3a19e2c76834f34786c10fa1446f91180719f70c7e75524854b4ced6810e2ba0

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44ad4240990b998096eb433641f46e85_JaffaCakes118.html
Size

3KB
MD5

44ad4240990b998096eb433641f46e85
SHA1

cbb3bc8de042d71195ce09d6f4f665eff4d830ad
SHA256

3a19e2c76834f34786c10fa1446f91180719f70c7e75524854b4ced6810e2ba0
SHA512

c0d000a42a3cabdac5a5a2f2e44859c123b53e5bdec1feac5c7b226f7eb4c93b983d7185d8cc71984898a39a767f66232dd42a1ae646e0d60b5be39be4e59341

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e7d5a4c24736f2da3c2d1c4850c5b06f9b1553225b106e8e3c1145411e1386d0000000000e800000000200002000000027a2866e653ae6ca291deca069214cbf372389b4e06590c7ace9c5f2991f430690000000b5e3eeb4959dbef765d4687c66f6e6062bbb2a0b3711fbbe0003ef007fc90f13e85f15d349337655ee3be0eafb1a0f731575803c90cdf7fa919bd81b2d0584c30bb38ae6a4c2d745585ddbfc6e6947cef4935dcf2003be3187c3c67319633c143a4656d8cf138397de272d2dd12b1788609dc60ecfc0dfd6a0fd4c7019cacea1a33739dc01908de1dee1f51fcbb0e350400000005cb49fdfdcd7386108e510dc2e6634f5f7fbe8d5c1545508e95f4a3c5b314d384881322b1358d3ef755bb54760050f6f7bc6fc073a568aac5735399318835679	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6CD4831-1279-11EF-ACD5-4635F953E0C8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000504d02b22995ff9eca45a0d3beabb856007d428f726a402217a1cd532e680b25000000000e80000000020000200000000151f0a17f673c3ea9daaf52fc74504661df69a6cebc9849943707240d80595620000000532dcf577f100a7ef6f090b15682aecfd679937e07e5bae21b1d10fad6ae83d840000000f3940a4d9958aaa402ab833c0ab1cb87871c6d52ac2ea82af46518b5bcd81e7e77fddfed115cebb8951b35d5888dbe6f6fc99ba8a2859d3a2ea45977581466fc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421911918"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06765cb86a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2924	1720	iexplore.exe	29
PID 1720 wrote to memory of 2924	1720	iexplore.exe	29
PID 1720 wrote to memory of 2924	1720	iexplore.exe	29
PID 1720 wrote to memory of 2924	1720	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44ad4240990b998096eb433641f46e85_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8be9e6993d67bfbc5f7554be983dd97

SHA1
55071284a983988edb64e051a53ba284bf0dbc4a

SHA256
e67916462b13f6ecf3c3a7eeaed707751f10ad1e8f21284c110b8a822b22100d

SHA512
736188c8a8c3251225a6a3c958f69371500563ccf7b1263db0cea4c2bf2d122e4d3a93d8be0c6c5f20eae3065d80844c77fce280c4e88415b1f16954da462841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19b83d797a0179a74a4f9ec00f357c98

SHA1
1d0a2890a9af8f8760c1c2ff0e8d1049293fc282

SHA256
3f26e2d28fd0ced46b3c5e5d1358e24c246ad85a4ec3f8ab874ea820ece4557c

SHA512
595839eaa632f24c19b6e90cdb0c1f2467ef54f652c409fea40c24dcd1bb0639b057bd9043f3642bda2fe338e5a0f94b7117e302ba09ed833f5e97d9e4361939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d480a6a0e7fa9bf4081b61f2d0819631

SHA1
26ba8d4c8e07696b73b37cc14ceb6d10cda9b564

SHA256
c74609acac3c5eb6f7a9fcceca0c79d69fb9b851ccb88ec5c0aad1ba9130110f

SHA512
e2a602bd4018e8808abbd85525ac833b23242c58375f7796958e94364d1fcd46be3970e41d7f6415321c9cd5755b8bd446e7c6a7377719663e4211fce8704d5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5663f9285e8bc3f10622cf6e7ab65bc0

SHA1
536b69451931103bb45bc8789b1942a12d5e0844

SHA256
1d4399ae321a71a6e4b98a9e790d7787f65407dfc1d3474473bbe25b0f4a7d3c

SHA512
a9000a045ac9a21a99ced1072622214f160a0f0534f384b5e0a52b3c204a5ca596d8ce7b44437469d32159eff12718f5c7e7215967ed49873264a21c6adce73d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d3ebb878917603851f206e1c8ad3e5d

SHA1
4bbd7ba7f5c5e83006eda1c67356f5947bd3c407

SHA256
fc44a768538f5d358b74a7220230d005de2a4bdcd53b2b04f2946d6373a32894

SHA512
701c03d75ebb138b283dab0cb5210b8a5c842d63c640144a1df0b87a82cfda481a98463e28a6e9a1abff271e7a12462f38448414f33d0e64d68bf1d6503e8c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da5e83c0dcb7ba338e3235864a24a88c

SHA1
18a850ee1953b490105fd17a4c713a4f609976e6

SHA256
edbc6cb7b72f56104f2770610af6ea6392edfb2e8bad83827a7f3692087c1bde

SHA512
be0f0cdf33c6e566ddba74c7d9c50415c4468bd45046ef4915c77f2b20efd377326b3dc3abb3b7aae8f3406fd0156031612bb6b52e8115afc8bc348666bc0094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceafc2d9383d0bd3b327676eda60090a

SHA1
d0d0624f9952f5eb6d035c730a4eb646e21796ec

SHA256
32bd7428924f44966be68f7b3b94bd57b1ca0dc0e7cb64e50e822f80249e7a50

SHA512
d7a5a8f82da923d78c802c4b19490c1339d5a9eeddff3726e54a332886c5b7fa38235c20a5a533e367d4eb4ed1337d98fe87d4b93136d90716c7a3f4ebf16a4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca5832e77db55c60a44ffc5e1d9b8e50

SHA1
df3c21a581b47aec3d08061a52ade7c08ec5fe67

SHA256
9da1a930cdcd516ec46d03c9e96a618b1bb02fde2be0e5415209e21cce3d3880

SHA512
05a5a68cec5ed3adb73ffed6167f896d2acd459716c86f026b5c8752a2a10f2b9b1455b13661624f03c6a520503af703ea3aff84a11bd5c726ef908085e9eb86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
853d110ba0cee9e30297a3abb5d5e2b5

SHA1
f6a6e3fbe4840cd615736ee5873781f00d854276

SHA256
c65361574c22daec21c388c5b56f264fc01a33aea60f53b76364d5a3efa789e1

SHA512
f4f76629dfdf1e5d0156894ae88e94da45880306b10ef434d9e0df840654f115d647d774d542b6d1fadc652af2c210c2222c00325a51c45b6af620f3270a7f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10d4ec3e04f86a4cb784689a00ca65e6

SHA1
80580da7a5ba8217aa3d84b07360dd3ebf3d8d6d

SHA256
39848811b696c850a872933d780fb98f4b12e29544c20661ab3f4fbff2dedc27

SHA512
ac2faa03b4c9e17900a00d6e0b51e15a17c1e6836f0849b448d0ddd856ef7747b7c263d834c73f4947dc6d7e74c76a10a579229d956b48fbe50e7eb29020674f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7794baa0c15196d724ed9b80e77f9317

SHA1
e4a286c10a48dec3800474d27a078ca5e0aebfb4

SHA256
057aa32b1e9bdd2a2174a8386ea091e7fa75f45247ac5630261a20ed7f450a27

SHA512
a21a5257a39f8a149b41937f50ebbc891a9cca6d048453b9add458a4ce834deef68b2e300c742b21329defc309038cb0d71db343baa7f1915c4e9be260f16422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06979a79e75a03d02928c05ca034f5a8

SHA1
d0d6b30c3f2da82d8158999c2af5a6f11ab54f15

SHA256
9ac44168260fb619cca7030335c02b859d7711e09faaa92e4611339441e94724

SHA512
49120cdd6edf87658b4cf3381c043826c34e551b3ff8d3c22079cf6ca33bd224e7d1d83db82781cbc0c5d8bd69b3f66ab94e5d7c2392d5cf497b929aa2a8ca9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
161efea18e9a381c9163a9472c78139d

SHA1
4e72502b22a42e6907fb042069f314c3d7d3d326

SHA256
4e76a6416353d7eec2f42b8cd510925a0fb4ce543e89a9928bcb609306770eee

SHA512
56fa9dfe7736a86cc07e5e174c7909c488b9bfd17669b266b4da1473c0187a33d281b8afdc4593935ff342233ffdedd8fa36194d7ca09761326e304dbf9a5531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f694d32221b105cef7204a629346bec

SHA1
481593c30423dc7b5274517095afac80f003b427

SHA256
9b0ade8ef6ddb61eaa6aa3c52610100e3b348040794fa4d9574dc2e4e7a15d8d

SHA512
553899c57ec8a5ff520aed5eb26ec587645a27c7fb47293d1d8b232dfb42daf49e901a67989607d4f7047ed45b7c925347b186437c2c341e9f2dc1457da084ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af0f6937f9a9ad663172d81e3f8218c

SHA1
ef19dd991b9807ffa0b4e8a3fc0fd1a43641b29b

SHA256
e0cd4ac2ab29c10a379af3e09b826ac20ba6767503a7d4e32321725a721e753d

SHA512
e32e2643551f4daf93d1cba21e63ccfc0f4c0e024c13d84a470494572481e3cfd2fc7256b74554591700b11861fe5e573073e66d836352720fca7a58ea2f0f3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc62ba1df0cccf32a7edff2c59caf9ce

SHA1
b1b17fb7d667486c3e9f5672e33528203acc8ff2

SHA256
aa8778c18dd9ab40e31c2ed805c089f3652bca723dc850510ebbc0aec788feec

SHA512
1b097bd40879e6f9c2778228a8c945457c67a75d89e8bd8365b6374d4a9e4d0550e2c0a1936de2341395ae53b98e5fa39162afdd70b81df101125c84cf0f867a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
802fc798fb06668dd19b5ab9cd51e428

SHA1
c6f5d084f07eb28d50fcab898da3fee5d68705f1

SHA256
ac4fb5b6075571f4adc8b76f25a70fc1f053b654226974caa8105f0d1628d39b

SHA512
98c170ba9b1ef24cea74ce0d195fa6912fabeb46f6c79cdefe4126d2b7e16ff7aea4395fdfaa88645f15a6206140a9ed8751a22837a0a92ae6b3005c41a71c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FD9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar302B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit