2c3222420327189ba22bfb8aa092d80b194a694726b4df2a7ef250a38dfdf428

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49cfdc297ea1cfcb1d481e7f1177f78b_JaffaCakes118.html
Size

2KB
MD5

49cfdc297ea1cfcb1d481e7f1177f78b
SHA1

d5470ed502328eea06b309fa87c06a296303882a
SHA256

2c3222420327189ba22bfb8aa092d80b194a694726b4df2a7ef250a38dfdf428
SHA512

91940230632e06b2a19ac905fa9e47bb804141903c03f64b0fefc5afedc0437b01c2ffc0b2ac9d140ee6d626058d899a137c971958e4bffd424829a81150e23f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000493c4e429f35ad11bf981e412c37bfb4ed5074d9ba2bc677e0557df7c0af3713000000000e8000000002000020000000e4f04c7212a14ec062962b538490aa037783b2283c565ce81a426f887eb018ce9000000084986e1d19a58ab841fdacd8fbc714d0fcd7bda491e8731f38a7d8ef2b4630ff1d79d5223ff31756d947773b4d47819f27a862f1343c98e296931f01de3c2ad9bcc11739363d0c9726c610d32e02c016dad939c21bee512004daaea15127168dfdd0167344e77fd5ffbc1437cd739746ee6ff64a26f14c168e25448a3a6a45d222317cb91d55382c9c1cefe46f1310e240000000b67f86bfc8cfd0b5da05c78e0b6af554bcb3db46f56e6de1a3b7204c3418672bf8711c656bf6d7442b6809a37f430bc03e8a4c6778622fe2691945b43303a02b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{117926C1-134E-11EF-A7A3-7A58A1FDD547} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000cb4ad0c02dc28c443e5331ee973181ae4a17c0851f05160e7066cd5d449c5e54000000000e80000000020000200000005e3e84b8112a9122a6d4c35632c190d85f718587c8f0ac4c1ee9fd9214d781412000000095e1dbbff5d4fb54de27c1940a2ace0ac52940cb1f54566a1a3fed9340954bb04000000081dcfc22e019caa589e6a21ea202c9c45ede783c1d8dfc6ec3e6b1c2a21a4a2ea6d3d91fefa462913fb170f81b8ba023be0c8fde7733bdb7ff6f5ef6dd58e59c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ca54d55aa7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422003016"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2832	2088	iexplore.exe	28
PID 2088 wrote to memory of 2832	2088	iexplore.exe	28
PID 2088 wrote to memory of 2832	2088	iexplore.exe	28
PID 2088 wrote to memory of 2832	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49cfdc297ea1cfcb1d481e7f1177f78b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26c7d7ff89b24a617033c07b74f6d87d

SHA1
7f269628470b9242fc87cd24c26cb69446f67455

SHA256
3e32b1385473b6c09e948fffc8787631e4c16f29b76eb90f5ffc5bc0c8fb3474

SHA512
f0159bbb35c5b758c3603749f6a483920cf07724ae3a8600a1afb61bd5aef8e0cc85d122eea751758b094724d4f76d5be0135ed759d0c80b61ede828f9c30256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
095a8d8a3c63efd929f15b4fe0a2646c

SHA1
b1490c77a3070462d7ffb0ffde0bd1f5de955bb7

SHA256
86ef3c89dfd86492586f258b2f971caef81046b341c296df0845ad094558f0c3

SHA512
3f2046d269387e3f7b4860bd4fc0e25640f05811d8498c751208b310d8db0d3eb5332279fdf5813f9d21514af1936c71051e1b64fad9f72da69e2ff1074413e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7da9aa4b1c8e878f3b6f65759c8b7cfa

SHA1
56578fa3fd51f4870764caf44cf6570a7e37874e

SHA256
dee048fdb4e6d4656044ea3c928bb4c75a32ff091bdbc2d396515cfc813ea907

SHA512
460d40f362aa2a190e029322b4ab28c82653689e9b0edf6a40a50244c4359b1073cac4a75dde0702f49254c5eafdf3429d4454ad8f0d2ffe822fb32941e65f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5517dcf59d25aa8187ea431ab3b74c2

SHA1
08b407fc9fefd26b0ec4119ea5c2d56b788ca32d

SHA256
d881905c02fc584b72b459d34d210e968fa5bcd9f0cf9a4dcf62044c1c38afdd

SHA512
704a04273f306f4078565b99a56fe11c132e246e8a4b1b76b6f28c775b9dbdcf9982ce25b25d60ae4a80b15b32003ee4244eb8a694b68c92d92815a531b7e34a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3246fa94a8005f912b300fb3997b89c9

SHA1
c23fa3c24832d8d438784808e512d155e981bd16

SHA256
f7002c09ba358355758e19ee5d9d50ac029a2a36c83f2a44c09c54403f66dd5f

SHA512
cc6bea5f6c2102627005d4f78e098759daed5053d1f40be650c85613c39b6852f68634e17d2d104046feab151edd77b5cdb6fd980f25d992db251023ed59a633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
753c7e92d2acb1adef945c1d751ef2e4

SHA1
ea3dc808f851daac89981b19cc9f81c7f3669340

SHA256
545102b81a9b152e12bedec943149999a3a652465a7d9265c2ffbee106515691

SHA512
4a988016b84835f99f0f7fe7044583d05d89c0780afdd7bbda7c7a2479cae3d90577c5064454877509f9a05564dfa114fae4c5fbc3e2de1413199f46485f5ed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e00098abb57afadf1f3ee63a5ea73dda

SHA1
cd2027a18508b967b661f98bd91ab4e8e295f4c8

SHA256
019587d2ebc078652cebfbadfd348224d31366408c10f03b2469baaa593df9ff

SHA512
572fbe5c1d22d3ba2df425f75a77fd1c563a0fda1655c551f89e41a75d3450d67c3f5f20dbc0a1313626ccc609a8db73f385f75f51770071eea958a25635e7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f7653788aea73d2779da734a23d7d92

SHA1
37b64e80df04b2e14286eaaf1c832aa5aadaabd7

SHA256
e2ccaebbacd8dd04ca27506893afcc1d8a9bc0f2fd53266bdf69d3890dcc7103

SHA512
8f31e972668c11ad4d932c5f93792561b6be193dc84cf15368292a81b6cc3b31979ac57c85de9c61ab9fc155118cf47e0d8134e714aa03256a95fb1241148ee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee14e26dab439cbe7d56ba55247543d5

SHA1
456b0130e4b62314e5b669e344bb648842c4db38

SHA256
c168ff05249b4def640760b60bf9a5821e3d460a9f83be359e34e6a2c9acf885

SHA512
9c324dfbaea044cbd6015a2630f8ade23d0f40100dc0efe8792c80e37393397a5ddebd7ee4fc37c70614ed28120724d8e00503ef95cb379b944da63ec6ce2ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab60a35f3847b195eb8eaa023523907c

SHA1
70a98f809f1f862b9253d31feae517936e2c8fa3

SHA256
557f49c28690923887cdbab2485d5bd88791e69bdd6c5524421aa8f5343d3a4f

SHA512
f393697424e0d9e538cf8cbad60324dd33c9057e18d177564e2beee0d4d1a639a4bedb3939d89d94d8673dfbb9ce6e8aaf19eec9776de4fd372dee294dc8b6a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c5829d2efc4dafb133a2d76f3419b5b

SHA1
d8ddcee794dc3db4d490887b1d12958273693f79

SHA256
cdc7c638da9b47e1436f300f269b3ba4919ce30a63dd1f62a2b19405b336e2e9

SHA512
b0aefd2b871f4039e897732485263f5748fba0c68087fc2136fc109d81d9e96b581c396b60565dfa8501cbfba6f09cb92e0a54d9a9c0f9ae54d8bea6dbde6d6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be6757f36a1cbef2e65dc01f80225c4

SHA1
803e49d78851bbbd1b5af5bb2421d2a8862e2df2

SHA256
6455669c86a92983adc5c6915a122bf06ad07ac108b3d6871618069ec379080a

SHA512
ec465663db9d8f502bd4d2f1345a9d70598ec76c4d8eca8403311d11521a6e2c882f026039cec5f718e29b180c73a1f9f3167439db5cdef015829597387c82d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ade01dcd63ae940daaa1820f3993818

SHA1
a83e5d80ad966a883bbe05f2eaa3b9ce121ae0ee

SHA256
c707233d044e30124237a444e0270f57050156edf844cd3930b46e119829026e

SHA512
70bc141defaf4127486362783f8466ac2335ced5ba4fb4f4e8ae518468e4899af8c2fe36d39aa8526f63a15fff870a098c544c1075af0f8e947aa2003dad588e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c1c57ed654f92edfa24211cdc6c1560

SHA1
e7ab1bc8c44e011d1d0ff10331603687d83ddbea

SHA256
985ca9529ac0c3e648c134cb5d663dfc580f36974a1473c6729753f0bdb89f0c

SHA512
6c77ed6d7d1718daa768307effd09059ec5e4c63ae18bf0b21080e7d477fcd7ada577406cc11a474d6269eecca7ca31d28fe7a04baef0ccb1e7ea7bcad4bc7fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3339798f1608950186d3861efdeb4d68

SHA1
aa1e50417330c00335e81652693f41a40df4ca58

SHA256
82d8ffd7d8c2f258131d5587055cb203a1bdd7e5d70cc5bdca80414dc606f040

SHA512
73318699fe3e866316198e822cfea7ceafa4a0a49e0f1807d211f9ffe617ab6201893000ffb4eaf4a813fcbdf79a6b26f9d0bb4aa54c071bb78e02a141aac00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e2e31762b26e901e0faba381d8a7426

SHA1
922aead043ea64f57429e0444f9aaca2894e0e6a

SHA256
cf2b271fce0ffa91efe3cbcc87f621261889ac0233098ad2802a77ee22010edc

SHA512
1c98923d4e32e169eaad259ae397fbfab50b048e17d8de03ec5596843a56f6020fbdac144bd11063e7a3f7f243d8eef8db6afeeb2cc60c704c7567a394027d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f49037b5a1e865bf5afc8f4cca7dc392

SHA1
81095570691b93ce3a0a6af0d680593302b567d2

SHA256
b9b7c506da333f7791d9e310fa0b422fe90b33da23526c2fcd9165c546bdb3a9

SHA512
0ccef80e04dc063919dc181b992d2b219fa7da5037db45e706694dec00f176218603626014b88558f19b5b1fc95415c65d321bea8fe027f1cea017f032fee206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a47a5325b955f5fb1f1c917f05a46d7d

SHA1
350a74b0159a6a634b9720859d433a5c045339f6

SHA256
7a90d099bea983dc1b40346b251187ac6cb4a3bc9dbe7433d97e43664a888308

SHA512
ac00228e6f96029d08a5da5218d46b216ca676b79e2743d9083436132c5819400fc0a631c25741cd01e359e4ed0044c37217300330b54c80fb474112a94f38cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BD4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C25.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit