1a92f03a7b2f12a0a16a4fd9688c3d4e9870059ac34b4b73589681a9f9ea8763

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24a9c5143a71c2d94b472886c42d079b_JaffaCakes118.html
Size

842B
MD5

24a9c5143a71c2d94b472886c42d079b
SHA1

1668f53ea6d794c281c950da9b418ee27720f38d
SHA256

1a92f03a7b2f12a0a16a4fd9688c3d4e9870059ac34b4b73589681a9f9ea8763
SHA512

b43d2007a91bb8e1062ccb01699c9731d244d4e83dccb640133d74597d3ffe4a453c877e72a9cf99d9376af5947714e2e6404c5b696840f59ea7fe173a13ebc3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06755a93ba1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e79597e7aa4c410b2247d3c7e61cd22b0eb4befc096286b4483bc9717bd1db72000000000e80000000020000200000006e3bcb35be2851ef157bd041169ce0c3f6d202063edd00e567a2123e8614b23990000000502417e7a025c9576cf5c67229c4fa72000a8f0a4065a3ea1de152f764cd36ff17929091458fb7ba9c5000974d7f2d95726289efbb33ea9ab1fb7d8bf3a015687f2fbd15a9b2651b3234208374bc188004344c1994a4b0f972d1425ba8e1ae0915c72abaf39abb2f98358e66e30787f332a6d30b059630f4e712fa18b9caddc3a21cfc822b783cf837d3241f6f82f4104000000021fe4ea9b4dacf37a247c918e60e2ad28975608bed78d87ce91fd6543e3f42d44c8b36eea891a1968f72704664d7b07abe7539cf754e8079eecdbb9c7c5156c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000432d1e97803b35a5aee0ce9d9bc28931a2c15df0d47134dac2faf815ea947060000000000e80000000020000200000003cb116ceafd136e616ba5ec02ab7a13d84003d6e9951ba8d48f1a61163dd6cb720000000ba6e228667c9b59394cc41e24e62e7f74d5603c8de09638f1f2d569d176b2d9440000000890dbb42c795fa5939312bd4ba6c61a6dfdb58f45010a19c57e48a96425c52b4400b0b8ec28ca4e5c9b7d55854c33833d0c1244ea2e13bf5cccf4a605ca95c04	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421329896"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4DC9001-0D2E-11EF-AAE3-46DB0C2B2B48} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2172	1740	iexplore.exe	28
PID 1740 wrote to memory of 2172	1740	iexplore.exe	28
PID 1740 wrote to memory of 2172	1740	iexplore.exe	28
PID 1740 wrote to memory of 2172	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24a9c5143a71c2d94b472886c42d079b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c616ff9d3cc77f77b8906c110bb67f31

SHA1
b5e50c47c6fda63cdc067ec0c3fbbb53ea540ff5

SHA256
830a97cd2c1f02cb834ea26799e5e5cdeca49749aa64163fd864f495638e62a7

SHA512
f178ff86cc13c4700c914e9bac7d779fd47b33825aecd67e6e5d032de4087ef745b67145e2575a7035383dede33e04f4b0ea5b298760a1c49d34402b09ae91e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fbc4e80cebb159bd493d1eb9794a1eb

SHA1
381fe03c4e56ca5f149bd44e2a6cf192099c2f00

SHA256
2f552eebe8af789d9f3072bd0e99af7a7c675b37159383a66b7231d08dc9b10e

SHA512
099f141fbebb8d9996143644b2a63509c5dee03f03fefbaaca8ff324ff3cb12ced315ad467f81f125a70666f6e0ae84d39753613c0ce32cc94a213f0cb6cef61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf64793a75650533cd523f0315e34689

SHA1
70773e1cffa3a0273a1785831ef936f82c0289c7

SHA256
5011f8eaac288d96671f36b49a48b4953b21d1e0228617b0d0bd143a0221b6e1

SHA512
1772f7165631f5eb2b27b3f3cbfcb5066a179bd03daa4740d4673c4e99e251297f08f3db237dec6c8e72b179f3b00b889e559d3d97875b5745bd266f85ee3b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
738e7aca264c4adf9f3f87b86f4d6db0

SHA1
11ae7b7558915e52d449ea83ffd1a37a547ed9a2

SHA256
b4aeafebcbef2706e51716a155c0837588123e52bb45b1ee0a0a29a56a45f58e

SHA512
b5392437440fa836ea307f8a8841a2a3dfd95711b5bf983ce2f0f7c38d31496b3ee1451e7f9df24aa4a9283261fa4ce316a5ba063f531820151b3192beefa5d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cae50890d558ad24f47e029147d4e9b2

SHA1
ee4d06a030190e4dcb8abeff7352dd91af2ce968

SHA256
7a6c1a76ee0eaf5fb40caa3b1e3db93b0925a4452a8bff76d954d96a78e4bce5

SHA512
e46d1eb67bbee3caaf23db75aba3b1a1abc9be263ff529462c890a9b12a4730b2aeb9cfd4d8de4d951a7f560efeb5366afdd7687a6e9ec386dafe984abfc981b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
061f4cfd35a3af977941203c49898482

SHA1
5efa832bec45346e2c22721bb96db612dc1f932e

SHA256
3615c93ea212292068e2ac36e534205e9680402939edbe07e3f866f229d2c880

SHA512
80be3eca7cf25c460b0e863f9f3a4f5b60fd9a98e5baa3fb79e79dda313cfc2ccfd3f5d66d540d6d07e6d82c1638fb00369151c1be7a09bdd62de0a35af31b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3eb6459348763e34ee97d51a82a1da27

SHA1
e36ba70e97a6b847ac8c5d2687fe1d669039161c

SHA256
b796a8d519d9546f06b2c78ed43e8dc3c38933666f4f7cab8e1f4625a6ea8324

SHA512
45af45bbd4ff999bbf0a956210d68eabfee540dc12dac510d5ad0f9127471a442c72531313a9e47c05f148062632d2aa98639ab972437d6a9cc8bcedfb3d0fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3fbc42d2a0ce97173544f2d7e66b08

SHA1
a23291c65beff73ffdec818b0d748c6e955b8ba9

SHA256
755ec581b9083c245b43bf2dd11bc6d3087421daefa018743b9ebbb9e3f1eef4

SHA512
aa2acd4a4a3e014bb6b366c84fc7f74133336afc37e8b59ec2ea4dd89148573e5a0202da9dba42c7e812d820d2e069ca4a52fc892127ab3d24c9cc1ff5cb8909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8d96b8e4756f40db3cbcf5af119a6b1

SHA1
3c552c67d0dbdbb76a5869407686e255cabc657e

SHA256
19364fe43db8b4b05338f033b46f5254926d122beb47cd831647e390d555c0b4

SHA512
27eddfaa09d3d550a1f52257140e9cabfe7988da0983545142f1793a09b950bece9fbd53aa665c716c49170b8f2628f724498dc512570a24a795fd14f35dc0d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ba103a8eb88f69984d0f8cdadff227

SHA1
31eda6aa6c5dc726bcfbc80465b524c3e77974d7

SHA256
65800599a7f6a6d8b519ee3979734624618dc92b5540963233f261e7b01f1abf

SHA512
4e465dd21888251a7830c7263c509c2810ac53e8a52f67343d2b3cdea36093731a1db7372ec84ce8cd3da807f4737c82001aba41f54a3d34c08d7d9b54002a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e875e1757f8405a2f3c0a800b88bb291

SHA1
d06628f65ca905656c72bc7f2a36145553ed2c3c

SHA256
041f7ff01753c9e184a4695a615551048f6cdb24d9efddf198502fbf5e848ecf

SHA512
0df6d1c4305e1d8e22f62d92f7ff64ecf8454202ac6aa03488249c1c7e681c6e22d810dada4b3fc5133731a9a2f0f2ae685f72f43020c9a7e70a9fc5865177f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47e05fccebf3df4cca7cb9eaa1805354

SHA1
d8faf5b65ec7bafbf7cbd458c41b284c24b93599

SHA256
7d25f73be5b00abb8fe6aaa17e67e81eb00ff7fef6a8cf956d4d9176a1dc27f0

SHA512
5ffba2e479124751b3179a9a92db6cf1fd0db64afe34ebbdee46f7826e38c3c93fcb8f057c3d229f46bf25d573eec0c1caa6efa6e2e41260d6a49be87ccc2266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e7a12e8de294a67a29f94249c148cce

SHA1
a63d8f115315f9e1e59be7049b608d797d633d95

SHA256
480f747db69dceb466f2eb818b33a3fef078f6709ca2fbacd83e79a1f709d21a

SHA512
d11387186d0943b5fb9df2dfc674098214dd5a098787f931e4d0b9a428e5573beaa92d307c5897cfaf909a07518dfac8715ee3b1f7231e69a07adc7906837bb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56148d90a66650f1cf73c2732ed6ac4f

SHA1
aa9b31609c2e26b35085a1ca29788cbffaf930d0

SHA256
7ab668f136c8422dbcdd1f28dc4d8ce19d4f5fdcba577992ec1d45bbe676f292

SHA512
3f0ed9cd1a96215cc81fd5d4c263468793c9132d3aaec3c3141d2fcda8470284e4b00e28a3bd25cec09cfd31a44d8a2f8a08bf508c164327af2da2cae33fd9f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58535211f316b56d6b6248d18725b186

SHA1
7a53e212327078fef37ac6d1ede3c7364b29f5ea

SHA256
269ab204e6c91d084aa92aef3609eba859fdcd2e7ce57403181ea032ad4bba1d

SHA512
aa7229f769fa71057f9474754098f94fa3b20418889710a2250185db8e4caac286608e616b9e4a8f36c930c0b514acb014365fee8ecb15a9e2c2ab4168ba4752

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38DD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A1E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit