050353a20ab4ae7428f0f68ad55cad2dea3b2d1536cc25d64a80badd57969de4

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b91d7fd56584b4a65ef3108dc666b75_JaffaCakes118.html
Size

3KB
MD5

6b91d7fd56584b4a65ef3108dc666b75
SHA1

18cd7b33117694f60c07f7858bb10fd0993530b1
SHA256

050353a20ab4ae7428f0f68ad55cad2dea3b2d1536cc25d64a80badd57969de4
SHA512

88c3dc97a3b162b3643ec8eec9200594ccf90b9acfa4c978fe272f1f7acad8dfa7a493da0195063158f6e75372320e24b6918267fbe3f476af04c243c2186fb8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03cdf322fadda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004bdb45b8800568a770272127852759536d01c1baf92075099ae97eab81bf6a25000000000e8000000002000020000000d4a5f536bc213a73f44d51f2ae38e047d71b5057c07c776660c755163f62249e9000000002e71c09ea1610ff8d88529154011a78859016f911491af52b5a55441927de3d882c66209594a13819c65218e2596525bba3cf35bda43e367bd174287d9f104f6559b39c16716eb8116a1a500de6551200ea8fb03db5bcd53846a68ddb673cda97b867e02ff000d807f873f66b064544919ef77135dc6a749b601652ae25424768c150bdb6a0bfc3b19cfb75964aae3540000000d48876cb9d9279540322bd6f4f286dd2eb9abdcae718a9a4a527ea5410ea841839e58171a6d95d0c4df495663c05ac0050c58ad4afd5a07958db4b8c8de8fb3f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422643959"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000054c6cd26425de95cda7f5986ce1d90242d1f48e1db9f046b7acb18d57692a90a000000000e8000000002000020000000bba38bde81be69b833ee3cce3637f0bb958d925beaa18901b0872a212be51956200000007933b80717412b00e91da3fd1b955dde1f442f2ed54233287c6eb1251a765485400000007faa3a3fb82200dad36ae776144b7d6a6af7218641750a25380269d112d04932b14ac2b6c19e33658fb84b5af776454551ddbc8b9a83d4193788c3b95086bd40	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E479A21-1922-11EF-B837-5AD7C7D11D06} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28
PID 2440 wrote to memory of 2872	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b91d7fd56584b4a65ef3108dc666b75_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8893870b6a4307a40f59c85694a4211d

SHA1
68017751492fe24d131b95304dc706550f54f6ae

SHA256
de9977e84806114826929ee48b30ef48d7d78b5ba2a8770739a7a60bedeac0b4

SHA512
f9b178e3e00effba9f2dfd558a8b6e852e2ae3e81ee8890e83b98b6cfe415267eedc0ed19afc7c2f5ecd14d9a141de8d5c6a5ff7ac776c27b560e5cbb5d7bbf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52c360dd2e8f8f451159113a392e6bb8

SHA1
65beecb66911520c09b1b2edeef84f4192bc70c6

SHA256
0f7708bf93a895f88342b4910b8314791ebb77335d4875039b114eb0668738f8

SHA512
34cd33b4b94de9f3fd41173c4ab38939be0f462d3869f2fc0b4da115d6240c6e8c5395ca077bb74cbe074b7415772fd102e15be09f7a2039b7dd0a51e7e8f388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e731b25a04ed3f2b48f2247374be065f

SHA1
03ad0e9886de57e2511d80a158ac7c1fe1252bf1

SHA256
a7bf0f50e2b6069f36259aabda566df4eca37a009bd897c012946a13e3dd07f0

SHA512
b03dcf2ffa32b7fac4bd79a1db24dd598f6df6c2fab7173b0c08861913d2d35cc93d3da4495c36d33e2232e4e256a690dd1133de7234483896e1169f31b3c933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b9803662e1c75f8d1a3d1a5cd5dab89

SHA1
d8e0083a96fa09cf29e639937ed87ff28826ab71

SHA256
9643526c896a93f7cc1647d29f3f81bb4ae354086c355e93716afb03cdde0c91

SHA512
8f182ab6e1d7f8558dc0f67ea987006a9bd1f66dc2c998d0a7e7cb39eef65d6f55cb73e05841fc5ac0a0a5fec8101292616751ad72cff68467df57df19a4d230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c010854ee462a0a559088303142fcf34

SHA1
9236d4da0d11895a5f49d64b1f80620a54afbd5c

SHA256
834d590becf33ce2fb3556a5464842f2d354687ed131c3e2028d1815444841a0

SHA512
0ba0b7648ddb7894aea67ed77a7c1a65c2ac2cb9be578b2230147b8cbf9913d834aa3ba25198ac140840a557a381e42e5edc187312d4754836125785179c6fce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ad156fe49b05383a2ce3b5cdc3726c4

SHA1
036a20f72214afc1d97545c106d046bfd56dd9aa

SHA256
7942d33e3cfac34e14e7af80b48f86c532c97b1f53d1696b51829b3963b664a1

SHA512
484d6ce9efc5fb5edd7a6b067abaf329bf8e4923ef054a395c3f62c0c5a705b6c4d228e4a4009fd86bae64634e95649927a73e74f3154a51c047520cd620d9e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
064d5e07bbb4513e0b37ba2446026a86

SHA1
fe07c4c45fca30af2526e6d81837282b55dfdee9

SHA256
186185f7d2bf5f958696c265c21f4c00aa0c3070fa17b2a07706a74ecc20f6b2

SHA512
5713e72d5ddffb6e398b53b656c0b9d9181e9414bac2a2af65895156c23bb38d60cab2d21449bc4cf640969311a46ea16328507144174765476b06a32a072481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05c1d5299ba91a9e02f44b1b5650612a

SHA1
a8b70f3694a86da39f048cd96c20acc2ee522969

SHA256
5cba1be81fa6fd5d4a9ebc6d7845f6f909b1f7cfc78f196ba697a1ca793b9625

SHA512
152e357239d10a6087b436b6daec33410ce7b42c0d01adda8ad94ac6f9900a887cad9d5c91ec7b81fd3a17aaaf9fd48cba84880b6dcc4a5eb7233d09b741880d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5123e5f547f7de3be326f90622c02ec9

SHA1
1f1e435ffc1a08340958dbd45cf47ab96682b0a7

SHA256
f704ebb0f419b78f201b8d1397a11d817b7d9d770908f1832b17855aa5b04ae3

SHA512
c303e57c40176486426f8be275c9505dbe2c3cb18156b597a375620a2ff372eaf2fa122501eaab6730195bc8647385d55ba9cf15be72c66e29304d8011fc4d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3a100747826dc36f6eb9d12b38223cd

SHA1
4b5092c01bfa7b34d7ad3f723064a6535476c66e

SHA256
2a3bdbbeca9f811d9398e428c9710f903d68308c8c7178b7f6d49fe822745688

SHA512
2d0f53b7d062cd7a83accac90b17649f7be24ead2fbe07c417bd69f6b6ec18106c108948d21ae3f528a347c6f6bd02f882e59386af8aee6fab18e37179f1dda5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42ca297efc764a39d2b5064a425bb2f9

SHA1
81faf6b03aa761358a044cb23d65961918d2f74c

SHA256
84e3d8ef54cc32bc1fc11593c685f0dd976aa6c004751bbe863201041f1b2cab

SHA512
c46bec64dce8ef887d48c8ddffac4d4e70695db1c04cca11d67b633bf636e61394a82ff36066a84da36a17c5f47184a29166b04c641dbc565f29b84f21d11b89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b457c0fcf3a041bb0fc7cde53a52828

SHA1
6fb03eba3abebea422a39c5778009d981af6fb4b

SHA256
5c5d18ad152e07ee9a193cbb83df0159cd967d855f0d8b0565cbed8fb6dce206

SHA512
042f244129ae787728b79d7bcaed7f7c5c6125ce6f4592a97313f8aa41383ca5a80dbd328f45147c244e97bf8830a2fde3792e766ab5ebee6ed367cfe0fd2fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5be11425f91c796cfb1878425deef52b

SHA1
3f63a53ef3b5f1356016afe8b36fcaaeeb266f9c

SHA256
a8f0bb1b1afa8b41402e02cc1074dc77e27a52baf730937e5a1204254cffc05a

SHA512
da5d3e79b5a23507f766f1f1f0c658a186c94e22134995c7e54b3f73d10a22e794ebef582adbcfcdc02f0af09575ba4c8efe3b367af35eb48dcd807d7fd7071b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80dbebd59a6c783895e9c1800a8483ae

SHA1
8254546566a4b518684d97b2b45c9a6130791c61

SHA256
aa5d5aec741fba3b6faf07005b7b6bcb5ca74157bdb8745a0b9cabad900f5039

SHA512
15a34a7b94c338f2b9a017b131bd924dc4d8af2849a86cffdc3dc1c4484c824414e0fee57ef218c076ae244383f12f5e3e83d41636f395a9e7efb5f6e3bf2775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
958aaa709cb2b794c6a8ed963767e4eb

SHA1
0e5ac705131025eeb89a170ac5a46a3e48ce5fe3

SHA256
735932fd62fedd0a4507e84d0312b16f1f466a556a8017b51941c3cc3f110c69

SHA512
8dc80c6bfa33034b1388dda5cd9cc08994ccffd4787ebd1ae08e11c32ae36c791f2157a145b6163d0ad3edfd071bc7457279afe360dd1fb46980abf460abf79d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23F8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2458.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit