00040b97c5c45a6018d98685b8454cd18570e308a267c7ee4535f0492b63c6ab

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3081f342ef262b8b59cbc0b11a5f586e_JaffaCakes118.html
Size

2KB
MD5

3081f342ef262b8b59cbc0b11a5f586e
SHA1

ea902e8bb9d3c91e1e3e0e0c110395bf3e33d796
SHA256

00040b97c5c45a6018d98685b8454cd18570e308a267c7ee4535f0492b63c6ab
SHA512

51aca13264b8c59e599d8aba24a8b4b6d12b6b6063bf779e8fb7a6ae17017ad2f34982710b329f20d48efbf2926d38907fe20978307033ec7ffc9b23a980815c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08a2d4a0aa3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421528590"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c67641491a65a61afa37bf5b69e3e33797ff56338f63ac42fa66a0e834ac5b44000000000e800000000200002000000063d7d41f9c7de1f4cead7c3039273386a3a7b208e1ebe1f4ab1dd296a24ddee0200000002cc484f66471ddcfffc3bef4b8869122b68ec1031af52209ec69d0dc320f2c2840000000fe4542a4cb1f1be029578f9edc9fcba640202cdd24ce5fa602266b351ece0874e0785809734a9fe38a06f431a0bf9025b93f2052863ac010cbeaf5d909d8d736	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e8839db5d0529bc3141453c505683afaee74094605d007104e129b9b44cb635f000000000e80000000020000200000002a6fdf6fc1f54965c892cf67b349a3fcb27790ce71d51ee96b9c05916334528290000000773e841946253daec145f30e00f18e047430b5639cb1d9a031d17e642fb857d066665ad75f5241fa7a4f8f0daf5f3d3bcba8ce8b43cb5cb259ed0a217cafbcf689297b1da8a0970762334edaeb9024066ac0045b0a26ef97737097cf70d76d9f985f9335029288aff7eb04d12510a26018a5e2820abfed93936259a3fed27bd521a7e1f38d6a7f64d9090ec9cb165e17400000005fd562865d6d75b50fd37a28456094c6ec878824743bfde6f2a63952b5ef449e3f776f9bc3e5867f7eadb2fb6bc75e46b6b3502d94d332b56080a4d42e731ff5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74F2F911-0EFD-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2164	2336	iexplore.exe	28
PID 2336 wrote to memory of 2164	2336	iexplore.exe	28
PID 2336 wrote to memory of 2164	2336	iexplore.exe	28
PID 2336 wrote to memory of 2164	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3081f342ef262b8b59cbc0b11a5f586e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5779a62dd83fc23942cb0b7ae135344

SHA1
96e7138b50aa0dec358721aacaf54db7beb74edb

SHA256
fa2884a5fe8639db4ceefdfbaf0a46dfc55b1128d58de09553e6550d7749ea93

SHA512
70f8819b703971ed0210686ece0045a974cbdc8648039d9c02521195bee63ee59f3a39cbfef202bc57da8a046dcb877c898a2d51afca1c826853167aa0c70ab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a25b6c9ba26119f8bf424414b16c1066

SHA1
3aba409b91388e7ff37fef139cfa375bd1b82636

SHA256
48f3d5ad48e5affe00b4f5addeeb227fea11aff6f386b8fc21ddc0b4257587e2

SHA512
a880cbea4be19559a306483bf47af0bd984bbd11843fc1b7ea64b2dd131c32346e53385e5156d1aab59ebc708ba7d16db3f1a5f56ccf872885b78e7b53ee4434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14755e78331e8e2f607437b92e9efc6b

SHA1
f2ca2a94f04f34d91f55d8637a064c495d9401b7

SHA256
8450e74758e0b464faad656df1c1e6ae78773efe62b12331096dc15d615f32f5

SHA512
4725aebced882dff1c172f7644c409435dc78395330734e7df76cfc9d8cccfcfb78ffd66406e0ed56e36f74d875ad647c8ed31a964e4a74db406c279778495cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d94561ec8feee260c1fda493eb9095a7

SHA1
826dfa41204f89af828e99040e05052612c37023

SHA256
055b1fbe06bbbf6bf050cabe27320f35b8ae1286513df46c2a09c4e83f9d1739

SHA512
fcf0eb068900c75844cab87b44d9826d87dbe287782c5a2718b673f19b6da52ae16a26ddde0c121728d267a85703b89bae32f6c52776aff809e6ff9afbcf1014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8d40437cdae572a62832cd62291e579

SHA1
729e1ec6275ad0cbf8ffc6889085014fc29033ed

SHA256
332ef035ee9077147098d00e502121b0bae127ed8eadc6e0d458ebcd9b905f53

SHA512
06cb8ff2aa9812c73626ae23076fab9746de97a27b7d73d71d1213e224f3bff1e02caf548a1e52970ec015b65d28b1791bb78f9a7c8e92fdcb05fb232810980e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bac0f770d8235ec0655f94a0ac67a6c

SHA1
d1e2e42d8c42ce78e4eb080e5d34ee0d7cf1ec89

SHA256
04f0da1fce6e89f892e34e61c527f20c76198e040a50e7bba14b409b346f78e3

SHA512
02751cb4abb2064b3433434c05097f1ae6c6e000e599316ab78bf26dd39ed862cf6c6d19fdcdbf4513b0da5bf3ccffa6aca96ff2af3447a95337469692585001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
325f3e883afe1def7be52632683a42c8

SHA1
c20fac1a527c85e09d27d9e649580ba156a428af

SHA256
b1ef687b2c3c2fc6985ea4a8a9ea7d224b8ac4d7c73c911e6fb31e9f030ca29d

SHA512
d2fbca37133fc208db140c7be2840c8c66931f275fb3ad5cd395e851de2f87154b5870ba4a18a2c234e0a45508613c1c8ac84af5d1af30613c13f90707e23162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9fa7222db93d2fb313097ea23b2a108

SHA1
b9e1c94a8174d29a6e29477c7e9985273980fd51

SHA256
db6bf2c981b00064bfc17e60664a4f8d2fa811c931c4251fd22a7882428f474f

SHA512
31a0863f6050812e0cf49cbe70e95910c6d304a77d9fffd6e2424410c7be14da296e37e6da94e256d8bc1e1b18eb7a674f4bed8693025e54ff41d65d25657412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c99b9ea12d39723e6b1cfd55be879a4d

SHA1
c68b9fd4a80a414a5d93d3b79db5cb64834426f9

SHA256
30f8d5ef3b5fca12423bda4652c684b34966fa511fe138cd1eb845c795f5ed13

SHA512
2dfe52d285c99cbfc608894dd1d664beb0f017797d1e1033c1fcc2441e903091adf92d1895e6d9eecd91f22c871f81a03e8bc56729f3ef64762005fa551ff352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88af2a89b8c2ead593ebd65b27719c3a

SHA1
b348ea28900092b07f2d00b562a772f98113a151

SHA256
0a7c52cf986a96ca9a387c1ef17587c2a9595068a262942450b9a03f75318333

SHA512
a0c0a24bbee0ea5887d05a7524e49117dbbf3a30a48ad68f90dd47cb572a86ef07e1aebe52c99d130d1df09b2c38580b4cc0d8bf0000f8232a3232258893f998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0476e2b1a78fbb1b81f26780bd142e45

SHA1
1d4ea74423177810dc492423a0ca4e9cee00702b

SHA256
45181f575d8781a65f4e665696d9657796f39d6b6901371f392b60d01145a20a

SHA512
13807b62558504505d2343c913cae75abacf1383c71bb9c56476bdecded856bc9838f9d85b213bccc63de58a779e6176202625cba18e58ced61195110b1901a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ca901c2e85e6f5368f267c4e1404b64

SHA1
1a6ae77518be4bfd9bd1bc4ab93385df53b6b776

SHA256
424fa276006e71877d566369a81082184ae2626a4e183c63beecec4a9f73aca1

SHA512
eae4ea9d27ad2c82607b6df61168edb4fabb6f6b9987f1f13ab4f7624b6ba6d34da84959bb03d7202a8ef1094e3a26dc236a95f92821a9ee6627574ef0a455e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfeee6eb88acae3b4d1fc6cdea3e8a6f

SHA1
37463bf005658c08c6cc162eb2a493afb8bed36f

SHA256
e48e22e2fc5d120d0d16265e74181e30c29463f2d193b6821586e53a22465edb

SHA512
dc87f57d21add69b016b4db0fb0698fb0c0caeac7d51829178b0d0a36673f341aeb25fc01b49e5abbd79c74cfab23d9e1dbdcc4a7dd6a5a1af2282d47be089f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0599c4da2cb37ceaec76b35b6483fef

SHA1
f904da45259ab9f5881fb083b142ae4150a43a4e

SHA256
7b0eb38eec9c64b3820e137ea804dfea889bd975961d4b2101069bb713df1a7c

SHA512
b07ac0a30ba04a8cdcd1c6e83c6ed6d6f68299c4453d16ea3109efd67cb0f2958d4f2cdd3d0fd104c348bfc3e14bb27417c5cca86b090ab6d0cdf1e775bcd6f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e119c3319b6b556dc6ab8b298276c03

SHA1
41e73cb37f058672ad742399bf9224760ae290da

SHA256
fa65356e31dce19cd404b3f95757597954b5146620edd4671e5af1081d8a6823

SHA512
24c048205cd520f1c8d685970329c219070ea46d3bba67a96ec1f425616504ee674f5fc02677e3d010c91f9c44a9c86cdd63b7ee05f9b1b1f33dc87fe9e8c375

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AB2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C11.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit