3294fa3c8a20e15d5c0a400c051326f46caee4af98d5c71a044b443f740916c5

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bb6ec8e155673ad578bfbd20debe1e2_JaffaCakes118.html
Size

2KB
MD5

4bb6ec8e155673ad578bfbd20debe1e2
SHA1

e429a0d285ad584d61130db262d3324d937c3de7
SHA256

3294fa3c8a20e15d5c0a400c051326f46caee4af98d5c71a044b443f740916c5
SHA512

0c6f2721aacdb803f941e19263b28733b9efbba5047929fd904fa87c1bd4360878fbb8341ad576d9b82236bd97647233a322afb3d3a776a429c0158625315dd4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E702C7E1-1396-11EF-81DB-4E87F544447C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422034299"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0020d4bba3a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000137d47f50249ebb6bb81e6f2daf88fb02057999a35d8223a8b353e4a4341c2f9000000000e800000000200002000000037ae95ebbd7743f8453ba873dcffb1e2fffada78e3221918602c60c906b3125d2000000033a593fa6d6af48fe24010414d84a1c7c3c50361ce4fac8bec74597f3c47a0134000000039ed3b42a0d6d6b74b8212535c8f2539aecb3442574ef6a13258f3dce94190c248dc6dd0eedf750e92cdbd58c8b19cc5e1050bb5e5f608200d4e2e830f36cc09	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000008877e9e88fde4860b881ab7032f1d0b067e32ab7cd1f23e2c93c8988e2e754c3000000000e800000000200002000000057f3dd6c76ddbaba19ca84724cf806dbee0e753b9644405279743ffe19c12fa190000000f1d315bf8cb76277d555b95a2dea0ce0595839cc94cec2ff2383a34084c1cef20c6d36c04cff78754fe65e8b0ba0784819db04b967a79f012e7b04a7f9c415e399c31843cbe50d7945338dfab30a19e36428f2addb2dd2dfe208783a40cb2ebba6a91d126b116875d82a24f94f70ff0062085c6caf078d4adcb3e93fc6b1c636516b5254116883d15937be5a8955f5c740000000311bef2e881b6864b46ec57544ecff4830bb6c3ebdbf351aa107f6e05564e5fb0bf455a030af3e1b6ed627ca39d1d8cf9c756e41b7dd8ac0c4e0770f15012a9c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2896	2188	iexplore.exe	28
PID 2188 wrote to memory of 2896	2188	iexplore.exe	28
PID 2188 wrote to memory of 2896	2188	iexplore.exe	28
PID 2188 wrote to memory of 2896	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4bb6ec8e155673ad578bfbd20debe1e2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d2078c071aa2a37a1848444048a3db

SHA1
a423e40420bec31eab4d09948eb9bbb44c9ebf1c

SHA256
f0e8a62ca99c68584cf866d2a7b02364c39e365962a037319f53df4c8a32362a

SHA512
4ab956d2be2e31439ee5476aece50d2cbcae131cfdf6a61fede9bc8baa2f389f1f8b9bccd3f95ded8a2108f4f6a08782f718f0491db53e995b53ffff96954833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32ee4ed9976dae6e90baf5c11431e0da

SHA1
53bb91416e8255951df6c8e7ca4fd9e417447d37

SHA256
42c744bad2df8cf1ba5b409447a77cbfeeb9dccaabcafcffcbd704c497691af2

SHA512
72c5d09f9a939908d7702a81722da00d6104c46bb722dbb1bc1689dfab68e8272a0c959fad57d01674ed4d181812b053418c161ee9b899b4d2218f6ed249ca33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64e65f82d30370d23f3c7d89f4eb2b80

SHA1
cbd6dd131a46f108801f3198ee2589bbf59a588c

SHA256
863d386a4e65d732ec4bed97ce4d6304d357b176713c0aa1b53e49e03e450a38

SHA512
e8dacaffc91fd52046ebe635c4195dbaae8cdea8e1701e5dedc59bbadd1bb2f3a5faeddd0bd3333e95928518bb3a48e6660087ce318cf0c096af60922c1064cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e5b0db3c14cdd1948758a1faf5a0945

SHA1
aad858d54a96117ab94447e1ce0cecff0c8680fb

SHA256
f916d0c29920852eb7992bef2fcd345993857cb55e560d77e1008f8e00add097

SHA512
07f89cb8a239220c5a3c1c048b0b04502f8db2941791585f4432a5cb5a8cf2bc379c1a15b10e0e0e264e62f392e3735496acfcb647d62d73dc3ec1bc650ac526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1abd8d6d4d82b708cf908bdef85239c4

SHA1
12778bf4018ba731eba8ec80039ca97e1fdbd849

SHA256
52107e045221a2969c99ce4cfc28509690d290298e3307a7cd096994916cb522

SHA512
c43ac58f9dad5bb0540bb9fea6ca65f9a24e4d8a5831b4b85d907bfcac4b7f1c02b1fe4057f7d346e8c02cec080c8309ac8c9bfb81aa74cc98a7f8f67e83191a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b13c08f80893b265d4f12ff80d8360

SHA1
73c17f03b50cb8ac6ef50b54da2e41564af1206d

SHA256
e4226c5244fbfe061eaadab0f5b6fe06ff6ff4f433d5a79d174d132fc4566841

SHA512
449cc28418978a6eb84ed643d94f75cc788caea96c79085728e7f998ccaa8de5a0b130cfccc64970710e263abaabbd5b92f6c9002b274928e83c82c9076234e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c520516dcbd7bf9ed9b45f5f42cd5b7

SHA1
b81c1b2a5daaa58c4be02ca66f0d9b581799b7d0

SHA256
cd11a5b1f1d685d43a5851992ca769393cbfaac2e0d294d47d84b06f3d33bd5a

SHA512
60521857e712f9ad45868171d8cf0afe329e4e982803f55875e5bdabe1d63e7a4171207b447d877de4c1dd99e02d03dfb80f927ee1710f2c0c3c3f7ea6b1eea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcf964ad1b95378890f2cf070263ed6c

SHA1
a16245e5f156455730b3f68413fbe4236e6b57f4

SHA256
69b1a1e863c32b9f85f77f54c4c1b24267abcd6bbc96ec499173b8f991b8f5ab

SHA512
ed96a1f19a6fc51f5aa4b3dc4bfdece2970b6312dc40c0aede4e4ac9d1468643f27c2a485e2c9ab034b252e02ac699d8115b44be3fd3d7714082bbe92ec1b9d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c48e6a8f7d1108f9b8c1995f9b176fb7

SHA1
7f53344522f9bff3895c9568cb3b74ddb66e1027

SHA256
90f642713d5ca1df40f28ed13fa6f24b44e57ea112ea090b1258eac7953467ca

SHA512
3ceed6749bfa0cfca8b71019ec44e82dfbe2e900a69841e6247127a1f8d00dd716bfa46bfb56ac129ab5ebf42f9103366abe612aba01e5a2873adf9c3e3fd466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3e281619c96ed7c3060697890af7331

SHA1
94431ad169bc20b08eba9c4474b933033a873992

SHA256
d741e01e08d70442fbc307ae1d48a0440744cc8409a1568a6b676eb2e88d761f

SHA512
d54accac35149cf1b180e8346f75830e066d656a2db305a6e4d8d6ab75cd4680c55e5c1d5c8865c3ff61bb3563370936b4d1247ea64bd17678ba99ddd4bef419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb3105e8f685f5418990c9504fb87313

SHA1
d93fde0e2648d522b599b581ff72abf2cb9ba2cc

SHA256
a6db856df225ecbb907a4a568fc3a2eb194a53c2c80b9e82d317a6954c0b008c

SHA512
8f1518c00b28d3988b655e659000ce9158c65aed4d364decbaf6b2b27c3e04ff6311dcd522eada0b22313cad97762cbd3aa397c8efdb2c59fca8314ec21ac33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3224c499e1f347145a4c076f2a67832

SHA1
11615d2999f6831fe78a19603abbc2f9ef690f3f

SHA256
eaa0587de9011c35dbda89f4893d813b2c9b84ff219a29ba31fdd5ebd8f5fad1

SHA512
abe0c4399061949829f05f109084b91be817d0444d8bfd092ae050514dd427834a8f8ee65b25a629d1f73fa88476193f4ec90f1ea9493065722f2ed0f4127b1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40ff43313c7a99f0fb82566cbe68f4b3

SHA1
7bfc37cad1da64b033bd8c3a0e2808ac42767c22

SHA256
3a3ffed6fa53a1fb63b79cd6771ef94b3f97969a86395ecd43a3ca7316a6468d

SHA512
ddc1654a516489d0069101ea878298cafc797336f6b187e1722d7fd29d5fa85ad881670b26cc1585147a420e6ea29c561d980bd2f550745d5f5a5f58213063a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb27061774bce80f069660ada39eebf

SHA1
86a3347ddea4e5fe9641a4a558acfb35125fe3c6

SHA256
59f9e107de9ef6f608673a5a4654da824cfde4582ef18d4220ccaaf697fdef8b

SHA512
881fe1fce93e15ffbf67d3ebf54465bf4c75c98e5ea3841f4640ea71095024c86ebb72d7b99d8d32c473394117045c0cca26823caa0811d8b7e08a732976a5e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
587f8f606ca7413f58605670100ccedc

SHA1
2d14cd226f97723970aa4f2b6cbcaf19b8ce03b9

SHA256
d19ba2eab8b0d6e54d54e1894cfb5f7be311612a37041173eba5a6008857a62a

SHA512
0cf961fe250328c8e826c6e1707b7804a3ddceecba77276cbe1baa3cde1597d135a48710bc90c88b945a730f7f8010f254eb506eefc7a4fa33319a352fb5489f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
671d11494cfa23280783b55c1d71d3ed

SHA1
5d0bd2a1d4205831256a1734b6f1bf809093dd60

SHA256
33555ad149e439065706204da7ddec8c2dfe82f02ce1b0cdfa8526b3c2bfead2

SHA512
aecb6c02c2ca8dadd4956146859e74f11987550069aec30419f47807c0964127c195da94412b28db9afa787cfc6bb3036acd0235d00a20be279e35984e5855b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1790e66837d01c2f544f5bcd37a06d1e

SHA1
3f1f2cc00a61e781294aa3160aa407e0ec04216b

SHA256
1dfc3620e6011bec684ccbf58402e8a720fe6a1a395267e98bd32d23eb2f78d2

SHA512
28298a9bfa875b448107b8766c19a5232681ee2071a10a86d18672c04a39bb31585bd080b499343b0cf731bd78474ff7654c1da402d0248f37a12c48d4ce387f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e600ddb0bec473ddb0b3cef3e9f4a865

SHA1
592e48e54220d1b77ec6b558da98fef3657f3e2b

SHA256
b6ae854f325c450a0f210e1821bf81354a70c7fd0c61b34c6a328e26322df96a

SHA512
cacfa7018ce740f16e21c6670df83dcd238e3c0932e4d19d1a5c200c35f86b33b2a50ad63b601e4b2945d1b5911ecddb22aaad79033372d681d3411b263b83bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3120.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3182.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit