afcfb8035a4723da19d5ae275a41fe6641b01b24f94b37c11b24aa1107146014

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html
Size

2KB
MD5

4d5116f59259ee3e0c00cca4a7c734c5
SHA1

4328db2eb90496676e7d6ef656ba457e00075e3f
SHA256

afcfb8035a4723da19d5ae275a41fe6641b01b24f94b37c11b24aa1107146014
SHA512

46250191516cd1f44a241477bd99bd1857e59fc223a27ca03499cf6e9d3516e5631a90fb6c1e5e67465d539b81622c18c0e05821cf5a5877fa89837fb4e046c1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0993a3be0a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66A72541-13D3-11EF-BE4D-CE57F181EBEB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000077a5a34628ff077b6944967c8fca7d7d020359a96f1a1191d375122adaf56d8f000000000e80000000020000200000008e772d4547dbdb3a1807a170a57fc2bf816b167796ffdf6336b2dbd9fd1e312290000000d59c9ccf7b0dc4e49ec569eb6178ba942f6e30235eab5423e0f5555c08d383a92ff5eabaf4f8ae1acebed33389c6887111ba783dd32caa44776ecbc9b04885d58ada32f5ffabccea5a9a7eb36077f301a723aef05b5e03f6d55af2f21498fb9bbb8630215e7aba604df2fde5c5e3ba9a883034db6dc2debf2f6d6b7e919bfef739d277ab49e657606bca6cf5ccea7d7540000000065fd7c22477d88d4d38beeaf23494f8438d8a2a9b773054c9ef185ccb4711763755fd6ac149d8cb873bacf6aaf0d13a70f2955dbf09d50f47b8d84e73c3b618	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422060282"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000027573110fd212e81199eb51040bfa1ef0eda8e11ba504a0720c44292a66ee29000000000e8000000002000020000000ce5f6ac589ca323d7359b44334b4fac5f9796c3091ccdaf625891849dca49b2020000000f794e5a55a05c990b5dccaecd49254fffc964c43321d56c2ef968ab635cc7d1e40000000a02926552a4c43479ba172003e0386ea3d941d189d209a59c81d15a4a16dac6989bf736868f1e6f20077a469bcd83fd69c6a66bcf9a5a33b7b83ddfeac063746	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1764	2036	iexplore.exe	28
PID 2036 wrote to memory of 1764	2036	iexplore.exe	28
PID 2036 wrote to memory of 1764	2036	iexplore.exe	28
PID 2036 wrote to memory of 1764	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c245a49bb9e4ccc23f3dba6554a978c7

SHA1
a1db359af2b005146eb5f7ea81e5b4a8cb2def77

SHA256
e5509d615b15aa7f68151838d6b78aab4f9b1a6d28d9e0ee8dfefe162e7d01bf

SHA512
6539d93752a6aa3717ec5205c21a0ea17402e47a4db5a2c3230614b944645223c02715d9e1ebaa834ae953a95a8229d7e3adb769a96cb3eeb0e13ed463e38223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cbd43fe5245595e8a06f29682447e59

SHA1
4d4f4a7b133004c4b00a7474bf3b9193f7d89b47

SHA256
473f953d6ce9f1c426100a4f35ef781f1a69ec5ea4e2041b60e00b7d25820694

SHA512
01e1d57b7ddb27d13c3fff4ce966ecd3168e2d9ef7095ae4b4e9f830ba0e7c827803ba56e144d7ec6407855a4dd9f4720743a8c49d3f09aa302fdd8d317930f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39af1e57c1b87850328b32f428489a15

SHA1
510341ca6591154d6aa5cef80ce5c00a7897bd5b

SHA256
ec83a7babc77c07628203e12cf5eadf851bd225a32aba5c3cd08d0c8a3c7f8a5

SHA512
a364a8c6a903ac884c96d10e17d04e36e242a0f02cf11d931677c91ec0ad7676bb21611c0316783872b3b00ebcaab7dab04247eb9554e0031a4667132848b94e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b16427850c0b508e29f09dead8e58984

SHA1
d895210d78a492b8edb4be261a06c696196e3647

SHA256
dfa6049f6297d18b321ffd27476c0831e90ff4cbb03e38dce0a5ecf848a57305

SHA512
054227deeb624db1f8369a0f5e1a31c7abd620ce8dd9a07870825ce3e63da686215e40c743d4c844b30818011119cb07eaa8e39b3c12d4a47c717fe23eef42a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb01a5bb079270e19bb19e4e0224311a

SHA1
21d5e0771058c2d044b6ff8ef7148a31095e4d06

SHA256
26aa30e2db3561ef8f9bdb0b4f47fdf5ee64f15079664a9394752094ada26f9d

SHA512
34d92b5a2e7809059116c46874d09e83f98d82d785db0aeb7b7ec1c3dcd9a2c166f336462673b145528ba55362109d57558667b93a90aeb4c24813c6ee3ca5e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a59812dc4f5c6445845660515eb91726

SHA1
aa52cca5db33ba9f5cab714bd39553ec1a78162a

SHA256
c4af186e2aadb8ccde984d79d2783d2a89d0407563fc08a23a8d1ec5da648d8c

SHA512
9bf96f559e9e410d25a93edc9c30d715ff10b3b32b73c0331454489b35098d318c14d17cd51f7e32b01f91c6e0e72f7d5b41ed6e525bf6f3827610ca2b614675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75498521a58233711d2a6d35a915eea0

SHA1
d237a5a23f9745b2823fc0b70dacc10840dd2b51

SHA256
0a0d563cee566a0b676f24710e2ad36ba5f709c06045f59aa4f7c1472bfe68bc

SHA512
f1695e9ddaa9063d69a0d46e3da3684a8487d68e1c6a9821c96f4589be7345a6bf3409f6d4f864375c9020495dd72397aec06658a9b928b5c5c47a6d50bcd748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33c574e667af4076ffbc553e67e941ba

SHA1
332e6be2f57b88bef32c70d4ac43a491ae60c17d

SHA256
815ba29588c9c4f8e690d6afe58c717f8583c7c283e2081c7b3a18d1ccee65d6

SHA512
2f5c543775a07b46dd960d61ecca3fc64a06fa681e001ab79e18c58328830b31fef74410834d666afd5481ceb618ecc3e9e41aab25b1d5e3cb47459a4505b45d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b00f60c61f769bb5c1b3d8e03ab1fa9

SHA1
0882a4ef8252c6be65290757ed3d142d53f8ccb8

SHA256
7c1a8b3e7ed8701c09953f592e02a92daff061bd596a5cc8cbfb962e7d7362b2

SHA512
fbb50033d33001871aa36790d0aef34cd6c972f93dc42d7afa0b5a8651fa5d6a1a7d409e98ab88b26b637d672e8f50dc2b4053f37dee22d949948b6e840d1180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70b7dcade0756483d93adc6edda12b5f

SHA1
6de3a301d76ff9b580eba1942ff94fd2551441d8

SHA256
e16b400a0256afd735826f46502413d1e7adf87341cb3b18174651beac168b5f

SHA512
0559b72c70596e1b1ec27ca0a1af063735a2e08d036fc7cbf6f057411429bb89bca4840e8c2dc20fff7112cd3089368ad611dc465325f44d61e9d34181ab6767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec7e65e82f6718f6539ab54745a90de0

SHA1
45b2837695e92f5fea76ea3c28fabc5f6b6e1e50

SHA256
cf2d9562eee99b32ca398e786b77c867233f6cc1392ee6fc97494326579b37f3

SHA512
ca2fe03405410b164cb040a8d4bb1167c6c090dbbcf41ebb07605ef7cb59c82589733147b6fe54bb787f672805ddd962f5a073f424ae6492c263ac03b741e6bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e3e874dff9fcf6f18cf160778366ea5

SHA1
687d90e07a2e580211ac40838ecf8281f62242e1

SHA256
c2b83ee18ec95da975952e18eeebc51c218dc8d8651d998399af75bd0c187b29

SHA512
626fbd9d56d1108dacad6edb10d165a634635b25a4b3c82762bf2d53f87fd8325f140a86d863418e8456830bc6a446c13a6d0b33ae7dc86f24856e927437d933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88cca7d453b2991aa3462900dd9dd2fc

SHA1
581e7a60e320c7adddc2863db242672bb39763fc

SHA256
52dcfb2f6efe386fabb42edc757aa4ef1a0484c5da582d15ba872241ca174a83

SHA512
8d70ccc4c92976a63630bc340a41522ce6c39848848185c7eea8e9333d75c1588cb6e800026a4f62b39c19c9aad7fc4a34d589a59db05b4b80971570f412d96e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccef12dc220b8683e100af8aa94f0405

SHA1
36fdbc3a9c6dcb46b0a728521f54326f7ade0ec7

SHA256
88ed9d20555e1aecd3407de2c024183f22a8d0d95349ca4e10ccd2a2653c4e20

SHA512
a9b57a1ae1ec6a362a0861c2af3111287e117bf798e710bd2d2fb188a462fc1dde69177aa1eb0d15a23a238d8953f5b353a2962075646598c6dda4824a1005ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c3b7f076a25ffb1a7c12b5873d09498

SHA1
83a0b8d7a8c9269f18b2bc28fc8a6dc57414d0a7

SHA256
f3df049db8b74bb265e10e764f37b73aa812d37a4ffa77b8735e3f737f795457

SHA512
d277e01bc475c5f2bbe34907c46cd91986641678d97d4e0b7f680d501638cb974fab0d292e0e5f790a119a77a4e95f1b81a560b2152b64035c4ca09e7e551fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33f5cc830604f2f8c67020e2a45ed802

SHA1
4100f12f896d4bef96e99611d005a8995c3ad7ed

SHA256
c8cbbf1d043561fe47b594f52ff653cc012bfd4f58285164e612151c9a59188d

SHA512
7b20c5914d0179ed8429ecc021617ece7be2422bbb63863522158ec38cf39ef81eade52fc131fa7c917042fb71270ace782144f1151cb48898f1890e1e6e5bf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e865355a8b2e6d142c9d8d0a55828e7

SHA1
843e03bb33593d028d26c0a843e131767aac1426

SHA256
c5f0493856b6f2a5ba30bc6d924d4fe6dc1971d610ec751d6040d914e9325bde

SHA512
1012b6094c3ef0a48e04be622b6e5fd279c99c9d643b0c53d559695ddea9cea0ebaca96b8a36f4c4172a59fb01da73e43508b86e29455cf6de9aa664f60d9b71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3489.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34EC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit