7b05bf0d704bcc14b1ece85411ea692d44fa5ad44ffbaebec3aa644165a25719

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

644c981bee6aff3fc03b1bbdb4c9a656_JaffaCakes118.html
Size

438B
MD5

644c981bee6aff3fc03b1bbdb4c9a656
SHA1

9f1556dc5197cd4acbe4dee225ceba411105cece
SHA256

7b05bf0d704bcc14b1ece85411ea692d44fa5ad44ffbaebec3aa644165a25719
SHA512

bfc23a91c864c4c87b6404b0f72173758b274da1a3cc6a53ab2b8611655fdb36b5c1dca153e71461415d7fb9bc5721259dbeb424c96db94913a0ea755eeb118b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C3BC711-179F-11EF-ACD5-DECBF2EBC4E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006be58cbe3e6a09a4a782ad5edbc89ce4c0d5e06d9c58e675c6daad75018f24e0000000000e8000000002000020000000d8b256a1b4b00fc85c218d852cfafe4c93c5cbf14e827b776129c6446b86228a90000000772c63345b226db42579628791072535b1db5c9ef5007a74f2e86ef818b481c575d64d73f3a3fa456a620e8e6abfb4134728ba023b42825651ab373db5d77218abc3c66c963ddffb4af562e19627e2102607536afeaa67f9b7dd0ddbf4d17120c3c70820ed4461fefb641a4448ca25f25b96e01672fd12f01da53fbbf305cd5442f5ab3f80a7644f8e481fef9f344c1540000000b513e0d03a3adaf7a954efce6343d08776a08856c3b9bcd9e4f11db444500d0e625a968c8d1a13bd66a0c7b1b37c8002e73520e8f77841dd55e8f6986a0f1b9e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b669c49f836e9695d998d66040973b5d0736b11d348805ac9d31cc9c2c4dbca8000000000e8000000002000020000000a41ac8b8e19f7d0846c05cae21b7f3076d275abf52cac611daa4c985bfd5ff89200000001fc1eec0920acfc30842f6c056d59da2034ae01f9877fb247530ca295651237640000000e51cb890d86c1d314990d97058f8827aa9453ae59da972476631e307d310b655b8d8ebf2009cefc35a6162d2c980c5a8896ef96575145a4622690ef0d2b3de42	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ffc750acabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422477793"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
992	iexplore.exe
992	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2604	992	iexplore.exe	28
PID 992 wrote to memory of 2604	992	iexplore.exe	28
PID 992 wrote to memory of 2604	992	iexplore.exe	28
PID 992 wrote to memory of 2604	992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\644c981bee6aff3fc03b1bbdb4c9a656_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f0573ed4b5b249ba2b9bec4a366839a

SHA1
084224c61814142590f6c3b6bab70fd46313ee56

SHA256
66ab21f5e5a13926e4b9adce12cc52aeebb5d70e0747e520df6149c47b8cc26f

SHA512
64af675bc9f4651a05687c1131ab3d029ed822c8aa3f950d409f561965bff9fa65c28df8b0c058e2321dfee18ca6c77237bbf647f363cb429a5410079ad0982d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45ee06aaee6429f4ccddb3ba459d78aa

SHA1
396aec475251c371b696b3e21d3004d953d09b96

SHA256
6e709ebf1af2854aa265139c6d8765861392c11cc5a0a143a918dc7bd56a8f38

SHA512
c70d4ed2ab5ce420e5d8a649d2cae57e675bfa77a3b91dca6eeffdf961180c3c18902e26ce47d84affcf118e3190420d2e8ec0625e86e4e99533c8516dd625e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2095b000f5c1d190047fe88504019806

SHA1
400ad42c8bc5730c31e83d4410375f88795aec0d

SHA256
e04ba6920ecaaaabdcc59096c972a1e32b91d0601375c7b4f7814cef3b3f7304

SHA512
4f25ac767148cfd4a343c032faaf3beddf36501a530450d07cc0e5699b95d18b5591f612f55629db7b547d0d8642ba58fe1d99f8470c3757529aabe9cf751f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af1718f79c169693c0e0025e12e2f87e

SHA1
06b1a1959e753a46481bf38993e12424b7d9b648

SHA256
39982113161455848c2a5e80832296bbe0ed57704978a66f0a3596049a5ee319

SHA512
28bd8c9445d5d9016cb2d2d5b69d05f2cf7367658050df4c73fe3d5b83dee1df891be7d5cb764fb21c340fd0031c2134883c9088fa4613550f5bd4e303a8f9be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a584a51db0b4b4b4447ac06bbb8648fa

SHA1
a921d961483036acf356aa9f8c195f53c5a99899

SHA256
dcbcd2fed2afaee9a44f9fd753497665b23b8209803228d5e514287f872a4d65

SHA512
023b6489981690fa3f80e83957feb532f547ad5b00af7525492c983eda95b66c5d17ceb9302ffbb25a2cd94d28aa64f2f25e711e2b70c6745c79003ff632a8c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fac4f07ded76fd6226d348eba8252639

SHA1
302c71c720cc2a98332e79d5be9007320f42a9f1

SHA256
5cfe7e176758c405db61005452d76df2c9c8ee7d231023593459034842e3df44

SHA512
e8d8f55034c34574578f48c7424b3903b87f9bf7f43c8b3574bfdf4c34ce313efcb9460aeba284e7a770d5502d1045a05aa5e70277d00ea5270e8a7e6f0b2cbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
879365ec6b4b57554d5619773fe9f5c3

SHA1
1387cc749a2c73d5d8af1b779482cecb0637dd9c

SHA256
a3f65426fc8675b8e81ae359c5b0942c16042ea77fd209d6f4e75e5b3905ac2f

SHA512
52c2a6bc2d2d5fbde3e735f2bdd5bb84e66fce2c2e9a80b5cf5f982184d11ef5bf1387ba15694a7b883fe21621c8c7179bf1873b91a002b51f2f8b08d046ea5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
033d24570e59b7fe0c3c2c85278d2c3f

SHA1
3b038d85d727fca5dfe962f92da4f4f563348463

SHA256
82a359bfee751f50db09b778a16b9bf3fa8bf96c737237fb1c5534e9ad2fd0db

SHA512
ed215e9ae95001814da2fef85bc8df73a3a2b7234da7798bf8b9f0d8cc0b3e7029cd53a002572eac2b26addd2fc1e9a3cc97f848616aaa0f9dbaade24268a0f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
624cb55a3853370edaca8173e7fdaea7

SHA1
4d2766f94bcc8e8e5ee1140a66dd8afec38eb557

SHA256
03f7f8c4c632ecae534b8b269b85ea47970f534350c343a0b3ae2f906ffaf57d

SHA512
940465670a9f7be583d917479d8c81f3ffc92d60e140339da5cff2714e6aff40aeb0bfce499e1bb3136291330a3882141d04e234e8302837c0160de1acb3ed9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ed8e64c3279e699acafd4a8d4f201ec

SHA1
7e671196e11d6747c96d40ac74bbe0cee43cac97

SHA256
5ce44467ea1f6f0dac928824b3453aef284486601c6a8b12be79bc61e01f2e3c

SHA512
5e2dab3b8d58b407aad7eae922042f46e0b8bdd92d5beb54f38975a12f771060f144ad1d737288c921889a9e66336c0fc01a7d7798d6233bedd70650dd5ad9e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47a5988f63a926dd304c3fdf80fc0b35

SHA1
93a3bf8d0781fe5acab540987a5c2c9d02e967bd

SHA256
f86384be9997fc1a9a33d1384c9ac28445b904d3c96c0be46bb676b8c4a7eca4

SHA512
9abfba64dc6356f501a37871d98b3b7f1110ee884696ecd22058fa881d68389db317332b836ab6fcdb6af9bc07532fbba8a737a60bdfd03fbad0bb6a49df2849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a29e8aecc75d7c3929db50415dec0c6

SHA1
e721c19cedc58dc2c10a5282e28aaaaec3673d21

SHA256
b2e5a879570d042d72a82118b127bbc2afa52bb40e8048d0ad2cc40ade1f4b57

SHA512
bd652132084e7c41248602990f3edcb5caa323fbb290456c893b10a3cbe836d58e21f00335f2b5fa7a664a5b101b87ecd58173fc75d43ef2581187f405fd766b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d92d8f7a7da7f6b73a903da3076d0f1b

SHA1
d089d69a329664d3f1363941468a3f0b62877c3a

SHA256
41a564b99b77603ad47eb1c49759ed8fef0e77b069bc830222855e75e8fdd9ce

SHA512
76e90f16465e8148c17479eadd9e88cd0cff4785dbeede43309b787c01feb303c6e940a16bf8404c5471f832a60d00796b0484e448bb68ed0a34d7e5c9726ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbf9590f2012a1e81a1425f97d7d66bd

SHA1
c44dcff3141c17131a2fadbde5c5a9555373f2dc

SHA256
a07a79061a86fa71e82cbdeb427e23ba392b425006c8c1118b3bd7b1657c550a

SHA512
0cf5a8c1746395c7726c359c9743d733201aadce49935fcd4f1e53f874c2576dddc35b32ccba869fa71e522f71e95c809d605efc6a55f4c0fd469bf485ee1b43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7e7506e5262a8f4df423862282017e5

SHA1
ed062dd6695fb5862ac810118e241573083f09f6

SHA256
29ed8558e8903eed9ce44d116aae2c2dcbad763adad5bdd981f66499f08a2ca8

SHA512
3f9c261fa2a64d2ca404686b3372b88bf65c5e506b9e0c4f58d4e198049daea65e30e3ca24e9028a6041e9865797015d7f02ddbc05db335447069d38bbeeeb8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D69.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DDA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit