4b4e1235e1369c34238ed5520113447c4da9b3288bbb495374888df82a4dc347

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41785f67a42e271d9eed8ea35f0eb106_JaffaCakes118.html
Size

3KB
MD5

41785f67a42e271d9eed8ea35f0eb106
SHA1

f2c1be38eb306798a8469eae7419aefb263df94a
SHA256

4b4e1235e1369c34238ed5520113447c4da9b3288bbb495374888df82a4dc347
SHA512

65882c906ef38e0db36d224960c6cd6fcbb713251eb5218e4b09ba5f739694de6d0489fe753b8d4e7a30b6b2ee5cff5261d6982074efe8a839812e8e2859dc17

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421851116"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64B8F621-11EC-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000771842123466ed5989a96a872c7a940933fe0b244512aa1dc6152c989cde6b35000000000e800000000200002000000002a74ab96cdbb75f123de3b35b538ce7883ea186187cba62f9efadb9eb8cb62b20000000e95752a54aae2a6a7456f8615fcc49470f2c310552d88775efb6683cc83e758540000000249be7484d0c5047c5019abf969d1e4142149f316fd4da9d31cbb73ff58f7a868d0956d4bb466bfc4c0de17e921e39b293a49a57ce4dde41cc12d6f5d2266ddd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000413b2e42731bef0aedcbde33c2a7cc5f47a27e0d60b09263f8a821bc92f8db63000000000e80000000020000200000005e73167b04b323bd350fe3f3103e1cc6ae90576ecdb497c1f54b614b3315fc2b9000000017699dea38b4c6ce8ae73203fca7f3aeeee481791dcf6c33c65bece98b553691c835a3a0892036cfecdbbec541bc2569b0e5c843142d1b697cff293823c05e8205cf5b882d9880281df2bcead0f56851ca12a5eba8ed5bf1457d46f92079d0d48160681cab7c6020d60b5fcc9dc29fa35b733f70f4b3971e7f1118d2bb19f87ee074ffc9a971f5a559f99d2d4df3e2f9400000004ef41c2fb22ce711d30e46c36d767489aa91329e46b2083a7486386ec019e93f8e66414e62761feb9ece90a63274f51fe4ed4f7766e8782eea7c1ec04670ef6d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4096fb39f9a5da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2568	1936	iexplore.exe	28
PID 1936 wrote to memory of 2568	1936	iexplore.exe	28
PID 1936 wrote to memory of 2568	1936	iexplore.exe	28
PID 1936 wrote to memory of 2568	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41785f67a42e271d9eed8ea35f0eb106_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56db067c78e0a129a551a5cdf69af316

SHA1
3231aec051f42380c359014793c88aab1fae6ea1

SHA256
d145bd1ab21dfd17eb66a2e397af294b652bc5b9edad364d6d5c358f7f35847b

SHA512
f570e8832f6c41c3c2c23258dd48d51f4e1f6ac4d829b651777d74fa6e3f650395830a91b3af42e957070292a1e5c697dd487c6210297f05a13bcdb030f4010f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9454e4bf85428fd5a5b239e9e4e470cf

SHA1
2711905fab45bdc47f59696a90ca470f1afd197c

SHA256
5137d2ddda6df120048896d51e9d1f770c332e163b80902517de2a756c61d5de

SHA512
27db182109b1ffcb29881066d57169ff415d10e63661dbc80e398c308a76d27f188b9d010d4377972b440848d0cf78585978d179162ee1839de9cd26de5e0446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57839bee20427c4e04aed3e39dd04a3f

SHA1
55b2aec503e614513ccbd1fe113defbccd77947b

SHA256
582b1f106bb0aa94309547f682457f2db15b88e8920d8b13725d3bd0737fe452

SHA512
9e289e5c6b438ea06ef12f80812002e84b93b832f9308f0e62a0387453003ca19fb682cd357cde40f36c750d1dcb8dff38da7935cbb8ee330cc69442d46303cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ce64fe2a9601116fa0543b9438ec810

SHA1
fe4db2e8767f77b90c481e94c5860e397736e024

SHA256
48e87f4318ff59fe5058e9e516aecd2d73794ed6a94e2a4865e56a567d53ffc6

SHA512
69fc52650961d9e916143b42a75573bc277743844f7384c9e3293e2908d3195c7634df86ad020402deeaf96a71917e4afda845245249decc850c4cf79b22bc2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78f3c884ffb95b529be53123deeb1105

SHA1
a74a7ced64c894066b3faf326f9c450fcab23a48

SHA256
ffddf5ca4b322378a4ad3c8d7b61f59628869ce5748097ce449089fb95ebc9a2

SHA512
b5d5a6cae6437a8f71d504560266c9488b7d5792e1dee5cb08bff78fdc460b96cedf622934eeb2915a3d3a1ae4275c8ed14d53cedf0136a9a4370acfb53c8744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf59a37f5d7c225fac686b487aa9cdfe

SHA1
fa1a4f61a0e0511527c7887e551b0be5fee08ccb

SHA256
6a3e3702f438bdc88a92d0fa56def28a9c1fec049ae2b336a874b1d4cbf179f5

SHA512
50479cb2abc82b3a7437152363d4ac03816ad5b5392f4416ba4236ea3d9afba6019cc9691b8e8fa0b255ccead83f5434f3ee9a13dda3f1b99a0ee77b770441b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c89836811560cb8c230d864c31a3f877

SHA1
3cac08e7a6976e5ea22db27a64c2224deaa0a7e2

SHA256
d6ee374f8d30f99ee3cf5aa4ff4cab4c19870e5e53ff2856d3de29555bc47c36

SHA512
6dca30f67b83605f77f27903ce2b8c37382d2da16ad6f788db6f1266e6d083be60de1d152af532d598b56f38aa8e044affac9e4f09ffbb34e2eb6f122f6788e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a23cff716c35e31102114e8e955d23d4

SHA1
3608f648c0a7e6f758d2e990273f71c125ef8985

SHA256
51554a1569dddc76296340d15c8cc8ab817fdf90360046a5c6ddebb0cb108b52

SHA512
f4470576a0b393770d5e39892da7dcc403c11781de986235ad9a2d2e2fb0770c96e9a0bcf09904dcceef0d4a0cbf255374182b798a0ec4999837a2d92f134745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80a866879f0766cee3af14ea9edf4384

SHA1
ec9005e5a5211f5dc3ef94a6080a47f2dd46df9c

SHA256
15c6e82c2b12758f434dbf0346d0e1b8e6a1ee878b206ef2fc8c7f3588c885d4

SHA512
c17f84276e50e18ec235c05bbee9933768ef2bda1511cdab3856a0396176aa532955eba79f0ba3ef131c9a0ba4183b116d2644139702f1cdb54f597bfc9f899e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
728d27915f30e4ef52d841b3fa68ede1

SHA1
96fd8ff8c7ed9efbc1d1a6bb054cff41f508be65

SHA256
854935baa36af8f40a10eb962851de49596014849d1b1671902a3d07d5f510a4

SHA512
bc50451af8ee73d7c44d25542fa732e2c9386d6b764cecfc3554be0387d33e9c8b59b1ea53b0cc835bdcf4b8d6d60aa9076fa35e05e5037f7ab111b15404b877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddc33ae6655a7f09f7692cd296c8410d

SHA1
63a9a62f44ed2426cc571d1f36687503debe8645

SHA256
bd2e64f157a92f21583fcf1d5bad487e72d46a281b4175b55f7da2702172debc

SHA512
91208e39e82bec99822eee30dc61744162c02e9e686e484ec63e0db67f7705348ecb46aa7cb7226427c2bc7f260238e9063e2311a03a517878e0f3cfb116ecbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d1c86911fc02d520cf7f4111d35117

SHA1
5d32b940f6c3ca1ee2c5415729a3155fb2740510

SHA256
aa2e9b26ad4892fd080d615564dc1531f3a0cb856bf343f6f8c998fb82b3fc34

SHA512
8395837f35f1a6caf08a13f153c8bf521cbe9744d08561394cb0a31a0ffda876e7527e33df1c41c14bd195a3a8748cf392663d7fb6cb63c7a8f2481cc5c2a449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21a8ce3c34d2ef8b93e161b7d7918141

SHA1
6f67186065307cf7d60611fadd2b48c22718b823

SHA256
06bd937170fed70dfab7afa4e2c225463efc187109dd571c6b16d73ccc9d08f7

SHA512
4505bc2683e0b0618dadbf831c760f01f8bc6746be324ccd8d3ec5432339111b36b0efd45237892e51ee5c2346363e4f09d76bd55fb5f98caba37d2b59cb5c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e308118b5f43533df1b2b198cc3010

SHA1
a6e6aaa9a4738b75bec0a2883f31ee09dc3600b5

SHA256
334b185c763b71a48c4369b34d47661af134b28e0a8177d228f268c719bef221

SHA512
d415ccae67e8811b898a1f0aa178a501af6765f8b1f52a70e7d6892787c620d7362d701cb1bb0ac655fa8602308c55d83813466bfe22ec97e7921dff285b9ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed720443754a591b344e5cc5be9da9c5

SHA1
635b649cfb74d79310c6aa9dfda30710021d4613

SHA256
5554d9427b3e652113abf9f09449d59c1ba76606411f846447eead0111bdc7bf

SHA512
5a10dfa34e916fd5f9f95f2c38a29478a625a2e0d32abb05772e7a76fbbbec9c9debcb8880e61f9fb9fa802bc20aca7964e006709ede2da77df912ccf81879b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7393a09c2818ca92634640b349e64b77

SHA1
2881ecd39d46111cf7033dcf33dfce99b5cce545

SHA256
81b450b02bfb45aa1d97715a0f8e7aadde9e88057e91601482526dab94f0f636

SHA512
72f37f7d419c1ec5d4bf6de6f875afd2fcf5ac995913c316cff61489d671ede292d781851676daf47196560fd9122c6176d45e965128133b0fead4a9b6dc8667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c43f626f53f583283ce68cb445be93a

SHA1
ad3ce509ac0565ab4a21bd6dc1db1927804b5014

SHA256
d8dd7c4a8a372ee917ae59447f2def4c439e60e8b7e66a5f01e12467827d76aa

SHA512
cbf2299b2e3588b471dd586e7c52f16d0abc29b7a83b78075f81b1f51638530f6f31b91eb154eee486d4e39bf32f1629e65ee5a0572ba9e9cb7650e7a30f6b10

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD9E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAEDC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAEFF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit