2f658ad2e26b9a12792fb37c5fffc645ad9f7c4477bf2318d3e4815ba10d6de1

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

366844610048bad88b2f3224a5bb4c26_JaffaCakes118.html
Size

507B
MD5

366844610048bad88b2f3224a5bb4c26
SHA1

5101a1dbc935eaddf96bf5175ef19d257911cf9c
SHA256

2f658ad2e26b9a12792fb37c5fffc645ad9f7c4477bf2318d3e4815ba10d6de1
SHA512

70a342da2f7e60cbca6fd5817d7a1952af4caddbfe34173ccd3d13c573b1ef2fa81845cfb88982e666d93c8921e95ea38575d0f61233f83f131200e063b2005a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000097439f052b98ff2dcfa08991a0d09eeede83e4314b51e981fb1d6b290860ae54000000000e80000000020000200000005d7aed16338de3070b8c7eef7ee595cd5c9a26119b24f17bdad98d3433c0a317200000007a49b3a778b7193927dbd622722a7d77d28ab3239b4b1f1e00ed250f866cc56c4000000000384a962e526cbae353713ac30161ebb7d0746afba7f56e5f9d008d64a87f660bd319596f79c807001ed7cc075666de88d1aef6b77fd94d3e8e32c6909d89ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000041ea75aba3780b57ef698240f694f0ac5d8b53cea7b9810186d3b3e9fa19050000000000e800000000200002000000064ef3046b16d4ed9847caed4a26a91ffcb90ed9d6f0950d76ba1d656d0f12ff790000000dd82f086adfe1552b038e6ddc2b546418512f087147dcae0179d208c7473da01801400165177f040451e3be3c58f0a6cb6fc7104b9a4520ed83283203d69f935063eb377a6990a0402b93256336238e0ee9a33fd245fa20e23bb6f00fdfe87e378c60a0c0da1004896d280be840d2ce094b1263e9adad38058df2f54cae63805d88d65856bd6f2e47bf4fb3df59bf777400000000448870b2125f02a1bc4df49b2ac7cd9e86cf4be04b14c36a5ef7431062ef18cf3e14a6ff1588796e76ef65513cb88f76e6b68142ea2aa2e71f72b2d6ddedbf4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421621129"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9E22CA1-0FD4-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f021d7bee1a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2188	1928	iexplore.exe	28
PID 1928 wrote to memory of 2188	1928	iexplore.exe	28
PID 1928 wrote to memory of 2188	1928	iexplore.exe	28
PID 1928 wrote to memory of 2188	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\366844610048bad88b2f3224a5bb4c26_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9f226fbc9af1c21bbbb1b351b3b56f4

SHA1
c53c789aaa23572a047efee024a9a350d2b9642a

SHA256
c6944c2f0b35ec5189bb55b40ff719bacf13c497eaf07f23ab869e3647d02fdc

SHA512
2d37948435e8874120d2697b10df52f64edc522e9c3d998184e712cb01a2865800995cccc33611e5037da6b52629d9870fe8237bf01880b0cea31f49ec4db5dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
989141c7e11d0eef058f19d1da115ab1

SHA1
0f1eff15a98fbb90d4ddb391ef1e7c7bdeed29aa

SHA256
0e0f47a1744baf1a711d188a06b196d95e9f487003c7976b427cb38d2b09b95b

SHA512
8f91002275c73b495f5bcf1b141144442150a955799270e63ebaea431f9a4552b24ece82335b59aca4374602edc985d1a0e1f7dfe17e70f595765d7d0e0475fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdd5d51c82d40eb0f00b9d17d18e86de

SHA1
57c8cdbd61199156f0e8358b9b36ab9e73c9b6ec

SHA256
421ea01da5ba30f0cd9983f5e7c9337271a6baff517c88a6ffb339e1b245ec49

SHA512
be1ca4708e4c4124df6a3bd81eb1fd18f575e4935e18d0b13c45d7f03007bf0c3d6d2206617c48f97f1e8dd4672b37ca7e0745ae4b1bcaa0830d389eeda13875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef9431e88cec3e8ddaa866eb0ce5245f

SHA1
962dd3e92fffc99263dcabbd0f36e8650286748a

SHA256
9d485fde1323ea0fe3b563f9319b69c64875b06ccab366f43861fa79c6fad715

SHA512
b02a9cbe41ec52c7486366513720c3637edc16a0d2024e91946d5d3ddbb3fbd1a205c88988de85294b029f1d98ed496f0fca879806dffd99e28f5ea94f8a1aa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0a2f9ccbdb8e608317916a057d87038

SHA1
96d79792fb7206aee5fe04093d5ee9526fae276e

SHA256
60520ff17c1c6da9b140228f34a0df6f9e8001398c7ff266a427cd8afe89e385

SHA512
ca7237fc1a11a7af8edb84918d5e05154b2f91bd0cc3724ec42b10a75feae424aef6d73b4ce52d567f51f6efc71ae58e2474ccc7b3c4123c211865e9d4f597df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b33ac412cd074ed5edfd1e30fe15e10

SHA1
1d99e30d8d6c28ceee4f808fafb9c97974f22c79

SHA256
08d0b12b1fe9e918611cf793c0a2ee97a6eba6c5b20a3a5633d6f31c6ea9ef68

SHA512
5d96c5bb051f216aa8c0afa319c0b61faa466c8ab55c7763c1ca255f4b6e0da2240d8cbb55324ad916c819f86d02c9828a517fea2e6ef576ec627cd97c6cc579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b52e6af4f9a680628623644e243b153e

SHA1
ea9c1b956bbc688612367369d70f7bdf5b14ecb4

SHA256
ea4ba62e53d545cfe85efe68ef88faae6a013ab5ac20fa2a00c556382b6715c7

SHA512
32e060e49d1667ac4f9b8ef2853f87e1dbb383a2c899eb2524b70017dcfb9e2067a5046efbac41a685b672cbd4ad990fc066241f69236e963831d4406242013c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a07ab635c3d2e905f441008738897e7

SHA1
7ba1272f30935fc647651989d30f65d933c530b8

SHA256
8f13b6eda8318fb03a47949fbe05d8b5c82cb7df09cd9a7854ad19a48bf4edb1

SHA512
274a6463084da899764d91dca483150e907fe2352f2a829e5f8dafb656328c4e5284e03dce07001a019149fdefb7828bb726410ef490bddfe71108c318025b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd66adb69302e5776f2ee14a5c7ffaef

SHA1
962ff493eef0e0a01ddfeeb49d1c2488d69d3b10

SHA256
65fe6a507e8f715d9253fd221abd02a86dde1b912b8d54471fe607a660af2196

SHA512
2afa381018b59f73f8a1a696a141f4db9eb30747a138e3e3a4a339e6cf2b7698349caa171e7bcb5305050004a9a7118d66a98ef63481eed4af853ee3be17fb2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
777b03df5c1459a8385e078a0bf9bd3d

SHA1
9a9845c0fba128bde0bc8edbb7c4c342623ca142

SHA256
a032532d9ac739dbf5cfb37761e5f429cfd3a00c2a6b8b9642f6cd07464ad63e

SHA512
fc5beed4353dd3a817d988b3a8cca6865cd981fce29e731435f2674fcf4c7015a0bb21809288b2c0fb6acbcd66a6d782211e1de29f141635a58ddc2d397b65b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e980d42f400700f549834854bfa932b1

SHA1
2dc6913534e4a3ba4ae24feb069b2e43c50e0471

SHA256
6942c902cf84e4d9aa498c94db7799a4cc973ee589ec7d2133edf61023a512b3

SHA512
ea61201e1273bcd80b8fd8118bdca4a39fc7a7c779bd7e3dd114161d66193cb4a6c8e2c0cf9cfd4c16ab09afa07c4ac8503122a01a7a2ecdf0cc6e70852a466b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9ac2d8ea226955c2a1e7c94c7f21ed5

SHA1
767450fd4eaa14ab2c123a84baa523d6c6d61a18

SHA256
92ae02c8625db7e540e3fe9f3879dcc63f9095000204683336525e651d841021

SHA512
673c6d11e8d92c319403fc3aa2dba40868771c3a92db20dd1bec9fb7a6505eedd186f67615ec2ea092b58eb5fed6776160b47b0d6b33ae1c88e6693f5487fd95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dda2a19e9e9f8289a837e593019cb3f0

SHA1
4f331e15239e33e23f369ae85258f866773c2e56

SHA256
4383d8131e2eec2be09c24969f5909205ba4d8d3f8d5606b68a3d59f98ef797b

SHA512
d4a9dc5b66cb6183649c571b7d50c697ccb64426534e508e80e220c2f65caab54330f317c3c245f974f035b4934b065661e7a7191a16a36df7474a75b57a62d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a48c13f07b8c29757e44c9ac6d466ff

SHA1
170bb5097aac4988aa9721a218b5e44a26cf812b

SHA256
3619f9afc4aa738599e83a37bf7e70849af5511b446a2d5276c0bd7be868959b

SHA512
67b89a890fe7b5917a02b78336f29dac1c4d7050f0f492d9181ccf455c0caa7d392874259514d64ea1a6b904689f956d667c915af3a2d4c880f307700b92e202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfff19ea64789853afb9a28f5b8ff6bd

SHA1
b53d997ef0f51736e0738cd2de4190ed5aedc64a

SHA256
bbec3d79b8b19ac03bd422743e8a4d9bc421781a69b5eed8b8fc02e0023ad489

SHA512
bbdd9429d2e817bea64da395b9926c514e1f84464c55272148b1423638f6d0eb628cdc4b581975619461693d8d8502924002c53a7d3d93fc7b0f3c53db6c9985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
010f71f59b4d704065543ee185b8c7ae

SHA1
79b0edcd13cf1a53b0c93410d404682b3c7acded

SHA256
671e58ec08df22c5acc50f8ce536d3be382f4729da9706f602e42d52623b2734

SHA512
5bf05a67f94c9747bfe30752d5bbb519c1d7c9ae78a03eea5f91df7049a9da6027a81d667900d51c018dde2ee517cdcfa6c06a03fa8a8245b6cee048f16d00a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c37c56c1ae179b335a709fa11b23ecb9

SHA1
c6fdc4eed1bc6c4202643a8744645359b182b1d2

SHA256
56a3a528a9ed8d053e1e04b2f07ef071933fd5c1cbbb47d05d725ef32218138f

SHA512
1d1e9b2e144f60cd4f7d6fa416b482cffa369ece89f662de223b561e7390eb74753b87049ca342b5a16164f3d9dddd2788d2ebb681b98b54b64c7b8d28d3df1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6EA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA85A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit