde9c48e0a720ced6000000000e8000000002000020000000482b85987d98002ce577f68bd11ee5c330c7fda0f9b737a33c76bee8d51ecae120000000c9384a2d5be35de552f903e068bb64a5405dd6ae2e69aa809dc1e92332e00f9640000000007c5305c7031d879b48e886f6f8014008902b630cb833c54bdc165396c11afc5ae595763a9446a53a5731f7c0728bdb1bee96ae61678035c0026b556ac4ca4a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005272a8e010387fe78eb9fd904d8d3fcef2e5ef87053bbb9c4c2ddb418ef23cc5000000000e8000000002000020000000629035327b0f37ecbf075d8b09497daa991ab66bf6ca1ace3309c6bb9be3060b900000004da7740610b3a6051c89c6def12bbe14e74c007aa17915de56b25b3b14c4360e3ef739b325552a5e54c647b70edbfca08ff4cb7231e63fcfa1cf6152feece78a67bac9caf96c732cc6bc4015917d2bc18ca01282dd08615ed450624d5f57cb0940c421f2beb967421261090a9cc0ea6d304436cf1c75e07018ac9530ec05d5c9c6401564a78c2022aa2772b82516102a40000000a5f5f558b64c2ab6ae98a8248b10d64caf22eb20628f55530773132ee7155539dd153ec650f099b3ceb1b9baa5964c694d1ce234e08ad868369d2a5c2af7c9dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DFFAD81-0D91-11EF-AF55-CE46FB5C4681} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2660	2984	iexplore.exe	28
PID 2984 wrote to memory of 2660	2984	iexplore.exe	28
PID 2984 wrote to memory of 2660	2984	iexplore.exe	28
PID 2984 wrote to memory of 2660	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\272d399c4c774d7403b86d21a4adaf50_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
53855c059156635253d4fc3b9fd72860

SHA1
abea2ce3b24a4bd5a922191d83a0341cdca57d1d

SHA256
bef7727a51ce2e5a44d320f9a10e33a1ccb27b7ba130525ce016de2d9c41bed8

SHA512
7a8a80d1f26c34cf9184d783be3c48bd4e7412ce359c7ec527e433a22a105e9920ddf5f14ef7544c100d3c58ac29f4393a6e6df7cbac1b2f6ba99b9b1627c7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
61455561ed7b81dae21d16bcf1106f84

SHA1
3b8a99a3d07080ce7ab5330719f9deacc04d2d7d

SHA256
917d0f93239db305ff35ec91441a59c2fbf26b9624b3fa032aa863e596590805

SHA512
ebc62cd8d2110be44c5c6450503bac8a16400626db9833593ac3069b916ccc19c7b68b105ab7141a5b34b40bf5604d4dcda314cfb04a133409278beb5918eca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9a67d5852803a034c2ab67e3a98300b0

SHA1
22cc66ba8e4edc174feecd995601905878a4ea14

SHA256
c49391e873f9897de37426ff4d6f9e4f7c3f29e06a4bab9b74789edb5fdebd45

SHA512
c4e267cd99c9a401f192fcc42c53f11d6174fc167df4424bd56e277881314c17774399a8d71840a99b243def32795afe92972b256947388d11dd4db368fb6a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c5cb7aeac1165157520145f5d73e6d6b

SHA1
fcb2b706f7285ee5212a62124fbb3e731145e9d9

SHA256
3d2ee7370fe9c96bb04be1c385e991c036239a20adb95158674619777df068b9

SHA512
7d13065ad3102fd5b881ccbb3dd02fe5b189fcb5becc316a2d3509b8cbe417aa453c2cdc96971f8d16222be393f10fea71c63bb66a6db9e672045562c9517404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f6e98a9667d274af68568dcee9ea5cf0

SHA1
9f44150b7e3a52825acdb7255318264baa4902cf

SHA256
d6d6d627b171a0c910903d44a3d5621234079f13fd0a851942daaa2beb4c6cb6

SHA512
30142db51e6aedeadac0f99404a196095d3c0d1b52629809a9a978534cb77cf428d319824566d41f12a09593530dcb35e0d327186e405d43ad81d4c99bf3e66d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3f0cedbd00300e752ed20a6a9e2d07cf

SHA1
5987bc9281752569a0c6ab32016e7af620c11bd7

SHA256
8d568801e8d836b6f3e81f6313d7c2c9eef71e85e968db6afe6642e53ff8898f

SHA512
ffe40635f85adc1f35a435ace7837832b3f9e09ce7fa4947905353eb08949eb24a89090c3edfa777eef85994b1f578ce39c2db863e366aae08aba00110283a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9805b30239b35cf40c20ce3c0943e1e9

SHA1
fff8836d3d428b926333eaca52fac1826240ee82

SHA256
81e538a93fdaa4c1cffe9d272214c9d2c8c58483370c3c7f220b569419264ee9

SHA512
0fb5fbbd32014c0a4da0bbbb19bf74fa20a79948f30e951046f5426489888c52fbb9b0bcb36191ef637ea6205f06bb5d45bcaba9b2f78517f7fd0b3ec7ab341d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3a3a0331c1b983c906c50e6e08212a5e

SHA1
7b469c78d1e6eb9524123aa104698259f19fa545

SHA256
313e64a54688da47cd12d5c3acf404c8dc74c1aa7205734bfa1715928b595de1

SHA512
dd862e99a6b30c4306a303407e3ca456d6d8ee0508dbdc8c9d28aae501b38d3432f7e107a5116676c21de8232bf13fe2a3845ebbba284ed304137670da29efec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3bf8dda8ca475c5c03c7ab4daf9014ba

SHA1
3ac855536895f500f20f4b524fff9cef1c42011a

SHA256
d82d3419e0eaf2b4097b0d64e41d9d6733112efeaba20c76c6dccc4f83d55ab7

SHA512
1bd9e296749929000cd9213f1529031088e47a8670b8d3b85be162f8df15018889cb58153e5e533f09447ab966c69857f87d4980779800a19cc8885a5d271797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
11817bc2b38a7401629a8a346b94071a

SHA1
6ecd12a87180447ffd4c7262558a2a63c44f48bf

SHA256
b48d3d236cb674d52a8d37aa6ede323168bc705faf1961218d9c4b270c60effe

SHA512
48685ea8710ae3c3de5391bad0fdf4119eef12c75bd8de2b7cccfe6866c435989fde70ddd42e4e74e7dfbcfd2f4d97a58a121cd18657b91911a026d47eb0f2dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
76335fd815ed819ca44aac39e85cc57a

SHA1
6eaf3d1f35b77d04b584b5ddf6be7b37e4c7c45c

SHA256
7905c2a4bca7872a64af53111f8178255bf644a225defd6f2768675526628775

SHA512
8956350a46e421db7dacf14bf667449db93dc651b5a55c3fa17081f0820151e0d4de2d463394f28662ca105311bec31448062185fe331ca4ecf37d3cc571791a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
09ae8652b23a349b6c068f55c0154fbc

SHA1
77a3b2a6346350c87b10b9234a1d7d16a2495b2a

SHA256
64fd490b293fc06e3c9fa61c19130462ffae71faa2e7ada481d367e3f0ed5687

SHA512
df542c0bc9996efdf2204262859a9b6ff4840c95b0a819ac5bca81b46fc4ea52979055077b6de6cc0a26397b0989f78e03a77fcff860e5bf47c2a5e78389f679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eac3c0640b00be2e91e89c6c81401000

SHA1
3672ca095ec91b91837b187d4c45304f3d3ff0b2

SHA256
b54212161de89e75fc259d53b4fd6e2a000b06ddc3b8aafd4870f5d2a6d5c9c3

SHA512
021e2f32ce3e1f51dc1ac57ff244a9fb65ab4155a0fbf83ec2b5ade260972421f4562b2970fecb77d446d7a037358067dbfd79e15fd574bada5a68cbe34fbe02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d029a7c656384511ca48fa69482a287d

SHA1
6c83314f67e532136ed68b6ec641b2e5a53aa43c

SHA256
ce044331f816b9266ffa91f4022f45e10b050597a88cc3b83adb01a2bb0b57ec

SHA512
f1bb4ccd389a5abb3984fa01ba2a904c3c48d3cfab8f934663b2472142606fdbf32027c605199d653aa80cf0ae84498165ed3e5783d9a0d53353c2805c32e3d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f855db8a1eb51aa42b7fca0de057f7e7

SHA1
4a1ad2b6f0dd3f4afd3ef8fd56c68fa7fb1d803b

SHA256
57d5f2cf480bb8561112436293ed4807e822f621d839cc21332efdb42c9a6dbe

SHA512
d126bad6080e26addd74624e328f9014da86e27fcb354861e60a9feccd2a363e70a03a236a0b9ae7271105ba395c0806dfc2f849f00132f23cc4caf985d4adaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3881b498bc03d28de83335756a2ebfaa

SHA1
596c2e790ec9e4d7cff4f73368cfae43ec48d4b6

SHA256
bc23b3a875bd96b41fc4dbfd1d723f8677f15ecb8f3124ecaf9e10b1b0f3dd70

SHA512
15a900635989a06e6eaa959aae140c91271cac1b80cceb5c51a99233d378fcdbbb66cbc5f6170786957dce12edbbda364b792bd79f161e0acbcaf72238ef75e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab235B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar244D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit