c99d60f41a7a4fdd293da53302f3b38ee8b58a6ed6885686543b9d5a63472777

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3673503b5811b5717f40e3e46b12ff36_JaffaCakes118.html
Size

2KB
MD5

3673503b5811b5717f40e3e46b12ff36
SHA1

4d95e257fd53db0933bb26f5411b461a05fab4c5
SHA256

c99d60f41a7a4fdd293da53302f3b38ee8b58a6ed6885686543b9d5a63472777
SHA512

e1167b7d874be4f904e2f1f25ce3a1d9a82e79e6dae932ac7a7082019cd4cf7d623293175a3b47ba4539085634db6fefdd9eba78da28c58066eec65171395512

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d0998e422a15db00b9b782d6f4cb54cdf00a62a36147666230b4aebf64f0ba84000000000e800000000200002000000041ae8db3bed9a1a2b21711f97c3f6f6d58c46bd759d02d7e65fa66eff7b7fa3620000000bb93a6c5861fe57df2061fddd114619cea53264657a2ce7fed0fd8e3b53e6be540000000174b6746b0a6a5fe63e878a3d27441d9691945059c653a780cb2b0d5ad449dacc5f06e0d3f5bb244f70432581822ab4055ff0647861d5bdeb1362b625c389de2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000085a66f28a5766f7e42297bf9cdf76c40761ba3b4e37a7fe1be740cef83eb3d10000000000e80000000020000200000008706834e154c3b273831870865023abda7bc22671f88bdfb435600332aaa7b769000000040da09912fbcbd9a86b7c0014de3617e37c8e97a65b3cc4ac64e53fb35a036e53c7494623b4c6b95b78106e77729554a3b9cbeb7959a8e8e0d64a533b84f93bee547000b7839694cd1bbad1cca6dc65bef402729bf9022d831c56738ad9bbd20d99f94194aea0454bdaf130c179a1e783cde5a19caa491c9fcadc104cf456c41d9e649e48c09c60003066d17d0fe85d540000000b92af3864e3aefeb312c6852fbe206db7b3f301aa7fcf173665823f2d875ec58c800fedb86a2af9c5c98a5a78e662f7093803d565d2c883681ea79eb28383133	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d008f447e3a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{734EA2B1-0FD6-11EF-99B2-4A4123AE786E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421621787"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1960	1612	iexplore.exe	28
PID 1612 wrote to memory of 1960	1612	iexplore.exe	28
PID 1612 wrote to memory of 1960	1612	iexplore.exe	28
PID 1612 wrote to memory of 1960	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3673503b5811b5717f40e3e46b12ff36_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
477ae59d8e47de47e4b56fb1556213e0

SHA1
53a34da5e27a4f808d5fe454fc8940120848aad7

SHA256
f58501c7c9a0cc39df37a95c89c7d8cf077e9a5162ba94170a33c21456476797

SHA512
aa2374474ff5a470ec119506ab53ea2a6033e1870a799c2d6c119851542727a4c46863039f68ccaa5f9406b9d396d37dc2bd43389eb74b8ca39bbbce7d5a5081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a55199f56c1af0ed0b85f585bbfecd59

SHA1
8e96e97da494c84a5e7127bc5f7f1423692a73ef

SHA256
fbfc7c4872189acec8c19b0445f3acb8e12213928a6f52e4e83a92f4b3fc9bb5

SHA512
814df50c671c32a064d0f054c91725f607754fb2826d0d81984803db9347baa14a381e071755e837aa4412debeb8b89e48ae977a5ebddb91782c621064095aeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49428da950b1b8006172aaf3406b3e5f

SHA1
870b2bf0a0628ce5a67eb2effc51137bffe76394

SHA256
38a7fb8041c776237d19fd76fbe9813cda54f62f6187425d492d87eb8f25a118

SHA512
392370440d837821610dc65bf25bbc43cfda0630faba461d4d345202ea56137079a4635d1ce8fbb9fbfceef22b26364e1d84394a36c18f09c72fa66b0e24fcdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd3a482652648d3f4628338bf1f905d0

SHA1
fd2b33d91312fca9a8c54fac2030c19863f25977

SHA256
807e8a61d4a0d09349458eacfa75e3833f4ebea7a4b3ec53f0196f4326dc20e3

SHA512
c5cb7ab04e7e8dd29dcc2f230bce6b46f9e89607578cf60ff0649ace98fd9c32fd02ccb48bcfa645432a2b57460cbb4d2255d74732d89256dfda21dfd5335056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbcef871c7985cddf2a63c37809a744d

SHA1
95efc3c505df5d511292c9b0c916f37021810aa2

SHA256
a7d61e3e03ca26196a72568c6ee1ff87a1a142662052e674758ea515bf969bd3

SHA512
0e820e75822984a9901cebbc4156d0d180c9947c6ffb76334aa3425b911eea9225d51b84895d7fe2f28593cb346493f5f598187119383c4958418af95686a246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
513b2cb09c8795d101cfb155590fa93f

SHA1
ebdc0e6085a1ec0049ed2f9a315fca682f103c79

SHA256
f7e0f84f05d21add810a83e394d3a5be46ebb70c8ad0e354becca45d719b6ab3

SHA512
28860775db142fd8470b3e327e6b43ef0e06a6b2cb32e26875f4485ec7607fb932ae83bb863718d8b0502cd8313f3b51675d9084b7502497bf9f5959aaca73bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4640e24f4e66bb003877a319692533b0

SHA1
7bf86873918a8c0a737fa69df296b8a06882e901

SHA256
d3089878ce8fa506773952ed3261dc8b45c6c68183a150332465397237b9e64b

SHA512
f7c39729b207e6977e68f1e0f201424d9fc41809c36ddbdd323729016ae1e57a07faa85e389e3fead5f679e975330add00f17f8a1d1375d22d28346acf9ba44c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f2bb42e3c75b23c04d5f0918510947a

SHA1
b5ace9cf73a911908a0e3a79db40e546a5c0841c

SHA256
032dcd3beb921d11a30b9a0bee48051b03e216480ddd11ac292f825ed4b3fc19

SHA512
2b4b7bc14da755390f2e7b0e957a9859f1f4aab85607b9c475bf982215b9c7663f1216623776f29eb4bedef5add1e6fe17ed933843c1b2a35a0a7aa0151c1afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9db68bb40315222ce0924ebc62e2bae6

SHA1
2939e79480e47451b199152f0e78598e03add302

SHA256
d8549f30c5fdc7491aa54ab632495a4c2013e436dae5aae2c9cba396d410d533

SHA512
c4c97db97d37e09326a3e94cc781649d61911551f99bbc7da7e97edc376a1148a9fdd35e2850ddecd5c3f130e47aa77b378cd755cbe6b4ed3fa342d2c305bbc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be36d7c439b70931718a1a8ed956b03c

SHA1
0bb2fd40a7ae85ac8369ed093479c39d4729d54c

SHA256
35c07792291412b78f365ae98d1eb9d116f6056809299446a35df1aa2903bf59

SHA512
dac9eca94ea36f6ca061b792489ebbccf409d739b293577c76da0ad17861fae7d1db77644f2b202da0d379971d9cc55d6e45991a7332b460cb473f0cf1bb9f30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab323A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar326C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit