473729c71c2ddbca8c95533d170684995d9c6461962143e2d012e706e13c65e3

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6244a42da4fca83d6e0898c1132e164b_JaffaCakes118.html
Size

337B
MD5

6244a42da4fca83d6e0898c1132e164b
SHA1

30bb53ed2d35c592a645954a8de22400598d2c4d
SHA256

473729c71c2ddbca8c95533d170684995d9c6461962143e2d012e706e13c65e3
SHA512

567d1b7b80b87d5c12b1ad4b8d4773604022b6fb3e595b1b88505e5207a5014876b181728f3162ebea39bf75298e8a6e13a0e5dd6f92aad1a93e704fc0a72f3c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309abbe052abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422439376"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000007675993e14751cd3b5a75f49027e7e160ab80123c26613ca2449a03f3d5c96d5000000000e800000000200002000000037a5977c174c56064a487603d51bdfb223fe5df0a133a5befc9e947eb32be50090000000c142c691c6464807270e30972ba2c9a53bc3779fa2cf16d2451fcfa49034aaafaffd9ec31a435b67da57c9b2c4384ccd0a97de09d72900e2a5e53c93a0eb28716564241402dadf90890a7518e66902a70207a6f3a7ee8e0972fd1df9d1f04e0fbd98f9a2daeb6a6853977ddcf832f50929d00942d64294486e9d8581be621c87512c941a2d7d744eed4a855d125882f540000000eaacd421d17791a4487c9ffcefc93e02b9e8ce9f79241efaa8887d3e8081dc96fe1374a594c053c5eb62304fcddab0558addc7b39194e4a1a6cdee45678d5f6c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000003d7ca1104c9f95ecefc80450a567b3ced9512af0ac7015d5683fc57f40729927000000000e8000000002000020000000814dc22f29b360fbe0949663fb724e40205e98e21172cf316d8750224740128e20000000fd6c7373c020906eca190daa708ec4ef4dccde03edd96c1cd3f11fdceb037f39400000007f300300a7ebb05467b1f723e4025cc8621c283e7cf9d4e013d4cf8bfa4eff1413c2e59ee1cf3fb801e7a8d8585faec6e334f5e3b45390909bb88e8a9404abe0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B1B3A11-1746-11EF-97AC-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2748	2032	iexplore.exe	28
PID 2032 wrote to memory of 2748	2032	iexplore.exe	28
PID 2032 wrote to memory of 2748	2032	iexplore.exe	28
PID 2032 wrote to memory of 2748	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6244a42da4fca83d6e0898c1132e164b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f259fe3635af2ceeaf8431e9ac147656

SHA1
486616ed20aece61961783c6a55278f47b956495

SHA256
e4aaa621ffa5a789e655766968006018340a54ab2f91a899486f40c33d4fbde1

SHA512
7193525d6c8579fe56dc4391f8068b7e657ee368a30fe6316463b32d808a711b5aed55274572c3549893af3d58d2c7dd9bdf76f8c515d059bb3c52e8f90de360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8df08ac43288edd4880dc20349d110ca

SHA1
64be4790f23b3717c1a1313eadd71c52cf324c27

SHA256
4dc9fbb95a910fa292b98fd395a587f5ba0fae7f304851e217f3281583a539b7

SHA512
52e4899d950382ab71b5d87c9ea71af1c0b0325a486b5bf5cc62874463a6e861af2a00cebe7f480be56f26f478586632efbf68d4228d06b7b25a395efa663c01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
955e7221ab6772e1b7a9ba63c1ba553b

SHA1
50cc7ca7f932e7ca9681b9a1f98e1a76fadac4e9

SHA256
e0a7e9ce98d7f684fcaefbfc8b1bda56f0b95d98e2eb752d14d822fe3ed6a8ea

SHA512
525749a132f7403fbf0df57b74fe0081abf555a09e10f16083d1baaf498fa8729fe4dccec472adf186ada4cb0189df9b4e896c706d72dd3f90f6e0a9238e752e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f805921c9da96625a4e9ef688c392624

SHA1
ebe811cc95068e67a8d1d094f5e64cb46f404232

SHA256
4f3b74a56efe66d8c0bdee1b66bf453b13a205ebd7ce51a422c6c74546477625

SHA512
760df5ce244d70c8d52ea66247f3df5ff05ba6af8d19f432dea9c93a89944fd7285d4b9bace348cf69ed38c95c364e35c55ae0ad6bc578233273b5416dcc8b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
218741a7ddb50b880bdb195fc784e844

SHA1
8441b78b30768b7aa827d18add88ced5be2b00f9

SHA256
e4ce112c10ab18bdb07e08a312bddb0dbe7dd50bd8961abd8d5df4421c0772bd

SHA512
02b3a45a1a83ada222ff6247fb373fda30e74620d63d611819dacc546496b56141deff0cfe574ce4dcbffe191ee99755bf471112a4481eef0c10117760e69ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1499018129523aefa6050dc91d030f49

SHA1
bda09a858b2592b5d7b51e4495ab2efbd52fd0e4

SHA256
18e1e84dfd7cebaacdad474ebbca1c14e496a1d278ff4c45e6297e4671d0ac11

SHA512
fa214140458f98fdebc70e8d4b7fcc8f9d6ce244c30a1bb1118931713d8a38b5418ad4ec92feee3496b7da30cb2603e963f8d5cae47a8d776d5ce54c470ca41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba492ddadfbaa88771ec5a919ab90f32

SHA1
cb77b75abe87b5e7a0685394df31c0c10984d488

SHA256
6796c2e79a78d57f2c5cc7b8c994612634eda89137e115aa9cb7a32cee0231e2

SHA512
f191a45054204bcd363838f62c7fc14026e93470aba31b0ae239d7b5d1f85e0ce002ec797fae54d25ca6dadf387d22e7efebf81939754b4a26f980d6e9076c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a1f4adfb802c30a8bc22ad3945df846

SHA1
a69d93d52c37175aeeedb9798e0f7f989b16fbee

SHA256
77644e6364bc85053a810b1cc1959e51d7f078576057b523a39c1687cc557e9c

SHA512
7ee44c37307afc62e47ca9c2d0e26cbfeb894ee0ae359eb2b3a3975830e640b660097ebab447714f7088dde9ddbe4d36171ee46a3a044528f99362ce85b5851a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6990389ce86c5ff3b0f6fe0f524d24bd

SHA1
e408bb76ce54122533a6d5307805150d65ebd247

SHA256
db2e4797e776b83cebd6553dd0da76d16f44f118dad7c187f525821a1e3174f2

SHA512
90dd2f5b685a67520313d311f78bf31aa29ca092fa22f695a41e884a516af7c5047ade85b4607d418acecb9d18261f8695553970995727446c3bee9c9205f281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0bb54dff751cb80690164152b1929d2

SHA1
a8b787fbca145b03a4ecc53c2a8eca371b151bde

SHA256
35feb59b367f9c40d4ec328a026847b345e8094582e01683fcd1601b6c664ac3

SHA512
a8d7d9296ae537bbb81a5e25915ac68978d3d41de91177754b61e637d0ecbfd1931ee9b6af5d95834bdb5328c2cff15d74d9bcf8f3d98ada77682f44cd585106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca62a5f1f9ad57b82c5d239e48df03d7

SHA1
d9fb667708456534025f66958a28760c60800d2d

SHA256
228ca8cc25332935727161e10bd42cc9f2858894c25fc8598609264935b79dda

SHA512
c934f6f609812afe40527e232c46e9bbaee63e2d9deba8336be35d1d6987bc8f36e9546868d9bb722a6e75336e3ab3772f4a5fe3c335c2e54c64dfcb8ecef561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de2bb7d6fc9f9177a319ab594aebad5

SHA1
91db352d772b7e2ee9af2e5c080da228964818f5

SHA256
0530631e583d7c477a954891c8842ef0aeebd028d7b3b0654b2e0814fcc72566

SHA512
54dfc8300ea1aad8efa01ea87554c2d294608cbfdfaea0ca7fe7909d752c1ae2dbce5a9c97bc4534f82a10c4c561e0ac7fd541ab3b8c31459784e3046a898784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60efc29737290055fa6f94bce2af9ce2

SHA1
33711c237a8bedc29b4a76591c146382a7d85d7d

SHA256
628a655e4115e30b033f6d208bb5d7be43e17e093216cda6726da1d630e87834

SHA512
f2386ad516c042675426bf0024b53c7fed50f10d28621f20b30400b9d43ed32b895394cd20402f3741cc40199128f061822758681bec60262c38aeccd5f1258f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87c4b0a3b80d22707b623a58ee1c6450

SHA1
00ebd3ac0f4bc71d86ecf61ea9c419ce783658fb

SHA256
ddfee892eacb780edd6eb4db24802612230d6060eed297eada3a9d3c324a9af2

SHA512
035d33162974f2910888aba2205cf686c612f1908870276567accb96b255c05ecfe6b3420dd847620d06f311fb98f0aa73e9c18e87f087ffbd5706414445e800

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34F6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35DA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit