96e4be58e3290e5d683685e4974f175a36bd3946296eaa5c6e86016b6b4cdc56

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6eb80d7ee5cb08dcd21d1136d194cca3_JaffaCakes118.html
Size

3KB
MD5

6eb80d7ee5cb08dcd21d1136d194cca3
SHA1

c77ee35b4d97844f7f5a3ca74bbc2791f4cb82e6
SHA256

96e4be58e3290e5d683685e4974f175a36bd3946296eaa5c6e86016b6b4cdc56
SHA512

f9d37bf1f39d32685802591077eb54b1a7b297b70b62d3fbc5efd8dbe5f043606a4a179cc25771c1ae649d00ad05d030dbd4a9fcb3b3a00dbab0fd7ae8c9063b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D91FE251-19D3-11EF-9340-6EAD7206CC74} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000929fd894c8ecc940b4e0cf0a4ded14ed00000000020000000000106600000001000020000000f8e5fcc8d1c81b3a55ca4e933cc88919cd205b78a6c41849e3af3fb43bd02e55000000000e8000000002000020000000decc31a311b4036fcf3d34bdc7d3af20e49a9d2b911e9438b37e6d2d8680c37390000000607070b2bdb96b50d09d56ec6bf30e0c823bfb12a89942609424f7f0e8572e5e67873ee781c989f930b7182d2730f6a63b01f280d17c8a44a887b64f475291c8cea1feb173bcf4ac09b4ad5a4b0d6b7a98f4ec12ed8d9d460e352b20a34ff83f69413da962beea14d2007c5672b3aae77e1a6d92e63f292b8d69c14102b79e6c17b7d655f242108c02e7126c8b2301664000000077a55782e75157c175fd94ea9e523f1a1a8a75101857cbb3d88ab626169e8440d174bc1f4fbb674c0085841c7ba31887321d26f7eff3de923b2aac2ed463798c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fa41aee0adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000929fd894c8ecc940b4e0cf0a4ded14ed000000000200000000001066000000010000200000002ff736f8e8a339c39ec2ff89a0df31b4a4df3d3e84cd1f81c5fb427edfad528b000000000e80000000020000200000008ebe6a7cf2805fb0dbf81b5599183e7c545471dcfe6c022a53cb2bf0834bc98b20000000fe8b27460195b1c72b9fe6c5ff69913767ba66f5a48d64074a2e8547e8f9bd13400000009d7f995d826391c04a72ffcf222daa04c243976dd9141a8cbadcc14e8d6ac401fc4032021bd38d18ce1f83a880e52dd284346a572d3a5ea61f9b65d516394a06	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422720184"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1812	iexplore.exe
1812	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6eb80d7ee5cb08dcd21d1136d194cca3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1f9047640f2be7836c09a6e61aa1f3f

SHA1
8c6e1a0bc6f5852736eee38b9e43d276f1752bc3

SHA256
78f3514c4bff83b158d1fa2eabbd1d9ab8e614a09bfc3348e3a767a88e057cf1

SHA512
9a3026fee2db97def3e862faeb68456c7e3bfd1f34f96ffa84908cc90f099697ebb7ea28cdc800fcce91a288f5d035b3f79c1bd4f5c3bb7486b511d5986aad8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf280c0ca16dc4b38b158e8e6581d28

SHA1
74e24a5b0181a8daf0e63c097cd2524dee5e7e8c

SHA256
9e0753a06bccd7b539d59231eb183589da325c44607c691beda15d31542a84e2

SHA512
f668e16e1b5d3ec9e03eef282ed4a450f0661806004586ba973c95298baa391b43eb45045a5a5706de26123d124482eb3227e76882b25298fd71fbfcf6004d6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e08439373662c9f126727925cfed50

SHA1
fc0c4be6644b5392cb6dee445d3317cf60479b0f

SHA256
77b1e3915a5d9a6e62bdd69d658f42f648d70d913f7a0ac071ead04749435454

SHA512
a22f6ee253fb9d9f572b9e024835b827bf3f02213de8b4e15a3fa0de30aa1f05743f274309a0317adda1fb1bd78f955ab0c5c9139b5e69fe18b7c3f677c27a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e77928e86f7804ab2b7c475db92265

SHA1
8fa8630d1b7a3ace4f0495a9604166dd39094c74

SHA256
6c3fb45acc150ce0fffbf9b7f78be1582e1983d401d37f1ce3475c7e56e9009e

SHA512
5eee335690b4b3189b67e6d27dba357bf8d25c337fe849f15d92b2093f8618a3c1d61ccd2a05135fcb1676ca6723de63c607d31ad13c41a083744be5264efe99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6925c25a2b3ce8a35319c2fa15cc1c

SHA1
b5e5d34d1538dfe6d8b15e6916bbc96cb12d632a

SHA256
3516b7a8c3a2777246766b8b9a7c2b6e9c917cec506cf0db7c1285b71c1ec3e0

SHA512
0eb07054d3deefb0a42421d19cdd7a606611f51cefff20befa83c3ab99fab255ea430c2df6bf369f0f1a31f042cbdc2dc1659f6d7404a26a7a55a0d6a5fe3c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2376a2f8353ce522cb85c9412042c80c

SHA1
96c7ff23a996c55c0435cc6a9000865447dd0846

SHA256
2fbae06c367ae5673e62b9e008a205f01186e5995ac93d715ece92c0eb5e2ef6

SHA512
95900ce62249d1ce6e16ddccf74368efa9ea2a034e8a3d9dc5862aee390f160f2fa6ff70d908988bd87e9ec775c5fbc7687829721de579d7c1123521843fee9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e73cc3e431ed7874556e800795f14c5d

SHA1
97bc9f919073dc108996d0412defe210819c6940

SHA256
4038860d1c2e1880353f0c5a7953a3560374aed2355844e24a4712a472332d2c

SHA512
c33c87c0b03688258e2efe9fdeed59641bc64c18f986389ddf3ca66d01f09907f35b0a3b29b726759393c62d6d16181c1897088b34cdce7ebcd886634529b247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc1fcd31135c99a0ed9c640c93b3046c

SHA1
418b67262ea1c19ae87c69450998519a7797c0ce

SHA256
794cbd9057f1bd57d2d7763d90337c7c386627161a3682d095335276e031b05d

SHA512
6ef5afd5b1f017ba69608be8297535f7cd1f3e962f01c1c945abae875a59623d441ad7be2c096884d19aab80f6e85834fe01f3ffed156128b5a02aff0a458d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ef5a453004f2c41766661b590e8cb8

SHA1
281501df252f3a0323e83a32ff59f5012e45617e

SHA256
51df172a4b805d2d58dd52c3465551a4e93522cbfdddc3a1c7474d33a4b48298

SHA512
7ad1067002f17768b7378fc5085a3da42aa501c9a1ef6283d7415a8f7652e25ad8ffb249c886c16199688d789d2c1f08f4ecdad731e5cc1688edd1f477a159f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
949f4a98a9bb6020e87c96bd908e5768

SHA1
d078a305532c512a63e42f4d060f31a7b5ea4f87

SHA256
d410dfddcc6df750bc7c0725b1e02b9d730ca409a5d178e36b6127d1367e12fa

SHA512
f04952d08360faf7c36dbf21b42a004510b0048eded0d6ca39bb4010ac5536d188d3d63decd53eaba379714d1ee0009d485973048455e860254ce9409a4fff6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80860689195f837ee470e46ff1a1dc17

SHA1
7b6d5d3cdeacc5edb6224c9cc00ab1504a247c26

SHA256
0163ef6f76d1cd3ea76dfc2240f137bde8ac9161e0728919752aba9a5b253f07

SHA512
eefa653dc72142f49ff7b77157edc1eb5b14dc36321bb50b55dcfee0eb3c103e015a475b7341e6e64fc907bc82770392f32b4953a24227ff017391cc8117ccbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00a8cf518e62362dc140ad2c0319c74a

SHA1
d938902117650f70fc31ec5589582bd5f9e14b5e

SHA256
b26953a76fbad38a493c383f5d5dbfaa3a1ac80e3cbcc7d22a8851fbc862f1b6

SHA512
256f76cb1f4869ba9d929f5a1445de1b8308ae1d7b1afccbd9af26fb869d2d51846bf2957d6434854aef07e23db7223039b578152bf65af616ee034e6f33cecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efdfa830cbca70996b93c89b83f92ebd

SHA1
b3e8fd0a36385b980368e1e4936e3f3f14478b2a

SHA256
40f5d2c78d6058771dfacc0b9530a872eed2d96b52899edf8791fff61536f64e

SHA512
d4b3c841a4cd412ce9cb674413917c4ff7de0b719cd8dd48d4b4a8fff9303050209fd9951cdbd1301ec8061082bae92ee60f57d795c642cdf72b4bda6e52e66f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C22.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DA0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit