014049a67b70a33a8138f5001dbc36573ea0f794757e9447e4d809b61f7ad9c0

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

472db8e43c47a35a1c28c325ab2b03a3_JaffaCakes118.html
Size

814B
MD5

472db8e43c47a35a1c28c325ab2b03a3
SHA1

a06dfbb5c9f840a9f65a2512849d4dbfc2be9ba0
SHA256

014049a67b70a33a8138f5001dbc36573ea0f794757e9447e4d809b61f7ad9c0
SHA512

a95118b1c5feb3f35e6f13eecf26065c99969299b6ced9a03342fbc619a65c80595e596bf5d4f578ec5b941dd81cce500c8878919cd28b041931838a5ef4384d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14CFD051-12DE-11EF-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30774ed8eaa6da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000066d5240d30f84a41a9c86f92b74ced9e00000000020000000000106600000001000020000000045339ff35444b34be1471426a6ce3a0bb895bd775e5da6eec0c9d3b86983720000000000e80000000020000200000001382f001da1d685af87bbdf174206c43263414e708fa088b509f11e6a84f235a200000006ee4668e40ef5d21df32924fb3722705c4ae340c0b66f8d9ed45233b12503af340000000b04c9e74f699206d6a0d66ea11367c7db845a63070e361596eb6a5f01936c843355f3e571721f049e87026e0890803c91f80ebaa68d7e382b19fdba75aec874b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000066d5240d30f84a41a9c86f92b74ced9e00000000020000000000106600000001000020000000165ec9e6a1ddb71e4226e5d493c9db3142daf181be15a1d31d64320be48d1044000000000e80000000020000200000000ad1f10e8fa87628bd78d89dd69f85013c6ca9f511dbd37d5006420cf4db7dde9000000054f55b84df670b8d5195ae187c4a21e3c52804923d2350dcb6c732b733cd2e5d04b35d63ac2c04072ae58cdc624281ae3341814998b9e2009a2a7d906bc593bf0bbbccde2840f60dbfa76b9b8b4f69b7829ff029551f7481d699f719d58ff568a8182914d77bf0450c01a2c5f5bb5bbc02e1faafecdc8ba18ed18f5deb1b8db1f03905e4fa066aa71cfb7790394cf28c40000000e9d6436529ca36d907cc493df74b900963131cb18db29e9239f0a1a8b82286d4b4b9137d2ca7044c89bc1923085eb2a2fef6968194b13c804041f754bd1b74a0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421954919"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2508	2972	iexplore.exe	28
PID 2972 wrote to memory of 2508	2972	iexplore.exe	28
PID 2972 wrote to memory of 2508	2972	iexplore.exe	28
PID 2972 wrote to memory of 2508	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\472db8e43c47a35a1c28c325ab2b03a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6604f5cc3dde6a4acd0724eae84265ea

SHA1
16cce17c89c4da5896610ba6e6edadbd6a14f998

SHA256
6c167a3ddefd3dd9d101286465c6f46cbd58a9b307eb7c9d25e6d7d195952241

SHA512
73d101bd7c4080ed37ea94905598e2a943ec7a07c81991967c6e5c1183a7d214c04052fe29201c44f7e301664b74c620386e3302c6760fd8612508b92bc1799f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d6e18db006af0fc235361ea2b9f3f03

SHA1
15484ad3bd02a3b7b6b6f14c645ed87b3f47df58

SHA256
043b15801fe1a8d778cc624cbe1705437cf83155db4ddd7e5855942bff699b33

SHA512
c9ddb95142b3b99bcd961277c35689d8fc8156498f8de7af7ef5dfde1a96f0ec212e948ca32eacd638523854c948f2a50d883e310cb01b6a04f5dd2a2edf4326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a52bd678367a5ec0d0f7eba74e3ad565

SHA1
d31614ea49922b971d090192f68d82b0c1b3ad9e

SHA256
41d9cb13f89f7c88431d4198e7cdb3d5c46cc82c6cdaf04845cb28083b66bfca

SHA512
bd4d6e9b6cb17b8ec62e66650d231874e1884669096a63f1d8dbf2672d16b92d5a8be81f5e3bca7b6ba6f78772c947e9d4de681b3f1f51737f4bea7b4109d302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5711064e881bf000d938dbf9f207466

SHA1
bfccc57e9d5b181ed9423fb9604347c86952721d

SHA256
9c068ccaf375a10f8956fe8e7776f0c6abeef1afb80abc4677dcd5fbfdf63062

SHA512
413129e90fb1989894b02a412a68b7a890bf38dba0df9c2070ba90d49333ed7c67ec76c0aa2dd0f3d5418c71ad6d8d99ff2c3a12e8482970ba2e3755e8119a75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a378c3734b160d0a825e61db890c5473

SHA1
ab21e3bf064b4dc0e571371536df967cb69ed352

SHA256
b7927dc38221a79521ed9c0a7ddc6031f49a2351eaf5bad0efc7daa8184f0630

SHA512
1f02854466c2e8b8d1c6592169a4595ea277b5745bb86ef892fd4d523c101097249442bceac1ae1a47212822ea3e3927b3996fe182cd856267334971917fe5fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1531feb35bc53f297d8ef536257ad27d

SHA1
7906fe09eaf58d60cbe76fa220116cb7a32663e0

SHA256
f3428ba38e7fa7789eb8ca8338f4afc5ea951a2591150a1048a439496c4af6cd

SHA512
348c51ab71b262babd2a79171eb493992302691ee47e7241edde0fa4b737b2bff7bc5badee6e70c6b9b2c046e87f2a59cb4de4109d82b23711e21e3cc0c3c2ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e5cee8ae15b89f32e13d68eda00f6e

SHA1
74cf4027b3d88da6b9d47622a730cd545226cdb1

SHA256
43c4b88e5039a27c638254b4a8f0b4e70ad70e5deb587221141cd9b7f8dccfb8

SHA512
e0c4959c78fb30757c4ad55f8918cbf72f89af2393cf24f1dd94132c0d632e7b02f93a7bde2cc12049fad4ecad1dae2d27bc9439377d8f32a77d8cd7ee8def4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e07476442dc94579b895af078c3b802

SHA1
ab0db4ab1d8bf39f0868b6751ceb55d2cc5ffb38

SHA256
3781307d139a4677248104abe326dd8b782e0a3139ee6b9564924024066cfc28

SHA512
a52b64e19bed96b6ed6d0386b70f8f1c5bcadb0f45ccd41ea7d77121f000ea46086bfb3e72b181eafb3c411271e2a5a6967a6ae1eca43925067e137f7e27ea57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5877897aca4cc924fc640f8b030a203

SHA1
71deb62bfd522f9bd7e416c74680a42848e7cbfd

SHA256
c95f9fdaf7024bc63f30faa4a028dec0a6d43d34f2ccdadfedfd8cd849ceeab9

SHA512
479eb7cc096e8d79f3f4a81173f38299c33d1c8050b9634aeb47cf0909421ad29f40ae8046b6ac5e56f07557e98b4f0117c874b7ace4b899a79bf7b546746e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7de5207245acf6fee1e1428ce9523cb5

SHA1
89b820739e39130a82bf7fe4c2e6959d2dc0681a

SHA256
9fca611bc7782b250056d10491fc8b463c217e7672dab9819741cecc765405fb

SHA512
e81fe0a92c9c28fc572aa0b143db61d2266e98abbc2c5a929a1063bd164ec0581dc8034a0f8c4e73a5e5e0479a7ab5936f80d81e88e08b94bf53bb47434f4dbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f680da8a0ad00ee9a2f4d323564275a6

SHA1
6dae5d3622312903458e863224f9e2433268e5c9

SHA256
445a9093f526dbf56f8224e532d88e7ecf6c45a567e063df1d5d5211a066e6f5

SHA512
f0f82451d6324ed30f20e32ed03f848767589b815938e8f2799f363e387ac5fdabdb5480383295964edf4503f759d7d0aeddea0eba462763490e1b244cb4c6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
939232939df4fd79a59f1ffcdd1fea09

SHA1
0ef5385c94842016d28e481c37b18acdbb3f7f7a

SHA256
6f1f61ee73e7571bdc5ad7b6172f7b324a3791bca9eaa0d35d97557c7d34997b

SHA512
6607adc832babc8f2666cc4da3611b9f392e035dfa8da3274f94575547d7055d43ede4a81f2e54c4797f36a6ddbd93aff7e2fc718e9d20d1d474c00f6ecde924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c00f83a62038cbe18f43b2add9b79160

SHA1
e9f0895265f244ded68cb4d166367dcfcab44639

SHA256
39e8902c615d67d8f76fb58f5a900090888059c74c0fd1de77dce7cbfd542078

SHA512
748bccf44c77f06922b7c84ac56eec06405227201050223c67bfb62a807b10c45aea1280bbbeb1587eda5f64b5efa408677acc97440460b3670d4e6eaba14aad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28C6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar299A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit