fe634a909810901cf392aa6d702dbc85bcfad2c27caa3e373418641b4e455f4b

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fd54456026b57dbda1984f7c4259a32_JaffaCakes118.html
Size

877B
MD5

4fd54456026b57dbda1984f7c4259a32
SHA1

7c17e3880f22e1488bb2e0e507ead638aec72ff3
SHA256

fe634a909810901cf392aa6d702dbc85bcfad2c27caa3e373418641b4e455f4b
SHA512

2c534498f794d0029bedc2cb57dce234287195e66261a4c177b6fdc974b902eee1be3a07ccf630d5808a0ed7896d77776255ab94b5e2ccbdf7e811705289a2db

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000b1ead769378749bd4f2a74cd4e01d4a4f5150c23129cea3d794ba28c18e2815000000000e8000000002000020000000e21c9b0c6442b3ff74f9038d9b9232f644bb5b8ce846250496c5a04dedaa80dc200000004d3b35b7c0fb43074d60186ca9f07cc964077e3888aac1b9ddde02f4b8cdf82c400000002cd388f5c1abee5d0c73c6eb728018be7414d4533ff23c08e2a02f66164c7e94951930c7c85a0cb1d7e3c64dca5e1d47bf4e8445e797527add2623bb97b9df0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{592F1FD1-144B-11EF-91CF-DEECE6B0C1A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422111800"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004d8ef820ef8d09c6ad66087f96078b55499d7eeefc5c5a696ee6d93b010a953d000000000e8000000002000020000000c476818550e50687f6d29076dc1520f534f20a8a112824e3f33acee90c5dea2b9000000051c8681c96824ca29ac768415162333b714f126eb48850aec260b9b78b367de612ae8fbd765089606543e88d6f4a6fb3c756e8e7e728a98d9887063f4ca97c07842f0765dfc71b37503bcc913128032c59e07a7d13574ca14929f74b91860ae3af18caf23a0df41d38fb40610a64939f1bbc36c79a852d7abc1de799f1b9beb09fe2d39ea6b55fbdaf052326806f636840000000c93918c82428274a705c2a8aa7113e582dc9d25ec2b2cce1b855ed128a8b2f465ade27c802cd1335522ae7c336fa621cbad3aeb2a6ff7863815099b31812f71f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3034bb1c58a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4fd54456026b57dbda1984f7c4259a32_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a54147cf4e29d55cfc99fd75883feec

SHA1
ff4b94d97137a32bb478dc74e232b28d8d57579b

SHA256
6b953056cfc89d3ebb717351fe940d81ac6431647944ab0997e026ffca21230b

SHA512
fb806dc663d52ab5924b61593985d0263defe90f875942c58a7a88535d4f7a1bb5f8fda95773cfbb3252c9c552538809b4d0a42a3a1ae84c7cf2d30073a6ce5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57cd8ea9dc193142fe36907202ea6801

SHA1
3c107d4fb59777d16adfb2f60a15ba138992eb9a

SHA256
acd0a115373b7585382636e82b9662641bc2a7e44f8a1d5d61d5a045a6c93f69

SHA512
d4fca0065a740918e9a49d53c95cd4d6cbf31869e40cbe9fd9b0eed3f6cd27612663ead67ad04aa7eb2ab975d3f7618f11e1fcef3345082ebb3ffe9652781de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09b9f7ca27646ff2854a27bd3d38c779

SHA1
6896ed018b54f4133a0e5ca23364fa503d9786cd

SHA256
2a4b5956598c1c61faf8cc0ac5d6eca6072e06b0b9fb7d907d8cffe4e52c40f6

SHA512
7fb290bb1f3839a17454d30d05c9a8b59dd5db0143db1498208ba2f95260498281af7d2c950247bc0bcd29ef71ff74d93180e0377ddc38105b1aad15a2b1380f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96577ab240d289e73e07bf440562a329

SHA1
df02daf92f8f82e0260bc2c1027e0b4feb9bac00

SHA256
81866fc05e8a99397a54a730e7d13c509a6a454ce46cc9e41ac17c1f8d37ba40

SHA512
1f8addf9f4f04f940f9e6fb8da6ef180e8c623697436da56751a5fcb962f25dcf4f2a77ad6856d9b3a702d1003431d2fe31691d63cff0eeb5ab820b584ebda33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b7ff782cd85db1bcfb680061e011a34

SHA1
04550cf7c72480bab1a0f61cb751b76f4fedb346

SHA256
8c44a6028d1533c82e6e18ce491d4477e11e88fcb5b0f9483e567d84531ff655

SHA512
089f7696dad9bf8330d6a4cdd633d3595b8c8048c66bd3d3d49f45ecf3297d75c4be433df5034aa3045f2e2be2a320a0fec7c2e406f13139927a88a4abbe0f27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0f3fe27106f7ff3374f5e6a4604c1de

SHA1
0f261c9ae1c89971305480a56dd5f64ffd45410c

SHA256
57f7fdaa06607bd2f7c96b1854aae72f627783309bcd9af16a781d84f1214638

SHA512
4813b69ec00452f448bd9442a940a96285d7b8ba4a64184361018accd52112374de8e01416cbead3627361b22b5b92c79552807f294b87d3fe0d1bae5ba67c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
578c42aba5e52ad8e1104b1d000942b1

SHA1
2cda5142c0bf715a2f44c636a3f5e7b111f1b868

SHA256
fa5e69167852cfc4148f841599840ab5d29a086656ed08b8c83920ad9389e2f0

SHA512
88bda439a159afba0f71c2ceee9f7e39748f4c41fd43702d580d2f5616e800d860398b5d10783f539e06da04607da83bf912a243820c333b2d23b7615079473a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de79bfdd592e925610c4ddd97d963746

SHA1
145fe66fdb20118fbcb7e153056728b9e60635a1

SHA256
44a2c154bac53877530d85190bcc0368dd386d4df0cb0255d1d710908dde7160

SHA512
cb0ee9e1cd151023657269951fa0e2214e58e105f14a79d388649a87e4479fe46406bc86d678cafa350c4dac6329bdd4daaddb6d7c3f252881dd52c142c2bc81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d9b82bfe8f91d2199b3c50d1b0d267c

SHA1
d975eb6eda86a409efced6db8c4e2c963ae39887

SHA256
785470de39bb00fdbc8d26002675c38b50a1ddaca28519061587ba5d076152e2

SHA512
5a2819a23c090eec889dd82cfe09e9be128cdd23c8b2c551f60f571a5c85d874bee050ef490c4133ae0924c06c1accff3194b785a608a673c38f4e50c119979a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e85bb18de9287551fd8f79b0c8aa7f

SHA1
c181d3d5a2a067d53559d03f077a43b03dc73356

SHA256
b89d3089d1820dacd4d01e6ded5577bbfe47481f3eaaa5cd8345c2fef544b0f1

SHA512
c9d469c1af4a8e5ce3073c0e6ed2666429c6cf7b620b57cf9311623b366163793c9e136787d7e07fb82438bc4741160b5aff1bcbbd9e2318f35b6bd44848f9d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cf6a6d06afa8d28c10276dbf7c10848

SHA1
1e34e14b5737bfc4a4755b6b52b8d99dff3577ce

SHA256
c3ddf077cec2e4aba04efb52dbb3926357c3bd9451c00382ecddca77b97063b5

SHA512
97a784c7036049c64516e9bd0993db9ed789158ee290d41e1f12bcd9256795917d50a03c875632dba05ba6cf4b2e41c986a38e0dd2bd2c85ae2f985baaaa31ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7187b0f020e712e51754c4badce31a60

SHA1
402b6eca519b66f5ac428f8913ece502d10fb5a6

SHA256
d3722337903c8f2d8b8364e3da9db0460fddc317905046dabfa63a1467b0ab49

SHA512
ce0bc32a6908374dbd3c150d77b108c64b71dd16eb24dc6f02857afeda214c0e8ce5cf50ca655aead7f862f4f03e6194c8638dd53795927c7393279b3a3dc0cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4786f35c5c9fb1a435694543290d339d

SHA1
08c288c3c266162dfc8c3dd24cd4c0d1bd61c944

SHA256
d1f8254eb02f1e22184bc3f6d34658579ba84f4cdde46c380348cc0eb195f8b1

SHA512
8350c319253bde4391610821471c9b8570ddadbbb616abba1953af5bc73a4fae450f30020d2d9a4e40a43862031a81bfecf8cc74bf735037d0b23d6bc39b9880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dec52976b0c213e98410dc1621032f4

SHA1
1231fa7ccbc1e852fa841e8131ca023e6f51e805

SHA256
e7ac73601d0e544115e9b1fb99e6183507908d59c09fc77383523b8ad84086e8

SHA512
277c91332547af853d33f795f6590056af977a070ead6aebdf5bc460f36f08b126fdbb405b5f5d3b1d448ba58008f96d7ffde6244bef6bf0c0e70aecfd19f60c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ea2a36df7c4db755c904d24ca67a0d6

SHA1
f0f25f334c69b3eaeee22142f2f835da656d7bd3

SHA256
93054fc963269fd1f4477c9ed485010b20690f60150276e3f29a5c23b1abbe1b

SHA512
3771cb3ed947d1042ad58fca8253dc5f89e3f260288135c8d3758c147c33889c15c98f2fb32531f4c344c53bb01fbea0f23c6a3ef500cb23dec62af103e6848b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
260e32badf684d8796ad3b2fb6013e5d

SHA1
ad66412042ecee2087f68b29a0d0d0bc25f312c1

SHA256
ebac1777140b2b05f321cad7c8a13ae7ad6f0f299add4b6c9989563c691ca223

SHA512
0b1e30a803d69f8ad66e2ff22e95a9ad47f7aa3d026f188d96ae70414886f5fbe9a460462261c3222ef191f8166ee55115a257f035a9e8b2f4a3d90b9451ef06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C21.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C83.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit