1f58540cdc2d901508a411ac52dd22e93a3bcddd959ff948dd59fb00aa93ec2d

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3857dc3ff8fcb1a78265dc8ac5a0d370_JaffaCakes118.html
Size

204B
MD5

3857dc3ff8fcb1a78265dc8ac5a0d370
SHA1

256806d1fcecb6729114ea7e1d62ffa510c2e33b
SHA256

1f58540cdc2d901508a411ac52dd22e93a3bcddd959ff948dd59fb00aa93ec2d
SHA512

90fd47be8b15bc91bc843b6b7da985b46532ff4953c4273e39d651e276b8c627d4445d6c4db7c9d804936de5332db4e2a201a92a1a8d42fa4853ef6eac2e1f97

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{220B7B91-101B-11EF-92B8-52226696DE45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000d22f17f0b934467437bbe2f7d8d036e2d3e7c1dc3e43a7a670be975390b9a9f8000000000e800000000200002000000079317217f80d21c071074c31ba6f1689df3f46a2884f9da07f921a0fe563084c90000000e088d1d919aa12d8088f80ef92fa99e2c3f022ef32081961a497396557d773aac1ad68e5c69a913cad34d13aab16b840232d21c2926eea1df1840c2b846b469f6d1aadfc2218ddd981138ede2d36843fa5bb83e3731f39796fdad7bba50fdabb440786c7dcd0a9c269c38fce0df88f946bd8d2bcf5846ec93253b8250122ab4fe34aee4eaf6f8ef0227ad0447222813840000000d116a3ff3f7f13b83bf12c992930a86de6f22140abfe4699c217950a0588a8e78710ec1d6fa0306b9446ab7d00a2e58012f856abb010c9017b5dfe80f0a28b48	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000fa6ae502fb86f512c62ca03af0ac2d613d4a231062d8b8850482dee93dc60477000000000e80000000020000200000004f77cfed31e993f00b16dc107545d0907f430bca2f6c96440523f00ff4330fed200000005cc23370b55dc99d7d7779ca639a1e4b96c33a23471dc049833a5275a032e1354000000000ecd139f56aed6aa8dc0c59bbd40a67350b54d98ea54fe3195b21a13a60c94242e98356131dc91d9a2093f9576b6fcc53feb33f3ae07f07ac4ede8b3ae80218	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20069af627a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421651287"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2768	iexplore.exe
2768	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2712	2768	iexplore.exe	28
PID 2768 wrote to memory of 2712	2768	iexplore.exe	28
PID 2768 wrote to memory of 2712	2768	iexplore.exe	28
PID 2768 wrote to memory of 2712	2768	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3857dc3ff8fcb1a78265dc8ac5a0d370_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6545005ca06aed7971063754a9825d88

SHA1
284ac6dcfd26e7c040ac0a14a3413e1a1cae0591

SHA256
39db8ec4e228e4aa1fcaf704153a1889160c40fecd98b0a5f9b2c5f2f78b26fc

SHA512
ebef354618e9a8932be524087113f8d94caa888c4174b41b553a97f4f89d703d4d444a504b5a1d7870e1512b07f0e8b51b0e9ea8afa01489674639e89cbb43fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b917c4ee8c991b9e78fb2a751437c79f

SHA1
e317fe9d99e6408dac21edf29f35d109eac7f2a9

SHA256
7d7593439e353738cb3aba710cd488f3abe28976e8ce460af837136d3adb40c2

SHA512
13f596e3be8428c3f50ba4d8d11322fdd0c36a4e5899bbf2c1127bbf625e9c777021f9669bf73a53177c0e379f5a64cd3be2810a0213369682cc44a698a29d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62af50b1c42415b872a0fe7e761de93e

SHA1
1519b1cfe4f5e1cb4849ac22be22e2a3bc524fe8

SHA256
bdf4789e17b1c04dfcf33c0bf12e9f628980cc435376ca0df4c3b4bbbc26e2ba

SHA512
b98ae7747e25dc084eeeb3ff246d48e88776e8818b77ee3b1492d1a2ab793382661e2ec64332a63ff6aaf153618a3af7e24ec89bd616a5d5d13a04de38d170dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55503bf3695e4f62f9b84555d68f32b6

SHA1
e52498ec748afd19cb907094d51d5fee1891531b

SHA256
b6768a0233f8fe817c61e254fb2fb41a8722d8a8a0e80bced8aa1e4cfe52e3d1

SHA512
9cb9ca5dcc3d0ad23a92451ba0eec1e8cc90486a65b4edf05d27aa4aaf53826a9da0047d714d4b4a51ce28235004e23c0d032a33038717c31490167f891957cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a995b864cd2c8f1c0083b6b5e8c8db2

SHA1
dee367dafedfc867afd343cf38fd95f61368d58f

SHA256
54ae9fa4a46ed195a95cba102987521cb8b7054cf77563803631ae7c50b0ae2a

SHA512
ae13b8aaf9055f13e785c8bc912acb3198f33363eb0ef726f7a82799a7980f6af6cf4aead5eafcc8e12cb9d77d08609e80f064736b89b52287dcc5c1b7b80ed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0049e0b997b1a068aa63499730a22107

SHA1
fca516f604299e837059b9335505de175a5cfbfe

SHA256
5a96d88ab387f3a853e5649310f2055dfcfa263ecf104963be17e17131664c78

SHA512
875cc9e7738f07b9dd3dfe5a385dc0fe43ea1fcd6c5614e43e2861d85996e2a69008f2dbe69edd06c9e4a7c75ad13b58b1400b9e88bcd44f049928b4d82f9323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff239c393f8727cd1cb200c31ac9c471

SHA1
4ec117143af2bc7e17fe4bca722008e03aff847b

SHA256
7bc448ea5f2c23989b2a6a89801cd96498b4c38f8c04d19d29e99b51ae2ab3cb

SHA512
2d124fb053006658efa34151c54d1429e17817294e53a3aff1add0f1ccdd46b3a7d246e56dcd7202c4bcc1d69ae7e09a4a49b4d3a794c1d685b03dace7b145a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a6b74a6a84eaee026f3154f71265909

SHA1
5ad009e0d6cd3d59422559878531f7c069613baa

SHA256
18b6f2663b99e95fc802afc3a592352580f354f46822977e99ee091de45c9ae0

SHA512
aec723309689cf45c68cd2faf1dc8d92740b4bbefd036b5d8f6d4d81e8844170cfd54e2383d21a7bc934226a3d9381dd9b320ac7ac314005e59a40c3f322cb72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcc7f0abe114159dbb5d3d8d4d9cb2b3

SHA1
ddc0ae3fee57ccfb99d419c76f208a1d0e80f9ba

SHA256
a54de5b55299580301f094e7529745f743fa7feac166730366d032eaf23ac706

SHA512
dc6dc17251b921850d77c17da4c6ea983fcb6f849571ec045c2b679da6c44d834a8d9a49226af0cb3559fd7f93e35c72ce3ca5682f508b8c9dd7cc9e7e72bacd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cab6efb1d33022f6378feae36e93c02a

SHA1
8253b05a4d590f6f2afeab3a55bf418b0198b04b

SHA256
168cce7f6db7286a908c1d9d0e85467b53b79c0ab0cdfd5efebab349c32f32ad

SHA512
2c218e690db4df16529b36036c44757d8fa933a1910aaee39cc36e9da2a887a5ad8d61813908fd9ba43b68133963ff91783f38dc58ef3ad8aac3dd98a110283e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
838da24d33a8ace0a6458286e81b1f08

SHA1
5e110c6ba580aad839af1e32d4b2e3413179341e

SHA256
cc1c172b0a85eedd733453b64f37ff46059540089d76c2cdffa8a0bbb0daa70d

SHA512
64af071372efa166fc964af1e39ea5c0ef2719d22ace750d682b703adc79f6f8f7a00623f6cb8bbb8470f23ca16dcd63fac4992ca1d92f2ca2c0517b7c888fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
533121d019bb4b603a8c442dfb0e2ba3

SHA1
71febd15c1667f76e56e7f5482410845e7e70a3d

SHA256
9795f77e2d194e2319136f58847965ed20ea200ff68f32634bccb4414dec52e3

SHA512
7068346101a024cdd0f439eeb5cca93443ed62aed2af1b781948e5d03cf359321c5db9b6bc462e4ef34da192fbc33f5cfbcc95f9b73386e759bb52ca9be6f11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e305af47fce6c7cc64e13b4ee46f159

SHA1
e98b03a1a93e0eeb19dd10009ba81819fa233a63

SHA256
4f86c9814c8ef2e6e091f52bddaad8c168d06c1be3c3b28c892416b69b2b3044

SHA512
e5f6787e59fd46c3748b46eb844ecbdc66fa8e148a16475ede0bbd8fe6971de07dc74ea2228d5a84d35a612200b17dd199d201411734d48ff039e51e7cd77ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
048c250101ba7891df640837d5e08805

SHA1
6ead31d0cab9339d97c4f6f25f25492f84080a6c

SHA256
076c7daaac057374cb4a12ca4d0fde729f5f335564518314c6c60b69553af6ef

SHA512
4c40de5e2b67db78caa2463d3d76d57a1d97f83a5107cca5bd480f91bbcd841e8b97129e71b4e970d6f693ed5f995a02d0d6f2474021ab5caf6825097ea70514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55ca0b4c70a76497e547604649ce8ef2

SHA1
f0854fa95f96ca788686172512b85e0c0ea83e01

SHA256
c814691e2dea3e2d5c68f84411ce29c2f030a329f3fdc5d7a460c745f91e4b7a

SHA512
ee46379370cfa453fa81fefd42e918ddffa79e825f283d2dd9601d1bf61b574ca928d9422f7e9f1c9f5eeb28940d1b9456a36fd757ea801ec5ce41f6b83157a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
912b1ca86b722a1a05387f94a21cd9d6

SHA1
76ac112714c5e4eaef28d42e4076af22ac3ed889

SHA256
26fff27a254f8b7aeea17b7368868acdfee3b00ba3db44ff4d8f14377d499f3b

SHA512
70e471bc5bea1d554aa3a7f2c836348946740a1ae733993280953646f3461e760e6dfe9efc264a59f81fc725f321a2dc6bd2645c00e8acbaa56399b06d88b7ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f49bd0e7c2cd5d4c15e032ad4416dd3a

SHA1
4abc91b02bb0859ed933ac15179fc81eaa1f4be7

SHA256
718bd1978af800f9ddb9d42ac32bc4da1a2d99c36e206aab7a7e548d2e8ba23b

SHA512
9c38d0b2e6bfb79b5d87069b023778f9f18ef53aad8543dc22ddd320243dd073570d805fc3240c5717bf1bf84a8b9e1a58363d712a80740f2d3a83a102658e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32C7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar33A8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit