8bb6ddc1326a547624369236c45a562ba3ee5981907be5bd85153e34f6d1d744

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

393e409b982302c2b40f2237e66f4c7d_JaffaCakes118.html
Size

723B
MD5

393e409b982302c2b40f2237e66f4c7d
SHA1

4ead5fd80672a61d8c021dc295b52c9914b2fe71
SHA256

8bb6ddc1326a547624369236c45a562ba3ee5981907be5bd85153e34f6d1d744
SHA512

af9c6cf73c5163a6a930c924a649c6be3e2b3f60374908ba8bbc991b5cb7fa871f600ca46fd215cab33568e408e96773ef0609e4eae63a8d94a5f853f9c49085

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000050c0430ea60a0295f07bb6c3c7908df8b595bbb58020bc8a3b444e475a2d5356000000000e800000000200002000000069f5cd36ed081952f1eda094c85917107d1e8072612de8949ffc1920577b9ec7200000008b9deee0668fc565df4c89fd8c6cfbf74c688a90181f9666bdf13903bec0af77400000007257464836722486d36b46324bfc40aebb3bd8ea288dca073ba4e214fc8dfa662ef8d72bf02e2adef019f08bed2ea38382a423ca2f3f849d769a877c9b77df6b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009ff9ef181e6e25cd0a607db43708c86a562221294b9976447505fa41220fb127000000000e80000000020000200000008f6c21f262b72822e772f48149d17b39b6e7641a30c316417b5f2235b0466947900000006270ccb160cc6dfd642c3c8e24ac69c3375da1c99854e2bfc9ee4eb1b5e0ae4e08d7a7a225f33f54af4d012e1e9b5c1bba3250e307a7729e9996f301762b3ee483e81a3923323a4a9a1ee6b6a63084ba63d1b5ae57cd7906f102b68ae1d800ee62e9ef38585540a72826fae7bce43fb8085e110195342cb46ef700e32272df4950bd1baccb0df993c6ba17103bee0ff240000000903daa3d8cc77eaaaf367e46a26dc01d54859b3e1ce57398d6fdf2ea680d8c84c410525b70edc5e076c1de74099ad65a5b7648ac1ef58d82b5e5a1063cd4cab2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4E75CF1-103B-11EF-A3B3-6A83D32C515E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9005b6a948a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421665334"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2672	2276	iexplore.exe	28
PID 2276 wrote to memory of 2672	2276	iexplore.exe	28
PID 2276 wrote to memory of 2672	2276	iexplore.exe	28
PID 2276 wrote to memory of 2672	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\393e409b982302c2b40f2237e66f4c7d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ef21b342bfe7a388e081159a131e809

SHA1
9ddb8d15eb467dc5e1b391fd81f9af13f3b8fc30

SHA256
c43ca925a892d2348742b98a19985e2ec64adac5e122d5e3b758568a54c0ad1a

SHA512
2469828115433e237921fd06e12b0157489eec8b836f2c72e4aeb8c4944e12f71a88fb53930a1018ec8ea2daf1727c030c5f29cb0eb25bb7d3ebd6a218224e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f2ced8e22ed34a90c4d5edd7258b3da

SHA1
5a7fbfbd5fa9d836ada913046b947e2ac85764df

SHA256
1080d7826d3753917ec395ca1e290d6bb86549398d197439cc9a80cd8dc2ea0e

SHA512
f31093d70427fe3b949b428ef3181ee08cf2a1be73732869b676c2ca814574e41b64e862b8cde56242a9bcd79091da24b6d1aaec75ee928964cb0ecb945c8cd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e80d7d21b7fa6a8d3b8e39a35e8a334

SHA1
7f928460792923d745de813e26e5b662c447f6ca

SHA256
dc65848d91d235c5a86b2e003893a50c9e71e6f14723e3eb8f598a762c274f19

SHA512
944f42993812a7c2d96d32f61e638d7c60a2e612799be9031f645a86629bf5e7b27b3c71bea68d4d1cb1486566d686665ebe602bef9f709e5a73d4116468c5a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8607726fa301f636fdd5f4cec1b981d

SHA1
23b55112bf1e1c36f4baa11284c811476d662b88

SHA256
d643d04f220e3a050912ba2be56313f9209b07746a6035d044d3c10b7d455b46

SHA512
00d43ac00381a52242c7d821c65ed5db16d015a7962ab7f13f98e25c3af6d35a6606fc2ae1dd37e6e4a8e41fa0de333be2652088fe015cff77f89ffbb4b8ed30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94506d847ea6b911a0f2527c3210d103

SHA1
03b3e2d0b9faf3a6e15f1f53b42aa35b76f26ca2

SHA256
014ef49e16829446d3156cf7d7163abe71a50fc89d1164df8d70a737b6bacdb3

SHA512
133e47ca2e76693d8b2a2f9dd4b26a775528f5614979d4f444c182472aabc79e85b56d0f0daec91644fbf5b870204a2edd605628e08bfed3d9cc17f962150226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8a725c2caf201bf9e5cb09e9b1b83c4

SHA1
44b139d5d1f0b5a474f619089c1c07ad7cdc3ad7

SHA256
0fff132aebaee25cf1ddf7bafa0f0873c9c73b747433c599dcfe23be756b2886

SHA512
335c5aab92d156a977baead99934bfcc67ff9c11d052d53efd9ac5fb8f921b14cc8f26786bc2f5b2b1f7a600e7911175cb7621a87f07c366bb038be15dcc9d1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47423a33bf9b8977bbd34e64f9849a50

SHA1
34f7234b7c52ca06db034c35ece091f4996a7328

SHA256
b42c9a69e3cd30b4e69bdf219d5cf64578d9b32872408ef5153dce5fe55745f1

SHA512
24d043993e681a46192aa063410d2ca3b58d0e269789584496e33bfd0d06d6cc1568cdbd7241cf6a9064f992173be5765568d378ca00b9e3716ffce5722c51c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e6fabb2633250f65ece2e7e70c38ae5

SHA1
5e9279e0fdafbbecf4e9f309f92f1fbef6ef6f76

SHA256
db3ef766c5d319e80125fac936c7f76d647a95c77b2ddb0b3ceeed22267f573c

SHA512
e3c3ba63ae2cbfda5ed58606264abcc9a2eab817508ef6abf28e218c55789ae2cd223f27354f2db68b6c8685f25d9944c7d3a50ed218ef6ce811f993a56697cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ecee323e663292da52143e0fc1817b5

SHA1
aac2d8d1b593a18ddee09917e9648c247035626f

SHA256
787fa85108ebd7516b08a34d65ad7a7290c36c7030896e6aa72531d2f44e370a

SHA512
f63426c1eea3ad2cb45b0c8b352c6f6d4ece21fd9fcaef075d7cd84b511304692494d026851485cf3bf099ccb8dc4c32e5beb5db58d47d8fa22c72a3caa56fc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7e19b226cf3d07ac1172628182ae56

SHA1
1d85eb0d938a6b77c7f9d09d8e972c4197565b05

SHA256
1d95883fd5dd2186914188b18290f0cba0b863c98a441aa28043929695b0a2e9

SHA512
806bcbb52fe6cba3b94b000f66a40f66b082195bc7d36180f6cf0b01a34a931c0b1579a50d8da213d71ed46232476977cc14108ab109630ac9cdabef6efc2aad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6fbf4f1cbe3e708d3bcab818e1c2d99

SHA1
3abf4e090dceb7d3a491bc8bb1afbbb310bb8600

SHA256
6f8390d564896cbad22e0869b4a8e48bd4c334ba25fd75769d228fc7dbed0837

SHA512
5aad8c1877e1e1cfc6aa4c17207310f93b118f08d4ae68a90e6ae8caca0f33f827219d0db01f1ad0f080f25051c02f628dc427149d6d8bedece01fadc70b21e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa32101d5f498ab4089687dc263e1338

SHA1
6fe4d6ed23abe7a849f65241e43092ee0b296680

SHA256
a5a99a4b3a7a84259e4258609f30769058d12128c5433289ca2e70caf2401cf7

SHA512
94c5d3871c609b766fe6682d57c9578cfc865d03b09bb91ae1c9e1186abe59e734f78eb59746c597058da9707296a3657d327cf9dd7c891365c2f6a2cd98f6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da6086a740c0c6be1ef17e704f8ca9fd

SHA1
1d5aa1588f4ab5cf52d9db2dbbbdeca6b1abbc77

SHA256
a323ee5b28b2081f62c1fd13e58b64fdd7dec9297ee1b015d0d8ed8cd7e569e3

SHA512
fa5431e99542d32c2e2ee8aa262d8498acbe19ead93a783fda418933f5956aa641cfc14c8c255c2054557ae6f9da604593672038b2b5c58815830ca99430855c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5cbde0ece09b7f8dd2a4021a9cb9344

SHA1
aa0afb677a6623b3eb4f03232fec4adbe2963308

SHA256
bff8303f50e21a4382de818f4bdfa84ba97d15ce4d74a9f94b053bdb171d417f

SHA512
1f25cc382cfed697a7a75246e472d12b6b010e4eef2cc203f7de3505676c3cd934a8978f55a4f835d9343a8ac9ed19170cb90c9e3f254c4aa64514f67b008de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c47d40b3675e4a8534166bd70c43895

SHA1
96f8ccf26121c6937156588be8209ed8fcbef85e

SHA256
724364e6e756f723d8d1046553c05084045cb3415dc86d2888e7826b1a6bf1e6

SHA512
ada469f4ff092172945f6184ff2da492e6770573fc803a5b33e4546bbea50e7644ab134a2d26cc0bb4ed08b3e0e3864abbacfd51193d3d9cd4ccfefbcd2ad58a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e93c774339bfeb063f1dabfe6219376

SHA1
079f4e8ade0f64f6048ffd6870f69cd053bafa06

SHA256
619f8bb4d6870235d20fc2c5beb3bd311c6996027f1820975bd0063ed95d8803

SHA512
862aa3e477868b0b3468839d86b9cb1ed7f0e64542bb7fd74f217f7ebdc97a1e746076f6525c7806f2ccace55a766e8c1511095de8907d113b70afada8cc82ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c9f3a4e8715dbea0d0d9a3ea48bd83

SHA1
7437935330948c6d0732a170e185d6ca879fc273

SHA256
63d67e723fc4d547e9c83be345da641bd4c77a49b8476952366f92031a437842

SHA512
5be55d4a2d3e084748ff000b5a63be854aafc3b688d9ec9fb61cbc83b5476c44110fedbbc6a4c4b3203c244844c050e99499176e270bdd43310e7ea1870f0333

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab316F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3270.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit