c59b926f0430af8fdd092c378513af23ec72a7446c6aa3e4213b5049d800bc96

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

299bade765c248822a37c11c7936169b_JaffaCakes118.html
Size

1KB
MD5

299bade765c248822a37c11c7936169b
SHA1

94ba50571b338a935544d4c296ffcaa2c3240d78
SHA256

c59b926f0430af8fdd092c378513af23ec72a7446c6aa3e4213b5049d800bc96
SHA512

7cece1049a0ac3571cbcb46b13a7b88a42c38e221dddb2534b7bdba7670f91062cbeb97d645c1fb689cec78562db163096ffc6d9ba8544303594f61a7c86f353

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a73b01ffa1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000057cfce8eb82687602dc9a9f9e19dbdd5bf6746c864e0fec82a1cd708e67dc343000000000e800000000200002000000044016805e027f2ca7eb92b23f1d029ba9ac61155423bf0336dcb87ad3f24241c90000000911bd8814d82dfbd5025b0e0054c04ccf6cf6720b02fc3a6953118b701ce7ca6b822eb3cf6bce401eae83024adb11d92080732344e8a7ee8ff5eefddf8644bf6b0867e12158b69bad19efe0848300e305dbde4fa3e1ce79ca1e6b474ca0218854929fa3123be4ac62424e6a7503362c00185df44df82321ce8fcd7c075ef7e7121ff60621133881fe5499a644d81f85d40000000e15bf4df31ab2f0deddac604614ff0978bda32dbbf6604aa99fa4747fcffa09c11167ddb4781dbdda1f48c785706a5e7e5c022e3a87b9da8c7564a80836d3a08	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421413793"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C983511-0DF2-11EF-B991-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002979bb9b35d6dfb4ce2accc186f9a8bb899aa8da01b6f18913c9fbfd48b6862b000000000e8000000002000020000000cbc13eecb841145b60192941039711134761e758b9838e4e7e4c84c241ffe79c20000000fc15b8c61f3563a92aa98edef88dc2b32c4b708a596e183e5804a449d355b9f440000000e7172611109793b587b9cb00dbe3d74684be2616052b75f03f8e4a1cc4bc22acd9672ab4f1b5d7d124053cb7055f3d5dc77212c5b19f992e3845afeaa274b1fd	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2920	2160	iexplore.exe	28
PID 2160 wrote to memory of 2920	2160	iexplore.exe	28
PID 2160 wrote to memory of 2920	2160	iexplore.exe	28
PID 2160 wrote to memory of 2920	2160	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\299bade765c248822a37c11c7936169b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d075bdcbb7e5c94c1dc0f92a4a03495

SHA1
e253bb969a5ac0d6d6baa35d4bbac58e782e3258

SHA256
c59fe424ae357483565664c983ece25f1012673c64e4dcaa2c65e6fc0d7a01a2

SHA512
2af8fa950a78c90ea7dda392acd9c0b92d2e19cc78e1d057cc552b17a7f91a59b5c23e5fdf140667338af8671cae523115735f04a16078829ca7441b24e6a949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4ee340e5725b63ad11d7d9de25b9c8e

SHA1
62dd9a85a47708f17115e48c575ca7c1315f3e29

SHA256
9a67d4b3c7ab20191156045069027744cba5f5f5d26650e7588b921f6135c862

SHA512
f1557f211b58ff8c68c54c37a508513ace0d3132780c02f0e1aa0f1b3e81a6e5b36c2c7cccfcf160de9b05053c6cc005633eba8196cfd0b2890d4cc13f0404a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0e38c376d00a03d5285baaf53fd9320

SHA1
cb5e5111b42a2fd4f0c2818dbab60e9ef0b8d632

SHA256
9e14c667f6f2243f3a2c29330fcaef43380c15adf1c459c49004e78c0e226e9a

SHA512
909113c3ed0dfd3a31d4f58d0e14525c5c96f3616c55be6169ca7f273c833baeb925c533d2ca44b48be0c1f6330b1c694e840ca274cefa62ff2a3cab97040b47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57dba9ab47e0f133130862d42911508a

SHA1
ae674412b1ef574b54c4132b7996e465e02c4fa7

SHA256
aea4c60b479880401c7795b9c61af5737198df2725e1a91be0e3785768b020f8

SHA512
958d3dca96c8a88d63628ac195c59cd21b1ab014779a29a8a4c88cfa8de50b43ec49b61e934640f0e6a819ec1c2b71cba5c69eaafa907c87efd1106527fa9b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ad0ac58272e730f2e9eee7b9f1e07d

SHA1
05af7810a3f929bde9bf87b2bc56b9e72bb7a124

SHA256
eed9ea5fe3f664e9eebf190b3304b8ac46b9955a293c153b15931a5a630e8790

SHA512
cf93f3556f373ed532bd682ea2a3f76e81b60336051a70c72c91009435132f76c6cef441981ce17aca225aa620d8d2a509bbab840146d9e38f32719be4c02d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5480efc52ff934be94b192256a00a09

SHA1
2d6086109fcbe0c0ca57acf6c07c6b6114324c44

SHA256
f3b8d94ab3dd4577519156d0b52cf6b87d54a2df448a34a8f8fa21088902a825

SHA512
13dc71f74aa50ac2b3e477bb4f41f2d682155880f9435c4b2fb1ce2cfbaebbdd8955c942adb5fa774e97dce04c7a41cc012d05f593d03e6b6e1837ab1b0a550f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc674044215bf13b6c3c3fd79dfacbc

SHA1
5fe5f415650ce8c9a9f533fac30e81d9d50235a0

SHA256
1371c2ca50a4667b60aef84bf7416b672653c805622f0fc62b0686f9690e3ba2

SHA512
4e7960437633620d34ab11881a4cabf75707261c837b77b181156d2a4b2075604c7c4e42d97bf8a4b44df20044394287f939f92570a589324b844c071c697c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cd76b6904d6ba2e85724fe591ad2f0a

SHA1
f2c035b76b050b7f693339330cdaaa6e5cd9d43d

SHA256
8e47e8a39819713ca325a469383283938b93f90eb6201f778f6f6c13143cdb17

SHA512
c06b130827c3986468df2170fa0871bdfe1c4bdb673ff2b5ead99d843fdb33a5ee567e8dbc8092b13b6472e21825067f5e42517605de42f1306f57b235167cf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
858b9bac9e6e471eb4c96a33a8ace885

SHA1
d916d25e3875da70a60d868cd18064424134dc55

SHA256
085a580e5595142f9b9a62e02ee5e4650de242a349bca58fcba3e3caaad1b9b8

SHA512
929ca33b73817c682b9e4711c51a2e36d447d27df56afe82b19a9bab1e659eef76a247cdda91cd597aa3f2fe195a043a697286951a2034fde3b7817a239d85ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3abc319a0d00abd0a21a4d8d93e848f3

SHA1
f9fe5f7cb80e4f241b11164f7a4450c3a772d883

SHA256
96ababb75f032c42bf84806128564ac69fcec4fd8f4efc5f0dadfabd237c766f

SHA512
d8511269f7716be63e4cbe7cc764c6806e0042d60e4e5ee5690789ef0a2672831b2558e864c0df693ff4056a35cb015c5fe6d130b5a98d20a7cd9c3256868bb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa33b6dd5ff6cee986777a231ba17040

SHA1
a52fc22cd76b5a3a9c4128d954a2443c8cd10deb

SHA256
14fd80c71f3f904fd553fa7388a5cb9b4008a5e1a821a51fe7346a9161c029ea

SHA512
9c3ef7066f62064e932ccc576cf2948b06d94d7dc85ed75dd9e73a3f232c4e779d95ba3385bf56dbbf03fd9bd5b15bdd5ff95a9e2195480a43543cc024776f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64db796c70409b6222981a817f0faa5a

SHA1
6a34465a5ece31fb4097fcc88dadebffc7547d56

SHA256
e606692b82ab104cd804b4192558d9a0d305032a84ee503a99439de261bf39c7

SHA512
97363245d52c7f3d0b4829446a1327be4140e1268b0b17b872aa55f536a16d0fbb9cd140b3bd5ad7fe8719942c1fe96178f89962001a8949100004c868014704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79bf2374f76b9cb563d7a79a1a8a6bef

SHA1
17d58faa034eadf43538c2f1ff36652625ce8c38

SHA256
a371e0c8f40792808403b9e5677eb39a6fc853f6fa52538c195cc7f7024ae2fd

SHA512
531331ea9583945e24f468f2906495c63f145d5df5b8aa62dce8d29a9dc918a46021185914a1a4a64e091c58248608a720348b9aba4119c170f0b39e3c43d918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e257465fe4a1aa776df6d79ae519bb4c

SHA1
aca626b3b7ff4f15802ba1db7c50264a9c1c84a0

SHA256
48968fa76e13985b8999b7baab27a6d3dbaa0f957e71dfbe041ec7e4d6f3b9a0

SHA512
796c6688c052b8f4682a0d3df8fc3879db9680e81626d039be02498604f034c1a31b2a4427dd841f864443efb08a7071b710c6b3c60f78c9844b8eeb14aaf830

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26DC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit