e64ae9884dbfc969fa5b17485adcfd102a44c1d69c90fe75b3c911215263caa6

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 19:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47bfa96875ed524377b2bc57558dd316_JaffaCakes118.html
Size

3KB
MD5

47bfa96875ed524377b2bc57558dd316
SHA1

48ac7440c1f1b24c496a20159ceae7891e7635e9
SHA256

e64ae9884dbfc969fa5b17485adcfd102a44c1d69c90fe75b3c911215263caa6
SHA512

e8a4c2203750fb98f871c6002818ab803d10877d6a491fc9683904f7a68066b56b234eccd0cad885ff8c95c33a1b0c014b189952f5f95c18671197f2511a26d7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d299f5719a888ccda75df4ace591c31c90802b4092e702c83cdc8e028fa3c916000000000e8000000002000020000000a9a3f252c1249168ab5ca7264055641f4d505ad60bbb60c1f375a205abc1a3669000000052ed775a8cd7b52a95f771cf17f256cdb967a3dfb42f38b4493bbab8b56d4f331cdbbf2a481ef0a25e4e907f59cb7fba7c07dc1edc3c3b77da709163206fbf685cea02cf5077f0b9722e36568b8e28394840e1134fbe82b4aec2173b85d678c160de21270cfb87745975eeedb5e08535c9ae504b48c7168d9ce22e418446c9dd66f844d0057f43513dab6e6b698ecf5e400000007b24fb304031b1f163e4f3dafdb7fbc6af2f98467dbb77b90c1d970a756d07276b7755640d7828bd11e4cc73708c8140932698ed9e810a34a8e6272079c1c319	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a08e0501a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000005f621d69aa6061ed242f022ac9b4d34f2267252d1fc556cd9ca7cb1c5ebb510000000000e8000000002000020000000d5d3e980ed8cc47209b2e57937c604853b9ff7f5236fb5e84bb6ea4c5d5badd720000000756741c842aabf69dc55d914013094bc1757c3711b0ca27f270423f853e04170400000002a3bdd8f79310d2ac0742b043b465945cc1d0de335e5d78906943bfca26b715e7a3612a1ce034164ef43f193bf95710cbf60d38aa1f6ef916a913e05c4ad7e16	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30E73E21-12F4-11EF-A48B-4635F953E0C8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421964418"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2924	2884	iexplore.exe	28
PID 2884 wrote to memory of 2924	2884	iexplore.exe	28
PID 2884 wrote to memory of 2924	2884	iexplore.exe	28
PID 2884 wrote to memory of 2924	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47bfa96875ed524377b2bc57558dd316_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0684ae27f3f11fc57ed846b0e9c5eaf9

SHA1
f95486a20c66e5968db8641dd2bb274b8324fb85

SHA256
63a8adcf6d42a7fc91aa8951dc368d32a4cae21e4cec8d7a4373c5212d5cf170

SHA512
cb396df71d2d63e15ecdda4b630b690fc83f87052f9b0395b0fcbeb2258e21f14f204c6e019a2fe56ec64f96ef7762e579a1838c43aa76bca3433c791d16a00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b6947ff99724d27203b38e2198cf3fe

SHA1
277fd943338b45abc27101c68e612078b1cf574c

SHA256
1576147cc4b25d632dc046febda2c4738a5105aa56c970f0b9b81b28a006279d

SHA512
3f83aed565a77bc4a459351d6302f44a3f21a86fbd0441226fc106e6223c99a37866be7b4516e6533ef7af91091ebfd70a6f5c74ef8c1e98c5108a477fb0d970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eca984a9be6738ba4a9561d2c31918bf

SHA1
27adfae85f6a69238321528cab3652592882fd21

SHA256
e4b41c79058a66f51423f3a8184b4a2e98868f466760765a7cf5c252720e27cc

SHA512
3cd817ac1d1ac7313f25a36e179294362cfd18f3698031ce48efaedef9b9cd121ceb7023ac94ca2d8453522006496abb227e35dd5cfde9da2b617bdd9771b3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22d3e5d563155847f7ffee5cc59c32a1

SHA1
83860d618a9809f1616fbd7f87b13bbee1c0f21a

SHA256
36248ae7c89b70db8606266bb9bc1f472c67c7f4cd232efc3778a23160cdfb56

SHA512
7936540f751e0d9ca1c9c2f29a6a8e083a738506009e541e9966852508e59629ff61bf1f8787f3418bbd56899b7a7177fa4cfc4307bc1a15dec04682f1d5ae47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b47c5f55102d1abda6d27f455579884

SHA1
7dfb6e8d94828e150088ef04016b71d772d2c8bb

SHA256
25dca41edbb8bd8671fa1b5b23bc5736d6f78a25ebda47a233f0b380fdb53e76

SHA512
2a99da5c2db87fddedb44a9ea8c62bfa832696f138bd88b8574537b043549a20ee79a6eb406648e30e28172e41c2f50e0aeea106a7cffc783936fdbcd44bf72a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fdbfa3c8f194ff57d9162fdffd2bb2f

SHA1
98faece5273476ec01e3ed8834c4d8004882f53f

SHA256
499b55049f2a08a4c6b80913c9d5f7e0126fe324697394d0b821819b421c220b

SHA512
2497a3c75ff6c3d0e98a110d3f46314be38711e89b3a699b55f12c09dd883af7a5e7e33725405c12d36b441466dd8e2b2cb7bae9e5834dc5190ec06cfc52e40b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8181571a4c396799596a0c316a9f4ab2

SHA1
2f84cd2fe3791c511058a69739b98a93d77d89dd

SHA256
aa00cb61a5dd108e2e5859406cf7f87fe775c82a0fe1e852112c79a685a5e391

SHA512
fbf153ef09c8388721ce565c5b8548a6359146a3b7dbbcb4a5c01bc75cd43ff9372475dcd027c68b8dfcf97266c629236ac60b1cb50804e3d55c54341263fdf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43ff55ef79a5ddddf184f4d10ef11cf9

SHA1
2da972dfa91cc972aa8043851d8c97497e812ad4

SHA256
345cae23d4cddb1956a6606f155ac0c1397986e5c99eb98836f1b34c0b128e3f

SHA512
d81bddeb486a58814b7fb4e87d5aac03839cc709f1f8e3779f123874b0a193e4a2713b167508074538245f74d04bb767df208c49766e00624132e42ba6e4033c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd8d1d4c1d2d7068b79fdfe50efcde5

SHA1
a8100c457337695c1767e09a8666bc42f524fd08

SHA256
29a8fb624ec31894695391975b4d8c7c050ebc21dd9759b213483a79dfe9e000

SHA512
55052447f450a3e3cc59fe31124f4392a1d7284b547b2d708dc75e900c83b55bc6f6a41024f77c50558e381daf9052a61bfd5328824af9de3f213ca7b2d11fc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c09698eb093fc4fc59535e895288f4

SHA1
cd3151724c68aad50a488f2891fee4cba5b0c445

SHA256
3fc6d851750ed5451afb1464a5c7f6a8eb704d7ac9fba6cf61ff254685e40eac

SHA512
94a869cd686e1b1e32710ef7feb128a70513326e776ccf771ea72c675eade9589b335bfd8f8732cbb093a439340b048c459bccafd10537f416a1ba6652aded82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa7a0793014ce08b7e0d1df373e9514e

SHA1
f44d41908f8149d52176ce522c3e2cdcb20cf08f

SHA256
97486889a4fa859fa40a1e11bd9e65dac14c50ab33ac333e3d1fce02932d5041

SHA512
0eafb223bc51bc2057fc385c493da814a03995f691e62c923fda28d716e0c5cbd4bb5154c6dbbbde0f10b696be1aa8439b7e311df032f66e9a5f647b41f7cab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a226dd241573ead744a4e23112801261

SHA1
875ab4209247fb14b56da2ca380d6afb40f0ac18

SHA256
9e77dfc85ad63cadca29e035645efffaab013acb39761dc063000dddeaf472f5

SHA512
bf00f2041a7c58088fe4902c9db584b13886569ff665a6d9d0d20bbda6ee18b098c6ae2142fe8722dc89075a2a4b6c33d36034399910520c8c9a5eed7fb0cab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9ed4292b8b01787759629fd2250c321

SHA1
79ee2735383f1823a6c50aa38ca25cbf45cca0f2

SHA256
bbe3fcf91b4d70587cb7f35525cf5916f657a3d5308f8525d0c2233ed2dde732

SHA512
3cfe9e2376d9f701f4bdc6c23dc0fb1367296011fd17c199ec0358a551ef3f59922fe533bee6262bf9ff6b160045a54762b61b3cf2ba6a052113afc5f847874f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1de0eafc54ce8afb5cffada195afe2e

SHA1
3eb8f92bf2526261b7178db4ff30f20700f17a5e

SHA256
2d18382cf030e02e664359c0618eeda5e185b6e95da6e5d9b88a30622573e662

SHA512
91130a14a1778bb2a288b38bd2d766e63bea13bb7427356afd82417ffd51776d0e3f4c2b92f7fef19318029cc86080e0eedddbf67c0dcd077f0e7979e4b07f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e526a8b0bdcee0b0b6806ad81a1f93

SHA1
53a2d05b43b8cb4eb50fa2c7eaf33a49811fabc8

SHA256
41f36950adfec7c01a244c82a77cf3760ab115f13a800ba2d544ca39e4426c89

SHA512
3cec0a36a4ce86300aea0a744853a1fd04aedfecd304a029bea39d3bcefce792eab2533ffce3823e21443508cf940962ce27d080166542f6e0bacc055fc3946a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2424b745c9147b7c3a2eeb45b2f7ed93

SHA1
e339ef7e0e534385bb40e0d23707954917327af0

SHA256
44f39656c9b92db6c77eab1a14df1afa1f5fd0f76f4d5dba75aaa280fdf4a2c9

SHA512
c85c0edf6cf7ca25cbd1ca3855423b4c2c40c9cc497c57a807b3ff347eb0158c963db93ad6c27a68fbb13fc374cc8b89dedc764a55254b699f0182b7dc450ed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21d9957eb0941b3f9abbf7560b205954

SHA1
dcf0b7636513c1e9122672945d9243915d79b142

SHA256
7aa5e05e6507306977a332cff3fe856cd885e02a7ce6b948b5570872681a44f7

SHA512
60e1c7005ab8a8b9824c3de57efdd94f13f99230194a1bba7f369ea0acb825bda604c96ae63034a2ff1acb780ffd220c712c7c2c2166401a0425433ec3415077

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2752.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27E1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit