6f97f83277edf28dee6cff4f457301407395d18e64870804b03c30ce551a10ee

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40b78866a9a679a3390bbe11c19c2a5c_JaffaCakes118.html
Size

2KB
MD5

40b78866a9a679a3390bbe11c19c2a5c
SHA1

ebe9660a4a96e37e64bfc01a183570ec8f774082
SHA256

6f97f83277edf28dee6cff4f457301407395d18e64870804b03c30ce551a10ee
SHA512

e8c947a53ecd683e24e43d85acf235559e7a510bea3a293d309c84f388bd08824bbf7930fcfb718d4c1d7f2f9278751df966871d5882110b7be756ef8f1ed2f1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421834364"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63D4B2C1-11C5-11EF-8A5C-CE787CD1CA6F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000049fbdbcf985c1f7531f8e97dec2588c64c183aec7e612ea1fe40c5033017e959000000000e80000000020000200000004740a48b370310b995a451f7e5425cd01b05fc59632798c18294b62a5891979d90000000cb3721396613031ca6440b2b5cb6f1718f9d34739603200781c6e5f042b78ea90883dfc23602b2b02a1624da7e1d61996d27d745c2f08d4a641cb341796acc011799ab4a873a75c6be4dc8b39811c46c3a5352c68bd187e8423dcfdb0ae26e8eb31c0708b4ab3b2382752bda230a309c1a4958c140cae4dd4be8dc6cdad643630e0488566c704d441e8233775a050bff40000000608f03a4c59a40bfefbd275e717499fe2272e3f4d318c213c35e7281beacb0acf9c24797f6cf2c216057bd45817cbb7f80d8aa1fff9b382383bc431f7eaef873	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ef8938d2a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000349141bafe4d565662732c2ce37e19accc7643b7b91806e98ae9c86a52ebbade000000000e8000000002000020000000b9f07f254b7e9e647c59c155b03ce1b3cb9acda16c827ed00511d3ef646a1ba6200000004ce49a1084a041fbfe2505daa4ef10582bf9aab254555e12ad0b25c6ac136d35400000005ac33c8bd7eb0802afd942307b30c2182356a16fb18580cc7289613633a67142eb7011300b49c9b0dcdb4ec93c076e2314be27344a52a11d123569219b9c20e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2036	1656	iexplore.exe	28
PID 1656 wrote to memory of 2036	1656	iexplore.exe	28
PID 1656 wrote to memory of 2036	1656	iexplore.exe	28
PID 1656 wrote to memory of 2036	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40b78866a9a679a3390bbe11c19c2a5c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9214de37aa1f699220a27798703ad65

SHA1
797d6df55ec3885dcb280d37471656502763a93b

SHA256
599a0a528099c6c706786c359103d0e24591dd7d2113ed2423b7776faa75d7cb

SHA512
13741ebd0bc576c25ed88c110b7d42cb8db1e9e3b181a335ab3165ee008af2b417007e3d41590c29504f7717f80b1bc65d74a60ddb142da094bb86245091158b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e52dca6dfaae28d7ee72664f0d1395c

SHA1
10bd9f6ca712d39aa77a9b3c8763747ca19c9330

SHA256
cfcf22951f0f4b238af705291e0af08eb8c8c7e45876686d230b888936aaf45c

SHA512
f7199421f08a576cf769cef597f0e710b46f29ae8bea115cdf5e4f6d9da108d9e29068edc135f9e705b9b19b33e4a042576dd39874c787a9ffba0d540ba7a3c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a9f0c18e932d64ad0130a5d9d64bfa1

SHA1
811e9536e25bd1a02e4f4a44a6f61bc924dafe32

SHA256
c693d8943f50f7d4403456478f1cdbc1c5ea49e8295c97766ef2353318a8f660

SHA512
757e4ea4f52a0291303e72f2d2c6c0aab22200cf356a2e9f3a277046d9593e97b334d24d190a3e7060227f94ac1625b045f93b199c29458951efd196ccc3d8ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a97b3e76c0279ac0a57396d5968c0b7

SHA1
d5580889657aa58ebd4addf7bbde43d1a36676cc

SHA256
29852b1d6e30806eba25c46ae6fa4cf6db757c3d79c515c2cfe15064ea11245a

SHA512
0516dab594f18fd795bc48f1c1614b4d40f17fa45674fc58e4faba7a9378ef45495ff977f3ba0d4583861bf67f2cde449696026a20a949134dcdf49eb91d2585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72bbde4508a969471e20374badc8983d

SHA1
2fa37d1e6f76a3ecff5a497f2204b93d5459ecbb

SHA256
12999791c621d437c914b96687e8b895fe0e6b7a48ac50c7cfc213d2d03bbaa9

SHA512
f193315226758a6850a090657f4669e47fc814691ce4f0d88802c37b04c5f9fcf907280bb426c5d9728c48f31f58c7f32f830d8c814a490f31acb401b535ab99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18caa8b76d14e1ca67dc7e9dae142169

SHA1
b9b6f6393888258a6b0d8dae6be324586925f8c0

SHA256
7939e425e76ac622568cdd2c792b47ed422bf98dacc087f0c7545432f56ec93a

SHA512
9ab406cc7367281b67e636496cbdbd0e72a2b621033a436c45b852a06a3cabdaf0d5acd110573b726b2fb28e2bd28771a46cb76b1990f9cbd06ef113ba7ddadb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34097645ca7519fa771f59bdda4b4751

SHA1
65afe48e855d01c916c78bf7afd78ec2d42ddda1

SHA256
91dfdc49b071fd8f6b57dc632221558599e2f205d54ff2bc1506fda0de1e9a9f

SHA512
8c53fa566445d591478e19231e4bba0d2bfa708bb3fa718d280c1223781c4d15903c72fae39512b0c97ef9b3a7e157082595953ffcf44a972b649a16957b589e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc228e0de4d0fbf8ef910a8528ec772

SHA1
52d57e4f5d31adf0443c3d78a5c4ed957c5c4ee6

SHA256
c005caab9fc83fc909753c47b5ddb9aae9e5d926f8082b8b63022200758e68be

SHA512
a24b90ad10236004ccf58657281f72114a36ca42582bce6fab10fc4c6cc7708e2e265af40fd6bc370da4af5359f63dbf9050245771a4f89dcf3654147b9f8c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc9aac2e1e160f35d12ac5b977c1bdaa

SHA1
cc1e293a74d25fd9fb1118e74964dd6417f55615

SHA256
f523370d827e099042487256e0cc3525a182ff20a04b5da275dce948b90d0bdd

SHA512
b10c4af3b0a8becd9e37c8babd2edafdbc9d207f0a4600f86a0b3f7e4a5eda4163dd713cebcaebd173489fcf9cb3eb3a3c2b7a349e4149ce6673d16ec13d7ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e98c3e7299bf0d13e771ceb12e839f5

SHA1
c9f49e39ed3cef9a4c155578318ae5c8ec33223c

SHA256
0f516312d7bfcb2211701c6592908154a66a28c3ce19f5c26565c6b424898055

SHA512
147fe093039c752f8ea0dc6c4a29abdae461dc2fb7143d34ad65e5c0addb6053f37f06425a7d75050b760ee24cb0eee0b2bcb944f8510b2f608aae64f4c6e0ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43d958185cd4ae59fac4f7a842888a95

SHA1
e218adae1d749a70798e08e5fbd955352b4c18fa

SHA256
7a1d14549bbeba1dfdbb1d76979e899620f61c936839f7563cdf96c635bfcaff

SHA512
5b40222f0a08cba9241f50ead6f29ef95f124d889378637a3fcfde3e91597b81e60d19e1d98d4f21f33e5627ef93cc74698bcad5d6dfb96a91090ebf1e5a096b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ed87706f33370217381ac0f67ecd169

SHA1
954769b50bed59b43521725428cf4365e1869663

SHA256
49750bdfd32a6847853db989fc3cdb9e406ee8806b9740ab6efd65faff4d4e55

SHA512
7dad1f8d4b64186a964a07c57bf2a336ef6914682fd0409cb9f5a58314ea87cfd9709bf22415f5cf6fb8ea5f86ad03d6a27b85cf91e407de54f4f55b82075cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fed48ac97ea05d1781ac659e8a1780ff

SHA1
effd73daa98def4d397fa11b827249464ca646ab

SHA256
337612664aa87b9f725331b6060c06a1be778c19f30cd622687915f110187f08

SHA512
e2b1d0a7ce42f1dca051106a5c08f8283fd848c6f480c6d147ad9ed0a4898def2439d4f78ca529e8a026f70de136b0beaa400a7a10a5112c122d52ac2fb528bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf1f3a46eb24f8d64bf4c8cbc0717805

SHA1
2be65c49787fc94c9caecec69bc23a880f26ceaa

SHA256
f7dbbbaf2c1082a65752a204bcf41f28c15532222488dc7f874c8addf6ee78b8

SHA512
9b48e5b1fa5f62acb5de0b7a0abc9c347692f82a99d5c6d72f0629f26ced9d5b242e12ef66175ed4820a30f61fc362af129edadecf80b250bd6d33e727ad3140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
163cbf67410fd88eaed2d974a2923ee2

SHA1
9679f89ead597140be7beab2fbd0810fd0453ff7

SHA256
44bfb782ff8fb85727e50ddb6e8f0413be605b370aa7f56279affa3f16362d8c

SHA512
ab8d10e21b7462a10f2c1ab18a4c33214e4517a973ebb8eeb4d2dd00268946bb1cb69cc9d702575de50f023a65fae7e93d0a27026e8b9d2ae5f053387cb91b13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5afeaaa11eb7c57770af3d0e379f05b

SHA1
00a3644997baae0a5284ab8b0c21fd9a1ae9d7df

SHA256
2cb724ad556dad552b71fd467cbaf9df88c4c389b24e09f4d4aa7d36f48347f0

SHA512
8167a291a36039c05123a9bdcab1921412043d672242950c4acee4c02fcef713a2b6616273801f519609116f7b02ad3e2782dc8694613404431b6f56274fca6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9457af20577ff23623280627d01ce28d

SHA1
4f263f288db7a1bd42f856126e67950371de7f53

SHA256
19c62fcb9a66aa39dfcce5c527babafcfa20c6a5353a8f3ca9d3019a91eebb9c

SHA512
4fe5921749e4a58b8e17037aa0b4862bf9f68d969151b318875e624fdcc5e240bd1a1ef77d686a9efc0a2204e9f9aa494e08bbb5b36eb6b2492f0b4f8969b952

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2ACB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BBC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit