92d6b36a2d6e6843578e1aee589f369378b50618632e6ed6d75fdabf65cb63c3

Analysis

max time kernel
133s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6949ed9a7cd8f619079ca76984bca3ce_JaffaCakes118.html
Size

946B
MD5

6949ed9a7cd8f619079ca76984bca3ce
SHA1

4c5365fd016082e27243d5c62579bf9768b880ec
SHA256

92d6b36a2d6e6843578e1aee589f369378b50618632e6ed6d75fdabf65cb63c3
SHA512

ba23508d20928a983aedda57325592b31a973a681d4b874d68e3c2d3e355f5c01f4a30b2ff723d45c001028a8124926b12f8aaa80950ca34649dc9648341aca7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b6ddb1b0acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422589621"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ed83f86d6211746e7494eed3cac997bc0ff2244c8780d92bbe2eb68246bbe3b0000000000e800000000200002000000090f2e7c57713cc0ddbc39220fd3a04b3b95f6d020056ed9fdb3035353418e0db20000000de911f10d85dc1f93e21a40a6f732f48665f6c75d360284b896b9bd6777a98e9400000006ad5193021b0cd786509ebdfbc1797f04645194b8208f70fb46e808daef2b50547dd129b4786ecf76fc4f553e8603ebb39a333720a05c52bdc128967456090a8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000002b3937efe24743e8e6bddf6ae6f75a8a106a89a8d88fd0fce077bca5d1a7c34000000000e80000000020000200000005e9aceee80aee5701db79f335bcac90aa5e4757f43705d9c5a981b7102586c3490000000515e1026b612c1da3b717d47f1bbadca58e805bdc8afccb6291516e7f1820ffc353bb6c34fccbdf150ec318367f06f903695caacc88bf193b85b4eea9ec37c8058d258f30c5c0a083ae0069c9de2013751f892c2466df3fff68d9e9f5cf0a40a5bd3ce94a7bbbb03c91404cb91b4a0f41b3d7a804a13a252453f2a238fcb11c4142da32479e942c1bcb6163676768d3d400000007635f5ca368ce4071d8c7ae72bbe2373fe48938867d5497c703a54b1e11821906054b5e97086de458bfecec64b9d39395f0ae28cc3334db41df99a1a83233d1d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD4C6D21-18A3-11EF-B944-E2C1BAF7F8C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1960 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1960 iexplore.exe
1960 iexplore.exe
2164 IEXPLORE.EXE
2164 IEXPLORE.EXE
2164 IEXPLORE.EXE
2164 IEXPLORE.EXE

pid	process
1960	iexplore.exe

pid	process
1960	iexplore.exe
1960	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1960 wrote to memory of 2164	1960	iexplore.exe	IEXPLORE.EXE
PID 1960 wrote to memory of 2164	1960	iexplore.exe	IEXPLORE.EXE
PID 1960 wrote to memory of 2164	1960	iexplore.exe	IEXPLORE.EXE
PID 1960 wrote to memory of 2164	1960	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6949ed9a7cd8f619079ca76984bca3ce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adafa79b48ada962a0ad8360e5ac5e8a

SHA1
969ebdfe826a91cdb4b279316cea52ca469d9c35

SHA256
13367ce6b751979b51d4eb5fba7cb2e00a18a8bc5418dbfd90dceca1a8ca51b4

SHA512
d76672843dce75c472b162a35c8e8e28ae63549aafa7d2ac5d5af0efea7bb6f11cbc7d3cc03d03dee57c15a6a6aaf7076ac8ca3912ecb18565c293ad759ee3fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2838f9d02bc8aa40983652a54aad9756

SHA1
a76265bdca16df671160abeb556d7282d30a615e

SHA256
26d5cb2d352347f3445353f1257ea815146f13ff1a6e2298e5ed4e6a1416c0b4

SHA512
0b56f44bf68d68ce5971c7229c3a7987f7603f79f61569b067b6e40f8733542e60c9b2f69bea7d080d5a0887f6ab285c0831f7df5edfc4d954e0d309e9c8ed65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
460d8e76b747671aed0025147d29d3f9

SHA1
203021bb98debe02bd0c32ab50b726b278bbe323

SHA256
344c2c314926760b7f9888f0a93f7744dafc75770311e998bf2068f27074ba5d

SHA512
3972bace2a65abd5741dc69ee965a480418b682f0da7ad4cd88f68323dd47a0d3dd19fed4319914e630b35e8d37ed1c3c218c5b124ec937d33c117866cccf0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d39ec47d02dc515b599e11cd47ab5eb9

SHA1
5f1e0aa46243681a07b0e98c390ccb6267e2d6eb

SHA256
1e3f05113b3ef969d71c1c08c857a2f2ff888594ad0d9617a6665badc4584b38

SHA512
ba2e8970de6fdf19f74ae937461965eabdf23c5f9a75dbf4af88a4806900a5bc3a1c84150f736ef039ff853a2105ebb745e7b22dc60165959beaefac3da9984b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b236a9e0a1180632d50d76c597d294df

SHA1
e6ed0f62932ac95914b5e4bd848631a90ca871b0

SHA256
692da5b0a012d6f3441b6370e8301489938896d18a4da3dcb7864970ff741268

SHA512
ecf17db7df43b284f18a736ac7467f1a9b2a0e982011513f321d7d1dc399e5e66ddef7f2dd9186bdb47847736a14e41bfd3135a7576c348a925a7f6ab8cacab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9ef3442cacf9f43bd7424f270ccc34d

SHA1
fb5ee497d2f009e6509725f5667d34b66923655a

SHA256
d4127d2f45fd3547894b8236cee41569509e9f4ab1a87414fac7ee684ff70fa7

SHA512
1ba51c7857e820122544bf4460acac4544b2e605871a3140091f5c6d12435725733ed55ba4642db4c5ee3e45257b09561c78a79c6130a5e2b0fa3aa097d8aafa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e2873fd14428c7bc4990ae082ce02fe

SHA1
7be6fd97b113b1d3f37efcc4d93a09da06be0b3f

SHA256
c03b6da6f9efd9c2c3a0e8c0ba07509210fc0948c390ab89e3a9c673354012c3

SHA512
4c4349c333d224ed2ac3cdae2f480fbdd6cff77ecb4b314fd4d28cc34f75ee81b8862e268e63eb843d5e9e7d091a33e7bb31a99a61bd54b2023c9c16407b733d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e4c169251e053949d722c8ceedbe487

SHA1
e14dd92c4d0818650a3e90967b54270ae26b0456

SHA256
0a9bf08c4eb7045014acf0649b1b2d190fe32edcf178bc7aacd05cba1683fc10

SHA512
cb17c582881f5153f75a8a69c93f173b5dc5045b2d00505dcf2faa687d68942d92aa92c8ccabb43534b3fe0be80b8a93f42c4fb022503587cab10f2581282af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c199119a9cf9aa29c0fee87841ec754

SHA1
6a798d43b42993887bd9c9ee1159388f86b51bba

SHA256
fc44eaaf62c59f5742aeaa77adbbed7295898bd280b98bd655847b29581b248b

SHA512
51978c4fae046c68a4604eabc3f6191ac77e4eaa1d4452d8bc2546c44a4d44e2d8a29909f75191314b24b689ccfaad0b7e354ab2a0ec856f3c8a45adf278347a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3097a9072268d9ca38258972cc3776a

SHA1
97e6bc90929502183db409e6f08015204c078b6e

SHA256
89a17172c8c5fe773f5e0caab2f44fb5ab8469f0483f1f547705cf490d34d39b

SHA512
ea8954ab5ac659731e3703bf424ffad1155c866d56fa377074a5a3bd95fbfe8f417b99c7dca34b971549576222267537f7227ed0ffb6c09a17802992f1597ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25570eee012e90ab1bb3c28ba47af8dd

SHA1
78c9716ce9bb0aeaa7dae9e887619d0e1dd35bfa

SHA256
25db5de3a9c40cefd9fcb1976c1d551796914e66110a6bae5b838f5fc3888f81

SHA512
0528ed4c4700a7dabfeb7d81b4c8e902ba181907cc17b886c0491ebea4723d593d3053bab055e517db6949462a0ec289770cc03e001b56d3f5f3f2169e8bdc06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a411ea4e6a6eb27a9e0dbc37fcbed143

SHA1
2e99553b8af8d20cf0ab4ae3af9e713aaf255b6f

SHA256
cc1e522c58d3bc460d9b89441e1baa921138d2ef03e7178023490253f27f17be

SHA512
d38a679cac9c12db7bbe1275a79b594e1d777246adc210fc3495df400f46237706c70c2c426bd0817ca09a15d9a0ac30ab1a644241f12a8d09e778dcbfc7e3dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77b74038669095e1fd9080e90aa42cf8

SHA1
a168d51e8e8926dfd2a33a489887cab5369bfaab

SHA256
40ba5c79921774a11348e92eeedd6e13e1ca8deda8f85f9611026fb747987c73

SHA512
910e0275c774a106942b020465e37fcb5750404d95c02a4932f4c63d2599cbaa4ff629cb68006053c0bc8d642408c66dd9a608417962daac99fb8e398a063e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75c8349f4ed235c230a3e4c012406775

SHA1
5472356aecb17d6cd437a9e58020b065632379ac

SHA256
674ee1726cd50e6fc08eacb2218d13af1ca2b88d54c54d8a06685595bcc90a7b

SHA512
0a19caab2e9645aa5e450fa81aaf28d9febd10e6d0d5eb37d290ab07aed07b51f61badf6fc68f27b0a601701ac3eaeddde03119e21ca59e05212f84a50d34cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8d2b5641cb9d0f0e5539bb4955cc786

SHA1
9daa26fa88c9f4725abd410b7c02be841925ed40

SHA256
99e3cb96d264100ca5be2d96eb588052efa553710e9f462c9afeea017ff92ea2

SHA512
cb01298b5d35d366ecb467461d4cdba8b7e1511057210edb7f839a9aee0d152eb87d1a1179485876a0fcdca89eb2b5a91eee1f827af5cf7454ba951aeb88ad45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4402b6826a573f4985313e2b4009140

SHA1
d93c4d8458f59438141031a10927bc147110d9f6

SHA256
a6a5bc89eb015222fd5660248a260164f965bd6d44cfbff2c424db1700e5875c

SHA512
dc2d86c4d2e9f1bc66b44436a4cd7376ffead332979358729360ddc0ba55245d257bd8f74dfffce59ff0cb4c9b4b640eaa9392e28ea418262cf217c680a96dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3141.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3192.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit