863e1e1cb2d00ec4d400e8163e98ab990ca2e71fce9f2f4bfd52b1b495e45bb8

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dfd6487467b71f27a73bb0cf042b50b_JaffaCakes118.html
Size

2KB
MD5

5dfd6487467b71f27a73bb0cf042b50b
SHA1

3753e9dc52c6374d7bf08f1e1bdde4e102288ef5
SHA256

863e1e1cb2d00ec4d400e8163e98ab990ca2e71fce9f2f4bfd52b1b495e45bb8
SHA512

16acd104ef3437dbcdbdc779b1a2421f82ec5806e044f48234a4d4798d8b121f6bc5a9c11e4d90d376d7b76a9b071e836fd447d99d5eb2d419291b6735fac2c2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000cf7e29457279205a3eac034a696e7dd3d48e7af65f9b6c24e869e75902ef479f000000000e80000000020000200000001feb23ac191a30c56c8e5f39bd366ee1f7b5b8a400ce1029c505e5b6b1eee7ed200000003fe9fa921b34845cc5db83a0a1052534307a94f2fc041fea15440f09a1555d4240000000c06515695f052939aee41b653e1a2b120a9ccd091961b05eaba81e0a802fd2f366a4afb0d4fba5d5f723b693e953af58d5b9f838d35755728abcf7bb253820c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000008171e5ed5199199ad3d59200a25c59dc59c9c893e452539c5adb4be715328225000000000e80000000020000200000000b53bf3984bdab686440003de6cd3f7d88775598f92cf2ef9197fe94356a3c129000000067442cab25122fd6124af40048461ace0645db53300e5c6f5323bcb3d95ee0e23a22d4443a24002b3b1f13dc3ae7270b2f3f9ab25c06f15b5bf4e2c8e9aeebd63ef5904081942e2738106386173e6e3ac0c914fd7a928dac0dd8d5669cb448b9992bc82318496559a6a356b1673f30e67ac3a7358fe65b1e97e57932e685dbf24781061fa83c36404fa36ed298ac9e2840000000b711c301144e68ea0a5192fd04fc72de81d86cab6e99ba868c604046c83f8d12fd4b4eb677cd0239f2bbf39e94b196de3ed22ba9a0a68c748143313f5295e1a0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{165F6171-167F-11EF-A7E9-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707c42eb8baada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422353924"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1648	iexplore.exe
1648	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2216	1648	iexplore.exe	28
PID 1648 wrote to memory of 2216	1648	iexplore.exe	28
PID 1648 wrote to memory of 2216	1648	iexplore.exe	28
PID 1648 wrote to memory of 2216	1648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5dfd6487467b71f27a73bb0cf042b50b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3692a142e2a7cb3eeae3d8dfeacc536c

SHA1
7e37d4f75a1acb772249199e3d0754392901f90b

SHA256
1643010343d2bf4375cb8c10a3d0014279327773049b19c305af8d6e113d17fd

SHA512
db62eab997fb97e7551b3b71812362c5a8a708d84a19f8011bbd9b4fb1f1b7afad15180fdc3621cd53c3181f9b16f98ef1e7b99262119982c1f671c5a5667bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73bd1705a70ed60e762cca66a9300635

SHA1
70a564506ea0bcbe1d954946742174a8c0f7537f

SHA256
1a24269a9e2a136c4cb0d0e6dcf8fa9d4436de5cc4e0724b33c13ace19c115cc

SHA512
b6589412e6fe944adf50420cd551030173da494e655d24afd019b7be54a1e024355cadf1158cbe2b57fee8ae2f74b29b0ee59daaabe0eb59f8641a80ef5ec6da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
751a3b25f187cafc47f0497d1acd2be7

SHA1
406f99d83c99781e8d35f913d13e412b3527a199

SHA256
bc7a3069aba302f7c3bb541142e3f7bea365073f48632900e70d6d8fd0d4d7f1

SHA512
0fd7de6b1191d6c20306b66966d4c63d10e60a97101b49eb487466b7677c2fb4dc1de50796594203ee504525a24c751ea6cbd6e21fb10cf19b7f10615dcc518f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec8dd0401ea2a0de04a83d2c15fffe21

SHA1
ff2da7b943eceebd9383dfede01702909fb3880f

SHA256
60220082f00b3e37de3a6f925286529c7c2b64a00c96cae1a39277d7dd0f73d3

SHA512
548b41cdce0aa3dcee42456103723f6ac34acc251e4e3c155df74f49205a97e507ec7d50f42db0623f270ac9a49579f9de1f62f69ae0c9e20b08fdd5c8af6dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be59e468ea416fbccd513afc1287c2f8

SHA1
8af5ce89823d290ec04734ce67899dae2347533f

SHA256
752ab66b758b2ac468f35cbddb2d4d2ae88bc5fb0c4c8f26f889079810812658

SHA512
54366179d5982aad2115a9160cce6aeff808e0ec88e6fa58d89159602c64019ff8a73a1f5147a713f8c6988a059ad53d090c6c7662af9e7aa3cfa15d292b12db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67452d85314d9be0e72fc5499f9216a0

SHA1
f414b20649fbbd4b959422fd5cfb79a97a9d4d14

SHA256
2251192cf195a47dd9883c4c0471f62a3dd07c8d57c86e0f035cc98cb90cb3d6

SHA512
270da195f807f70554d0195435ce43b2e2085d7f799bce8a4bb719faa9ff83541446fa27be87e52b938659d6ba1aae6d45597c5469e16a0d678b4e9d4934b66d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3e9372e1e0c0f5fe638560e72573d32

SHA1
32ece960b559694783f046e23c2768f1c4756d9f

SHA256
55a97c9a47b2ff5cafe62fe52575d2e5af6596284b3823d949301d33f8709ce6

SHA512
19213cba9ed3aa5ef9faef1d7d5ed991843999fe1b11f7965c855f0b2d2f8d47d89930a7634bb5ab9f677b890aa429117232c9ac676f79ea1ddddf604983bed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fef118fee15914972d6db74d0307d156

SHA1
9efdb4645bd0b322800839ec647be90e57c0b5c2

SHA256
bfd4dea20bc433e2fc28897e04902ddc3bd96502c24b5a891ba6e7cba05dab82

SHA512
d9bc89e3e7c2c019ef8982a3080feeb9409acfb1c1dcd367962e8ba66eece662a89fa35bde324f3d0913fc78e8b5ab8da2ebdc9edc4b573bd408434e37d26f52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
415a8b111080472dd0ad7136cc0835f6

SHA1
bb238d8d93fdf769dd9571d313cbd3cfa8cb218e

SHA256
2b9d247f3bb73a5248cd500c544252730e41b6da7850f94c363a5607b18501b7

SHA512
e792c9c412b9b6dc14e421a4d335831e6e81cbb3296acb557a57ed9cecc6175e5ba8dde5acb004b761b2eb1d258a0ce7e6dec694c121689ce1df5e8a76a41c14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
015c2d709b773aa82714ec52e3f596cc

SHA1
169e8c30bdf4bdad34f216a68c93b640df46325d

SHA256
cfa139f5b550eea46eb2dda1f574b7ae9190e4ab4a6994c2dc5532eb36766d64

SHA512
0f6fffa2dffc75e27f04273c1d2649c0284e3d50d974b17e01dabdc619d77d5fb787160b812bfa3e52bf87aeab9212b9f8936985879d9a38111d4c927c29a32b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
625b4c1a829f8f59a858ced5c0e1c17f

SHA1
c41c722bcf43d1e6fbd97b707d37e1a8443d58bd

SHA256
7ccfb335da5ef92d925e321e4aa0c98c887df37b46bf70786a234d8469e25dee

SHA512
68ad7498d3c1436cac213b280e405af1a8e3f22acd3b68124e8b28149c7bd50b46be6234c5088b2547374413d9dfa59a9db7930c6c997393b52c1245cb45f3c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37ec245ea7a26b06a0e9266e624ff70c

SHA1
9448d538fe65029e752a7029caa00acb46b3ceb9

SHA256
9b7d1f5a235dffe4676f0132994d7ae9b8ef479697d32c513fb2cbd782188709

SHA512
1fd6e613fcfeb5f037f475103838834db4f689bc11f71707155eb7c8bc5719c88490bf13f70dfef6ca879667ea277c806019e371d6dd330a8a48dac0fedaac94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6fa8ecbe4928431a7c5bb4a9a208e1e

SHA1
4451bbf9f45f9fd15a78a815b75c0e244e4feb64

SHA256
7336dcb35fb46742928efdb2c6ffc7c8806aaf1ec79e3528bd37788ec42d3372

SHA512
3120c96cdde358a5beb10cf98da449e128bca85d1ab7b6feb52fd94cb7219f1ebdeba232a9af90be35be311793b734f244fb2171bdaa7a561a0d93289ac1c3fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fd4c084280e331ec14d52809f1f1fb7

SHA1
8494efc70d4c130dba15b5ee6c70adddedbe0b84

SHA256
9165a2a1fea40b58c818897ff29580076ac629febbefe34eb315387ad89b9bd5

SHA512
707c79502cf30a69380bceff26c0f77dd75d7cd48968ba02fab4aaa4337ff1eb56e2ce68b1b89c0510d7b2cc40b84c6685fcac8b36bbec3c0c42dfdc6ac89415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5885926df24b6e8de33569f24b14770b

SHA1
811e68dd3838830f1370bc73defd7f72c64a714d

SHA256
0b29c2ab1872af4e398b710086b0df5a53886ee9c6b10584efdf8604f9907409

SHA512
bd243f5d5eb5089cd3e1115ebe7e1c362b0c51b6f2ed4f4620f6e2cfa9fa93c313e1b5dc48e456c84eccc47e14351cfcdc441d5d2f7580c4761641837a79f874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9096b8e16463cffa9615b0d4b90c36c8

SHA1
e11b6caaf0f188ad24c805333b82ce8241f4208b

SHA256
88140d785b723d85cf17752d975d0db8a9b1e3a6565a72d383a40d03b5a8799e

SHA512
c4b16c3eebe7f404d57b46f2fae79273e64a80dcefb3b96789138c61464b7e1a3c4aa2551601b65e464de36f36987bba478adcdd070acd81e3e1f1b4a99b3073

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36CA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar372D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit