9d8292ea0df702fc5e641465e9295dc9f7b482925633966e2afa4f02f0665b88

Analysis

max time kernel
137s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

314d4ad0de714ec3d97ee75c53aebb74_JaffaCakes118.html
Size

2KB
MD5

314d4ad0de714ec3d97ee75c53aebb74
SHA1

2c5f1e4180f6e025b9d74a591f1b1d5981385f2f
SHA256

9d8292ea0df702fc5e641465e9295dc9f7b482925633966e2afa4f02f0665b88
SHA512

10a26f9ed725f01316d2d68425a55338efd3e26741f97e85539952c44fa74f3867a13f50eb926c2516fa5ad4747cf60d1d2b005c857e6a202995c58b0175b955

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c756d427a3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ffe64d1fbba646cb3574bcf65d2cf477c6cb846854471f25a2c1b3563bad3e0b000000000e8000000002000020000000c91ce21b875bb9b4e9f4054279be783ce66309f6b77b1b47b045b9e970557431200000003d4c88a20e479f07a590ce899d4866539458ba0b432f22f59e07f20207d6c6c9400000004f293789b4d925c83c70f6bd4cf8701765a18fe7c1942c6681154d7b4db86371d1941210d5f31aaa5a424c1f9e0173cf8b61417978b3c1bc75a9accfc2cd2821	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD384381-0F1A-11EF-AB01-4E87F544447C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421541277"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e2b66ef82be7727da4a355b490cead9466474d9a6068c2a41debaaef6841d0f2000000000e8000000002000020000000204661418b267ef49f0844923df1db0a77136b055ee1d69389e4a21e7ed1aeb590000000f69e3197de8c127aced53d504282ac3ddb29bf6238f8fb6a08bc0d586741004878b90f6af2acdbcb5e2f682d921773af9803ca1df65b004d7a80bb9f4dccffbc7fbebbb32210ee377a57b9f14302e742f8d869ac0fe21831f6cfbe0e0ef864fcb6f5f6faac8cc53c5ee580530dff434ed5556a7ce876a7a5f0bd46dd71caef56eff0124494f7a669c023e7b2754b43e3400000002787d0afbcb8ac4c94e43b5dfc56b8f590aa5a13190123444afd6ba206b3654c29e0157112647ae54d1f13cad80f48292a3679e418b640f3e1841a03b49b4711	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1532	iexplore.exe
1532	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2648	1532	iexplore.exe	28
PID 1532 wrote to memory of 2648	1532	iexplore.exe	28
PID 1532 wrote to memory of 2648	1532	iexplore.exe	28
PID 1532 wrote to memory of 2648	1532	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\314d4ad0de714ec3d97ee75c53aebb74_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bec789a19fc28089ceee3f62f2d24e0b

SHA1
793c851aaa0af04d76f977f51e7ad085a3cd61d7

SHA256
ecf72e4d3738b767d3b6d54941473d01c5fdddfb22b2da78d4f5429b2e61c40d

SHA512
b06c857d5128a73fa1757b5f6e8ad030133366b304a9b5c055e00f6f01f7ede4bf490adaf1d03860dd8472bfc51749e7db9ef92fe040c4e900c698124d51b167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8622c17ca2a939275d2c83962294f77c

SHA1
7f5bb0c91028445837a11ff1d7735c18c485c3b7

SHA256
d8e42f0d9286df3dc483f820a49e416873669bfa6a9be4a1be65115a355ce527

SHA512
fa1e687b7143deec3cf8aa954fafc596013cd834d3ac643ef1dbd157aec99d3248f8862b3c6247c4518d0a5d811c65c3cb926f0787dee49044b503b793124f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ce49abb4aed1fd2daefaf306d924f53

SHA1
157cb64f662ef1f8d1d746bbb1f48eb16656397b

SHA256
b7851a66667c8ee65f69c77be5a0d8d4e9b430fd02ebcfe0b9fbcc7764232fd7

SHA512
95e0d5e447bfc2d25ec6528c1ae31c3b4857086b46adce3a9c99f25da8a8b8fe28ec45cf838ff737f662d9789a7031d8e1189536a2ef8e1bd566c6722b87fcf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
058841fc41b4da4bda74336bb70958ed

SHA1
f830bd5bf11b94811c6654e7111bd79d90a0926c

SHA256
d4cbb11ee55fb5b21581e616192a16ba0d46f7d513e7c4dcb56cf056c0d18a2f

SHA512
074c315d64766a1e0a175d16ab932aeaabe89866cbafbe8be6e54900b50ccef45f50507e6cc718b627c3bb3e8bf91c4a9709a6cdf54fa1c839a611f196d0be14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aafd078a3469e6100277e346d460a57

SHA1
665801479a466ffbd3a2f3bbaf4f642fc57aef99

SHA256
165a0195966636f42e18b6a662097fbc802e9ba6f0d1b9d197880c137ca8386a

SHA512
81b93ba4a303113b8f947e6dc3e6c3725fe94b9201a9df34ec596c05845cbae1a9a7c22d0dc60c245ac20dabed0404c234e723c7cbe6f7c14b45236c68b9adda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
356ebf97cceb0ff5e8c548b1f6437ff0

SHA1
cd5404613e2c4d25c40b2e347901f81ac0beb2dd

SHA256
abefbc1b8516d42588be46cff3cba8d1dd002ffcd5e5e14274dbd81db50547f7

SHA512
9942f95fb21a129a17e73be92b85e7ecf19bc27b545a06331ed5c81b27500f062e5db14d1a3a422cf7827f7d0d08612edf21fffd4a04ed745be1679b3eda1e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4291e7e00aabd91e5c7087fce6c9d34a

SHA1
961a249890356f9c4b2c03c2ea4bbb46ebc205be

SHA256
9d682dcfdca141c617ce573d493b70218789f543acd6bc97269610d3dd591f53

SHA512
31f02d0f7b04becf146dddc7a45752dee9cef9dc23cd702051f9db86060e7a94ce16b0d2463c2d02881bc9176836f50a8f48ff9e02568a049ef571a7d154dd2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb3933de2f74900350a374f510f207be

SHA1
67f242f04a71dab0b1d488bbe15e84a26dbe9425

SHA256
cabe35ed4603544dd744439c626eb29f6127f610fc53c3379616dc07bf6e5e08

SHA512
79c3d28d1005766b4af7f0f58f7181c2158d8cf9051471243c3f41796f4e8e03f85040f61877259b9077e8d3142b96374e8c62492fa7e86ccf6aff1b96d72caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16e7a9fcf1b37db743309abf92cfae5a

SHA1
d77ad3e22f03f2724c66b5875ad457ae825e322d

SHA256
a79032ee13482aa11716c59336bebdd4016b3e6e47b650ffb54d41c842da64a6

SHA512
e52449b9c89f05caa799f646479ce2eec654d954e3926f6c39672e98a7f0297c24d10362f923d06870a71c5c9758ae1a1b10ad393180c5745026d262583769d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7590bc1ceef7e45a6d402b1c0613b28

SHA1
844bd40b8a1ea4fa5f6bed8842a7e66c7dfc1ab1

SHA256
3629e0690c409522b7a917a2cfcb628a68c05b939625c4f5573cee72fa2e50d8

SHA512
3eb1de2fd818c07bcabf9c5659cd916c8c1576345c80ac9d4df628663b05620fa35b9ea75f223763fbd1c729d0207741f2fcb9b03cda291050fc5ba2bb79c139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
066a5d55655511da1db2abef457ff783

SHA1
b23fa957e0a3f6b6bd7e2701af615070d8930611

SHA256
6dcaa66ac48ae16c3c1341b9dcb63323bead822bfb56d0fa9f0f2f0face31b35

SHA512
450d2750b1370f6f8a46907b52afaeaebc15f1c4e5ba91a1d9b7e9069d3a7ffb5e56e18287af4336e94a53b0a026f992eda71108593d27e0c9575b1f4eaf338e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccc723e4415abb896e3babd79cb31af8

SHA1
375a64aa968fbc2d97d84cc06f546822827fe2c9

SHA256
4cc9f8259184bbdd4fb1be17cf926f11d6fb5b7c9564cc93339e8a6eaec31600

SHA512
a620d02d8867fdfa8b404690850ae2f3c38a95a95c125279f9e488810ea4e3c44791c97be28a36b906a6aca02df3dc14f063a2dc1eafa5f1fee3ead8ada6b132

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4912.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4915.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit