63177169317ec700c7114dc8fd9ce6b8c43ef11b160e4bce3afe1f1e1dbf3bec

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36ccf32d5a947fee4f2a9b55f389eff6_JaffaCakes118.html
Size

2KB
MD5

36ccf32d5a947fee4f2a9b55f389eff6
SHA1

8fef6d617e6c040948996df0cd96523f7b8598c9
SHA256

63177169317ec700c7114dc8fd9ce6b8c43ef11b160e4bce3afe1f1e1dbf3bec
SHA512

b0c78045b4bb8b3b3fbbd6deb5e806fa6333436f6e81314c7e7372f5b54d7d831a3fd5eb52b587f59ff1683a2f79c9c28bebdc9f3f8ca001a20ad9f4c6ca4628

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b8270cd97cee0dbb68e3058aa50cbec466edd6b8c85eb6cf31ce2073dcac2808000000000e8000000002000020000000ba7d0ce4a67396692d25e3edc8a401569e543ebf12272f6fd555b6bc8d1bc714200000003bb824467a75b3dea0d85f62ab84c22094c8ea10c8607e9bfe12fec7bf180474400000006a5f98e25d3a26d193cb7a813be17dcc0ad30de13f10c8ce8a3dba8b10c45b8f062ab65e8a1040017da0a822ce1cb8a68f2a2f609f6680a21b53ee7ee734326d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d098aa2bf0a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56678B51-0FE3-11EF-B5B3-EE05037B2B23} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000003bd53c0f71c676c70de003a67fd0358535080bd69cdfc9a01c9fa6a28ae4b8f000000000e8000000002000020000000676cd9a5bd17ed94117e99deea11138bd315792adde7a082435c33330db12596900000001d846ae760edb16790b5828e91cb71ef2d677834c8362ff838e77b34dd2f3c130abdc07cd341288dbf7cbf71aaf6d129dd7562edd0b5825b4dfcf78a065a20a5343e9bdddc0d65f977cd7bae8081941895e554dfa76a26500fd33b094038865de6ff24c29461f735f990026e833327b8a10ff20495a9c901369606bd341236a5d5ccb2f807d0e3095a01ea422fadfe0a4000000072ea172a960042ec8c48f657a3e6a30e7315dadd540593b3612f101da6bd06383db965f97dd153fe7c462d0c9423535bd694af848399fbf90610f2666fb00ede	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421627323"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
108	iexplore.exe
108	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 2056	108	iexplore.exe	28
PID 108 wrote to memory of 2056	108	iexplore.exe	28
PID 108 wrote to memory of 2056	108	iexplore.exe	28
PID 108 wrote to memory of 2056	108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36ccf32d5a947fee4f2a9b55f389eff6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4f179e744c94f932a064238c8b10044

SHA1
fdabed2e4657bd93f2a66b49eb1fa39157d823ae

SHA256
e3ae2b73115fcd23a1516113cab321f9c281b126ada2ab79559143d1c1da68c2

SHA512
064898b22b0b98143d197aecd83fc9d6df601a9cba9345b450a8b203dc860d36f04796031a4ab6b30b36a07ad2858ab595961015192a4cce3025fc265570a64f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e2fc3f2f42a8bc1db8961746475df0e

SHA1
8af087a3c6f1105d787500e9c60f916209ec88d1

SHA256
cf991dfdb2e230d64baff06516898722fd9c5d3dab3e8fc304c3662856905d34

SHA512
e5bdeadf44851b7f8e3e8a37c08f6b7a2906a7597dfb21a5fb987791b30509083e214f0ff77f2b7c1e042474b6e3d6ea5186e7a27744d99482d0c0010792ea0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d550bd16547933e813cbffa83861f954

SHA1
6810a2e7f67ce5ef3a765545fad68c0287c077db

SHA256
c30c7c2f6d89e493bfa63dee73f6a8f9a5b4121111f2f968be467c2d1057820c

SHA512
e26623b6007be100741ca1dbf76ee0fbb8f6f3671d3dc79fe23e9fc9addd84fd72f11c5f12049cf4192ee36d7de0e78b929872790e3e36bfee23fb19a4e5bcb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d5a6cb14ade6cc475f334647db03c8d

SHA1
1ed38c9c390a79b52991f96f444db903f56c8b64

SHA256
fb2c157e2741abf2411a29c45629a903450e153654c7b532fa8b47299de4f354

SHA512
ce5596a4b6d8aff1cfcfbfa4f9e4a13ae9c1348e1cbb9b3481829e5d680da94cb9da72ae492c53812beb5e6f1cb40692ddb40007ee5d8cea98506f61aa65a97c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82c3b92eb0f646f95c84f1dedd509b9c

SHA1
48961f67c16525560bb69524f1569bd6f68e6eec

SHA256
a741173a889dd10e0ec323a6fd2224ce0efa4dab7e82b865b5f2601a2b649e43

SHA512
118ea879a4efb992b0b8610208d69871329bdb75df7d89ada2b19702140db7f4dccbc6bec1a75168f8312ccc7e8aa9c4d103c721dea56a941a992e84cf4e9488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b1b4dbd5396c09600f2c3c717716dad

SHA1
bce8f5b32d7771c2e0222109a162474deccf2966

SHA256
ab05c21aaed1775d83fdae918d0287b6eeeb01e634f4c2159050e493c6f6179f

SHA512
bed59aca2a4be4c9a410141594842cda2985075ecdb84ee93eedfa8c4421c1e024e44af5f871a32be15bc4debed7fc4638b7dd398ae65c2c9a56cbc3997c190c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb4df01c5ebfb7db9385229c81a28d87

SHA1
a5faf199e6529855d1b4fe3c956bf73044a8bc3b

SHA256
ad8a21bc2343e2b3d9799afa58c78feaa1f4eb0424a09c1426e2139c26a2ef9b

SHA512
892ae576ea81827481c959bef929f0feea9c5bb3563375bab9481b22b7219939722e3bffdf4ede293b1e201c7a0141446d886d411f44fbdc2619efe5edec6db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e0bd5c7f9d09bce9a6089712a53972c

SHA1
dd865b9c9257448754f19f05dec85652521a8fd2

SHA256
0f11d2c2c880ba0351650469e8eaa394aa0213f56f153cec34e27e00cbec999f

SHA512
b696ce48e5c22d5dc9cfd9cc746daed1aa6bfb817c0b4004254955489554c189c1a595d33a21ff3f3014442f0b9d59c3fad20de54ed5293d6ff2650b15abed19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45a9534a30db5aa379487b13d527505b

SHA1
61f50e1cd6fb97b0c7209f2a2503f199c82d460c

SHA256
63a388c2789422b68160aae756b06ccd362322bfbfddcb6a6be8ba0c59d0cf3a

SHA512
15b186a3684e7cf7df3f8f81bc302bfb87c05fe1760937d2f88888e1fce3d1fae721a06b3c1b8b9e7e2aa373ad5004619adddf1f34e8917c13e9a5e22f0ab283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bba1931028e535ec925a1e7c7730e332

SHA1
1730c54221c67e7804e87248a16a4253320f1943

SHA256
2326145fd988f4b360c635bfe92f093c332abf4b0fea946dce9ffbcba41e91e3

SHA512
9d27fe8a4896069126e88b8841d62001e92d14cd13f061e682958fc0297263a209660b26e901f4dd7f4dee35347b5baa5ac67a1e52a560d9fc1301607f39678c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bc9ed9862e54209db10cd893e1cf756

SHA1
b6ac20e2a90827b6832ab3c3cf9db512c56002d9

SHA256
ea65191768162a09730251982b681d20589ae7973780a4a1a1887a6d9ed80b34

SHA512
636178c901d244ba2e937321b21defa9afc9b7a406404e0f7f6e36d07c373e35a7d9805a5551f761e80e673c77b135fef132131f31101cd1090db45faba4aa90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecf4758f58942171ef5ec3d3e62572cb

SHA1
ad6f074c4c39c77fbf697eadb0defc9d6efdb0f0

SHA256
50ca6d3889ed811476f6e2f15fc6a51ee0412eedd85d2c59d6a89f5cb418aa41

SHA512
3730bd9872e42cb323bdb013d6662c56e394786758615ce87004d686c68e289f7daf36bdc42e97829bc1eb7ab23fa3651a40522d8c87eb38d2237304a8404ef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d9c9cb50e062b39ff72fc5bfa7b4f75

SHA1
e6bf6a03bc9022d36a1cb5a0f0f7695798b2265f

SHA256
16b9e3d30b07018bcf6ee84889a689cad5e6e475be4f9a31ff0c5a2f227fef41

SHA512
80417f5244b8c77b4771b00a93bb0d229a5cf644bb35e67328f0c950dd085a790b24e003195c59c82f62cf6bd715dd010a4b1e374269dd00a7aaecb3ad59ad31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc920b269feb5dc0d43aaa08e8054b0b

SHA1
f67e92d546d895e4e3ae9ff0bc2968ec87b76840

SHA256
e08fe376ed0af4e871f5822b1700ff41f408c14546724bb780f8ce9a5c68c9b1

SHA512
26057607c736020b7edbf4b544cf7a962cb2e88c136935afe3ecac66a8a91a1bb8f5c76bd011cee870e3681128631600b33eecaf88ef8459907aaf9c900d175e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f3c124a77e25f7eb054f8928545a1e

SHA1
c2615737c3889ae95f5eef68cdbfa8e08d252d6f

SHA256
810d1a5f5e4797c0f170929cdc96681e3bdb3655cfa1308dc984d2ecb6963370

SHA512
576314c6f0107e9f2452f33d24c26dbb0665e59d620c68438df5cb3dab5261783dbdb5f44ee203759096c8f9c7369f6e741c07947d3fb73069ac2902ad1d883a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b06febd3391f6872c4c4e86e858336

SHA1
d56036703b2bee3f6be887177b92442f31122179

SHA256
6a7a6fb6414df0ce07e0d380eb8fdf1e69981b7548b78385d42017ece271bf8c

SHA512
bc2095a90403781550c9010eafe5b2dd7b016f96eb3a0bc94fc016dc2dde11e57b3cf1a9422fec0a19bd624ad8cd5c4e842edf1d03bb19a51136beca1cb624b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
280c4feb169f6d2a4eb029b3a5261fae

SHA1
e3cd846c05fef51b017bb8ad1541853cb8d8e1fc

SHA256
5646a96d6741d76361ed7a66f30aee678194b474edf0e6547a3dcfe4f870eae2

SHA512
c6635e230daff7a4d84f9e4db994265bedd75627a816a61b3672f1f0c5ebabb4a72ac72a48207767add66d396d4f636b44ae79226ea791b560fa9e6890bad4bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb9db4e8d15577b4bf581c20585a2f2

SHA1
f624874ff73ab720f27ea55bbc66a1d1e3289162

SHA256
3f13df56a94285072f86ce6b48434fbacf614d13444089b303eddad43178e6f2

SHA512
7e0aa64ee32ab42a8119166c438dd754ff8b6699afd725135d557cb66d683cb289f8de3f918e1e15e8f7f5f9fe459e72d5aadf512e44033407fd8ec67ea34d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3729.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar372B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit