83988f3d03a6764d0db37d82370fa3a962fe50296feed976d3d1cb272a91f92a

Analysis

max time kernel
133s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

648239d24eed54eef95ad7aa8cfd720d_JaffaCakes118.html
Size

3KB
MD5

648239d24eed54eef95ad7aa8cfd720d
SHA1

0e2fd1b0a8cf705169c587323e5c2e99ad441c8e
SHA256

83988f3d03a6764d0db37d82370fa3a962fe50296feed976d3d1cb272a91f92a
SHA512

a98557fe94e8c3c45e8b542b7caf606188949f88fa547caee340f4d9cf0dd9cd60dab4afae99706a0278f4962e307622beb1e3028bab8755330f30c3b7f2f71d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d04fd33cb6abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008e07aa5398803497fbd9e64f039125e00de1bcc370adc756f7d150465a3f721c000000000e80000000020000200000000260a7fe7c5b80a19418f78fdb5b255a90b0c5298305cd54b56b909c5bae0478200000004bfecc4cfdd84267c9ebdf209e9b21ee099aa8889763e5d05022be70cdd48d1f4000000047618d15573ab09a002f6a8d494ce4d6383a344f18bba941f3b493f4f5de6c790e7cbec4d21982b3f98af7bbdd1ab956ed71e7a46d5186172ff4b9614f1fd83e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422482050"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67F8FED1-17A9-11EF-A4F7-5A451966104F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f221264b0355edf0dd1122261c164ca4e26271623f5ee427b4e0096e25902132000000000e8000000002000020000000c368433c4b250bff6e3c40a2770e8b8230621ed945c292dc244c35b4e84ff9c0900000000baece44cc96a5b5189d985daca7f268e3b11bd56e68fa31614e214805e344cd37e87e11c7e67a371ec58da972cddecc3c7da70208aadc03815a6ba83d988bdd9aaa800af24be2a2be3dce8b46c80acaa71503b8e821c2fb3eb93312ef074c571295fbb74288accf9440f6cd8734bbb245a98e69e96deef75b1f942f5a15b70cd2378e58fafea186a5bcbf7f369059314000000051d2acd7b5171fe0f3f5eb0a002803917ccf754a9e27c9178cdc997fea5e4cc7da2b15ef51d21c93c1bc270751421448df3a47f9470905c0043baad2e7a894a1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2836	2156	iexplore.exe	28
PID 2156 wrote to memory of 2836	2156	iexplore.exe	28
PID 2156 wrote to memory of 2836	2156	iexplore.exe	28
PID 2156 wrote to memory of 2836	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\648239d24eed54eef95ad7aa8cfd720d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59bab1a03873f4fdfff8dbcd8c253aa4

SHA1
2ff1b9ed15156a0df084640e8b26e17a31f6bfe0

SHA256
072def505cb42051f2ffff5bcbff5ba8c775c2e2b38bd28a38be80c7c13c388e

SHA512
d271b8ff946aad608b0f3a0a72828601c8e308378953df128c0a91ffa4184196706a57e6ba91f003590869921e750742780dedcf0aa29697a87a67e6f71522aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
247d677e8c1caa18b95e3799bdd31448

SHA1
9ceb37d5da51db0c513d83840e6be75e4b5fd486

SHA256
6ba17d17ba941e4303033df3b1ca33fdf535930383017dd194d95c9292ec15e2

SHA512
1ecef33a71078179dfae63bf68a206f5187c9ddbe21df179aee370e73f190c1966ff6d574c3c79fb77a1cdd75ca1236c92311d46d53c509eeb6670ede1b876d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2c8fe21f21670bc73e9a26573fba09c

SHA1
811df555ec896f4d2f348b702c9a62ff5efc747b

SHA256
104f5f3edaff6354bec1ea1b4811455d247e4801203092fe70bb6c0a947793a9

SHA512
89ffd9de7f81041e3d2a39ec69b222a6f53e74fcd5b895a9b9d5b91f7f9bafa7ec2e16a87f72d4e56a4d8a9018cdc725b04ad860428fd247da105e2555689c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30cc6e2492f2ab9a03c2c786dd9a22f2

SHA1
99f504eb89a8f4edf44f2818b08371fafacee62f

SHA256
3d9b839c39e905097d411ba02a5824bdd23ff0b77168eeb8b597feb606d54238

SHA512
807e48b1d5831eac78e6d491128cb9d87c82d3fcf19571a0ab2e2b61c23442bfc34d581e1ea6ac1219e156f85069d0e1f7f642b2287e221e1b70fd02e5fd8eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ee4d3e04cb5b02aeeae0676a7bc6e19

SHA1
da04164a5cae08cd997fedf266665b67481cf960

SHA256
cc7dfa7290bd9ac0009ee64d96be15a7872202603c23048ee7cc03068d5b9efa

SHA512
7be772074f18470b29373941397fbf8e9cebc406f1ecd8ad01fb47466b01a7ac623ec8fc18d2ff211d88293c212d4dd1fc898eaa9e9ef7f71f97dd28fb4c5c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d373751bfb61ab54d5404fd86877ac17

SHA1
1d607cfd8103cd2dcdc88998d840dc12371951e5

SHA256
f1e471597e497ca5219ec0b1eda1441fc17d82824ea70be275f86d909485d818

SHA512
61700610ff1fc21278ef659845e7da364d6036614e2ce81df9565786e5e66e599a87708b48edbbb2e39520aaed3508b74c1e8958b81512e265492ed6e9c479c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a11247ae8afafd2bcf1bd6999d59f7d8

SHA1
36ea11a98c5e22249138479f66396ae7bab82572

SHA256
f6991baf0902f9260014c2530a9f70fcc5d53df014cf01ae8280c4755b069954

SHA512
b24a52010aedb301636d7d4803e159ed49447a677ae9829b768d342712b9a48e4de0bd80b9b635049d06727a25aad4e2a0e167ca212fa001bf5e35ccc35930c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24fc5e11b689c363cc85a8e15b3d7c07

SHA1
c0aea516b9b3f7bf3d2bdbf32793166ad9a8b951

SHA256
1979d792bb05a9ac242c82e9727113ef505b6ce7f41ae1a5a64794582f2301ee

SHA512
7b2a8244aa8c8a417c452747948608eabed657667a63f12bd3022847d6849fd4a64eb755e6c9cb9f491e15c677c41ef91438bfaab3fc83d644de8ff4ec1dd5f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da4593bd8e577bfb3318bfb835c11fb8

SHA1
b2c9ace115da4c9225c5a786d2e58ed6275df15e

SHA256
df42791cd047b1ddd53ca320c6db0b08ec8175629724c8544f59bbd7b14b6848

SHA512
836e08f69053ac101c6c11bba998b47100ec71d43ceaa54bf2dc733844c5cd12d5fbb96b0e686f3aa8e1e7f0f3f13769d20cf4ba3883c2578d878306437f0b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f63cb350ea3b4df3a44c14c16106aec

SHA1
c18a2d6be4f1ecb9949b2f8814ea6c3eb6304c0d

SHA256
47c82519140b1bf7f39d079f2ccf37feef2471e90db41826ef8cce9afdfe62ff

SHA512
a016d82ed337418d241c18fff2b392dd1641ef801130a4c936a161a7bf84c35f203011829f86d03a7be7052a7d6472980a479a0a0d37aaee21b04f0215e97cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8305cd7ed6d018282f12b4ed2a5b72b

SHA1
e3b9b1ccbe99e53ec5ea7e02570bc21dd978c2bd

SHA256
cd110f917fd44a0a83e2a25369067c471bff121f4200c5838d54a92d3a5ec07d

SHA512
1c18a4237094280ac3ca2d54dfe6cfa15fd5d3f6d5d4b26a78d226bf4e52b958d39dbbf8a08a3d499c0ce0d4a4bc4d7f4881111b5471a8697a36cdcf0be326f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8713e3d0d923e197cb658a4569938872

SHA1
ed88bd3342e236b442866f0485dd7f85b9729e41

SHA256
d35a046b97dc79038c368d0f34be4b7cc583c75def12104ad3fa61745c76c62c

SHA512
0b3da6d827762b55b1fdb2c99a10c929082e87ddd69ed3721a8bd5e98d9a73e4f35a1b5ea71bfa7ae157d27c3706ed1f1fea5eb709c9cfad0376a2336a3c30cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d39dbdc42cb6a42d1fa085a06454f097

SHA1
e54f7d674a4fabd67618cc9afb5b8f38d77f65c8

SHA256
ed6362ea2713913221ac8ba8b778087c585392bbbaffc722e7d2cf711fef00e1

SHA512
00a45347c66cc00fdbc6fecac425d57bc3479064e0764e0061511fafb827c031d0f8e37d3e91b33ba3f77ea9d38374533683771f31a44d08d079df872cc2f2c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c4f462500515ab53b16737cbc51736b

SHA1
69e4fb8f2c4a97b7d7ca7fe2d8b506eed30d3b74

SHA256
6aa421efcd1b6b96c7bb13b5a457107a50310d4073b6bb10c808bf0ac0d4db40

SHA512
d0c414dcd63485b955af1f5718c2a8b862337547f720e728beb8f6ac637c8f3dadae4b333e702c1bcb3468213dfbdc7cd48c19f883858f61145aa083a3a2b7a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beb315bbe3a742be128916b288944d73

SHA1
de5232a014bc5f9cafbdc98821d5cc8b95f8ae17

SHA256
daa9a889bac654184b058707f5d9931600fe501481a6956ad7a9803a9b404a51

SHA512
2cb86547ab7687c1ed7f56ff0175e0718464c58e60cdd98182b938b878a6b8b8820bee560640ca9bcc788ee96c88ab86868665ab5e1f3de60d32ead96dfdfce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfb4ee52ecd99fa6b1c6f5a280cb48fa

SHA1
c2119451b45f7c44a2bebd8266d6fffa2a1439d0

SHA256
56f320beb3e9e6d07cf84fee9f3555263f2180d877005ee4897f21512539a019

SHA512
1983f6d0e1c54d6f7792d79c13a7cdf58171a9aa32ab133e409678df6c9b2db35712cf641074b681643d904778167f8e3588af08e63b468d2afe042d248dc1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab368E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar371D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit