16935d1f601d1cc8cd3918f7752c2a1fd81f5bd9ee1290099fdeae9c69600284

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

484487d4f3ab6ff3eeabd31cb94ff30e_JaffaCakes118.html
Size

930B
MD5

484487d4f3ab6ff3eeabd31cb94ff30e
SHA1

83f5bf05f817e67ee1324476cbe2ab8db216c316
SHA256

16935d1f601d1cc8cd3918f7752c2a1fd81f5bd9ee1290099fdeae9c69600284
SHA512

72aea4040486615e526210e18f68fa02d8ef91d857b6da9839cc9e2a63091ed992d1884dcfbae9cdda52676a2b6999885c79b5f7eae94aadcf06985b70d3540e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004ffd9208a8b674accc4011826838e7a8224e791b5e6f365cf38e4e1c6864825a000000000e80000000020000200000009be4387e77c49686b949c1b349b1fd621a8e37e8273141e141c285412499647e90000000c9fc6079dc4d217c5c6985f7806c218e4fdc071caddcd5574f75375cd54744e1740d20964f345890e8e6d2e1f2788710de261feec5e3a5b73638081f67f0a2a7170217096376fc96bfadf10d3125c2d8f00e5852e8390da40587891ee374ee1805dec26d5990835fb4625d025313963e20041c8725a061e29d00464319e1b1a767b522538d37960767fa8a75a11a26954000000079c91be885ec385c9043a72ec6ab40dc346a1dbe28037a52bf40006f3df4b79c1cd3985f020f52026a0dded4238425c806e39a0d210a50a72c1e7f3e6676b9b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a9204038bb08ea9329cfc7198d045cf8db366498df6f48fa6a2e27c64494f55d000000000e8000000002000020000000bbee4282b11ee733d10ab4d500b8cb89e3629b3610434f49302d8dca6b74039b20000000c073509fb0cf98946c8d56b62b3f753f744894ada87fd2385384db95791204b5400000008dd7522cc4efbac53d66ac8523a31c4763508bda23e69bfa844cd1811ae0e769329aaee80f7920daa84d894434c654741edc085b4675d013de7bfba885d55b33	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421972993"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05653fe14a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29CD4801-1308-11EF-B21B-FA9381F5F0AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2408 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2408 iexplore.exe
2408 iexplore.exe
1308 IEXPLORE.EXE
1308 IEXPLORE.EXE
1308 IEXPLORE.EXE
1308 IEXPLORE.EXE

pid	process
2408	iexplore.exe

pid	process
2408	iexplore.exe
2408	iexplore.exe
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2408 wrote to memory of 1308	2408	iexplore.exe	IEXPLORE.EXE
PID 2408 wrote to memory of 1308	2408	iexplore.exe	IEXPLORE.EXE
PID 2408 wrote to memory of 1308	2408	iexplore.exe	IEXPLORE.EXE
PID 2408 wrote to memory of 1308	2408	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\484487d4f3ab6ff3eeabd31cb94ff30e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d67f343ec1df4f464fc9172e4a214f61

SHA1
80b90a14aeaca7c45b66b86c309e63df3527fc36

SHA256
ec0a6176bc4ac6a2bf64f27ef22e231765927deab2ce5db68661b4d3e0fa3230

SHA512
c10f4fa30261161daf53bb549921a36efae7e70112e614912cb9ecc98bb01f634cb53f6fcd3eba7f75c7c2b182311d7b90720b92181f497b369bfa822a7df5fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af437023310c7d7825e5c97b45934ecc

SHA1
54aa87daf5c5b2e446c502e1ce55a068c470d103

SHA256
0e8405458de42759771799d15555009584a6b744f39a58c20f26a13fcb813e03

SHA512
36dcb5d8747b5a92a92cfdf6d7982c6767a465116525bf46ec86fa0e0466fa2b96c932477c6482c1c9f0c9bcb4434d940bca9c76a5ce62244379499f18d50842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bca9702f89976843f8ac9eb4ab12a962

SHA1
3622b7830653921fa71147b7717a47c4a2244cbd

SHA256
6a8c47e7caeabf09c733d7a5f27e0748b74a63875a0aab15550da261219ac3ce

SHA512
23a40613806df70429a348cd673e7df51f5135802e9f37d72ddd1bdc93a4875d4400af7404e7f7d726589e77c4cc356ad0843d6751a83cb390a11e032c328ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1935c4a97c212575a43d70764ea48e31

SHA1
f59e403bb2f4e842a9fe410817bc7630ee9452a8

SHA256
b866b2ef7233fe890e5b8dacdcc96cb98e8a88081d26589d2a30f567f0d382b4

SHA512
c7e3b19259b73d81337d68b7bc82517410f64e92dcce36a4c0e322949adf82f131acb53b429f54f695d0bf5abe7aba2d7422de71327897d91afa27570b4cfa5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cd17b62f3939dc82decd30252516452

SHA1
39bd644a91335d703d89ceb651684a7076c4dfce

SHA256
6575f37aeb574eb82a6dd23fbe81ac88b5c245866c1eeb966abd30027979250c

SHA512
ae52a0223aaddb91e206c2e70337b4b487903c99da6a32d1c143528a67494b551a5aec2779a27171dbdede67a1c3758fc5b961acd0e5c6f77ebe5de5a1acdbd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a6fbb01fc67e6d117e41a43ed43d8d6

SHA1
697ece6a5a49117e5af537bf97809ce986725147

SHA256
6dbd4b969d2f61bbe246631a33b3fd2756b530d4a1cdc60370ae4043b871c4ba

SHA512
e1f8ff8e8264c63da25aabf2019da9cd9cca1f9e56c7f8820c6a93f226d004f739f502e44956e9b64745bcfb58caeb01b0ccef10906782a6d0dd9c89b0ce2f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd0eff6ca1dcf91405d71f3191e74153

SHA1
919e86b1554b665b39e176f5eda93ea559045855

SHA256
b7f14153fae034184864d1464394128ed24c93ad4529412704b1f02f803da451

SHA512
87295b574355108886f8495cf009a4b318b6e072272018c5dc11ff00e1c8f7cef0f409417722abf9535e656610877e2eb682b1753b4b9222be06662359228ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7ad8e9927f668c984052d7954147aaa

SHA1
6eaf553b9a2b00c7e77f6a65e6305b5ba11a883d

SHA256
45fb6d768645e9001298387212be1b21a6f05213ef8f9951da1404882ee1860b

SHA512
f759041e32ef81e4550b0b93779832429344dc02b797c84454ece834d0a2f090c25f7b1c65a48ff207fda44d15642bf30228c5b8151495578e329ec6210606f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c89f3f8e611aac92afd628d765f12f4c

SHA1
000591eb284ab34ab58ecd028e2d45e5ca80a286

SHA256
981fa7fa45e71e7f29c8385e9d039cf7dbe542e4e56b91604a334021a18a9636

SHA512
7e45d744643cb76bc76836b9aa6e5beb20e7746f456865da9dc6072debb40e23131e9b6377f933c52d730762332b896e97c4d43de070be66a29be883ffa020a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fd4b3bad952635395d823d575c32876

SHA1
30e0fd6cf9560022b60281c1c73935773632840a

SHA256
2947523a6bd5669caed24dfd618f9170f13a29327b3bec6db6b1054cf3507a5d

SHA512
f0a8ab96e3e9d74a1bf6983006d0d4af60e0df33f40aab485ca9e58868c14908cfe01ad5afabe1fa78f28077249ff5d05cf946c92119d403af6dd3bea00315b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c27ff9b2efd7edf16d8301c3d6387d0

SHA1
4000a16ab82f1a80fde25393cad3dbe7103c2fe0

SHA256
040603709043923c32a93ab05ba52d9569addb61284b36281b859ed8775f4c90

SHA512
79121206eaad0afdb745c8e48b0579ed9230c9a45ed46c24954cfb27eb85443e53aa48d68fb7e37467269cbb237026ba98369ed32be04f485f6098298040826f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
055012488c01f0461fa56a9655b56adc

SHA1
0fb8578e14df409e36c7a284924414790006fe21

SHA256
153ff6535431fd82d89673ba124ac1983186d3ab459dd9735b2cc29b37c134e5

SHA512
d8e3ffceefa637619267074f95012517058063c3a35e5c5e2f83bdc3f30fd536a1259c8e5a0d03100e5a6a3ed185714df0325479b925cfc0cf41fdea8ded9ce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6d999db51fbaef5ef5362cdead612ab

SHA1
ca04a200b6dcf767720ad3545e98dfb90513e8c9

SHA256
9ad7a204fc204dec754246a6b28ec9706f32ad4c9221edadbe08baeb59d7b3f3

SHA512
6231181a4366d6510b9aaf170b8768b130e421aacbc4dde3ba99acc04e4145c9c39deb2d2127f36bb65a16421ab0e4d3b3a075a5975815bd5f062b80bc3cd29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3df1b7acb57b65f92de5235433d50e47

SHA1
033ca77ffb10fbc380601f82ccbf5035ad62a5b2

SHA256
bcfc9ac11354feae7cd06ef9711fe7d6f5a86a2c142015c02a12b5f8f18f0561

SHA512
08fb3da70608d835fe7ec07a8b229fd9f0844c5de2e219035d1fb18c07be29f21a6d495b61111e306c256395d54ee8a258945b4e03b3ea019d1b8940dee21c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c1b0398933afe8abe85dac2487fb45f

SHA1
63fe6488896065e497a1f23e8fbbf82b97386339

SHA256
6861bf50e3d1605833fb10e618e2889b35f8e3f392c6e4528fade675dc719c4a

SHA512
e55cebd85d534908dc9596c863f20891c2f796641a9f183b6acb64bcf3a43d6de1d381be2d5aa8fdd9407e30d83aef0c260132583cea8dd29a89f34618d97714

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3871.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38D2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit