5036ef65d9acbadfcacf0b9494f15a143f3a2d4c7e763f0f105fdc3689bbd007

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6f0fda3e74ae12cf1c2f4b32b5f3cff2_JaffaCakes118.html
Size

3KB
MD5

6f0fda3e74ae12cf1c2f4b32b5f3cff2
SHA1

32d142fb7e6b502cce26818a203868189f744959
SHA256

5036ef65d9acbadfcacf0b9494f15a143f3a2d4c7e763f0f105fdc3689bbd007
SHA512

ff5558abd5b3f9d8f4eda4cd2aa3ab2059f0ca58aaa9540295721bebbf03d9120d39c97688ca67b7549db66491fedbdde0a0b38a65b574d3c6cfba10293f783f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4992CC1-19E6-11EF-9CEF-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000145956d4c6541c40961b909448985f9100000000020000000000106600000001000020000000f481520f61037150ced39e211d25be1fe42134622edab62a3da6667415884ad5000000000e80000000020000200000007cb32ad0194563c3f9c9a487fb1dca5aea45f3ad7024a8b7ebd41ba94b1f8b3220000000279162a57292cce92c04073f1b2acec9b13a52743555af791b4c3cebe57ed68c400000002903e9b83dd6c0de7a2ba6ae73d517e70c74212628d870d1a871db72f92b36371230309595f6e5e5d88b500a279d3f96991b882adaa1055867eccdc2110821e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000145956d4c6541c40961b909448985f9100000000020000000000106600000001000020000000fa7958d5c1ab1d15dff1f9a7ef6c1d08051933ea367aa46fa2c5f95257254884000000000e8000000002000020000000452335f31c2f476d449358b4bb3a99bc32ce40fc8b80ee6ff3b3c4d7e354cfa0900000005f73d64c3a43cc1458813887031190191aba1bca1c54d0ea60fdbe7febc7d3b48194d09167db9f17265bb57fda3af3bfbe0f428c676fbf756d792d3313e0188aec64451cfa16cd7bd48a4940a9295047b4aa655f841d10fc7d8eda3569e896a65f5000e0f0c8a9a45aeddd4c2e5827de85ccac144255309147193cfe2a88788ee2f90b651f0a203c32e7183a8c39c95c400000004b54b053e59d53fdcc195aa77dc6c7afa72b05a995b75f0f13cc7770fcf9d1a87f1d9b1c6b041ee161e2c4e6f057c158bc0ddc85ca11ea19a06ec18ef6a38286	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422728308"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ab4799f3adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2756	iexplore.exe
2756	iexplore.exe
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1816	2756	iexplore.exe	28
PID 2756 wrote to memory of 1816	2756	iexplore.exe	28
PID 2756 wrote to memory of 1816	2756	iexplore.exe	28
PID 2756 wrote to memory of 1816	2756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f0fda3e74ae12cf1c2f4b32b5f3cff2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a6df02c4253f80c68b183faedd8f6b0

SHA1
82432505d0ec5976037069ffc2ffcccfa08e207c

SHA256
47144a1b43fed251fd12a7e93124ba0a66ea0305c04b3bc5c6e1be8dadaf5cd2

SHA512
6b447c04402c99fbf0df2cde40a41e59332b591920a426b9d548004a52b6c1201b3d9c4813c26457e8d74bdfdb37f740eaa264043ac69f1f6ecad3548af5ec5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
586638763a050f51e92d1c9b14d29d48

SHA1
e157415b4688d03c7864936fda6317b8a1132227

SHA256
e681115d5b6f5eea37b4f99347bff77e3d734323399c63dee61451e4bdb03159

SHA512
6a75d7cd9fccf3eb443d7a2f33a301dadd2b7cb7d141e439293da04bb82c40627f73b3453625fc259cfb74ec07281ae81afce77ba809c3484133ccd69c3b2c81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
451902f6a469b770eda48ddc8ae428a5

SHA1
e9d7259cabf47d1d62d5ff7428857bcc0fa4450e

SHA256
7e9843c87ad88dd775d6d5a0a48cc5d208a46aed03b08db8da76921ff83ba2a1

SHA512
858eb35ee836acf7b9003a277b1bd6a07f7e86845c1739510701bf379ab4360cb52d592b4933fbdbb14831ee49898cb3adca6d8094bd7d3f3296ff8cbd2f2876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
805cbec68e40095ed0de541eaae84d31

SHA1
406223eab51c1eabddf7773450be7643bb24a82a

SHA256
3f951b99ea9c9aca0fc489400614f771cf44a4c699c23e9d43b46c095a34bf17

SHA512
ff09d71c19d151250afb645cf242ad917d214322d9444b76e480b84ca0c7f560dae720f9f46ba63150eb3eac5c3c00517c8f356225d61d2e509133ec7fed606a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a73ba66a62589b961fb47b1ff253618

SHA1
1a20b9ef16c38f6a9fbf653d75f3861a7a57f27d

SHA256
b249f8f101fb4042e517f373c36263757b23c397c6a1c8112a4ee41a5b1f2e79

SHA512
0dc0da4675025cf609821011ba8c4267a3524bf746c62907c3518894c83cbb5f9cf454a663f79703d6d6fb991c8974362eaf23fab70407981f60472726011d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6c5b236cade1d2b3828b7332d3785fb

SHA1
0c30af4abd5edc3c532f8ec8450c30150d2133b8

SHA256
79cf01cbc2fb8af7858345e6b797e2ba0512548e970ff2f136b29e13e294a36d

SHA512
2210b4e01cd5058048af56cf1740e99cdcd36e3fce4335311ab068a989b2f5dd8c6ebdbe0f15f2327525552fb82b3d4a749b69f5c0ca5b671717ab57f71d3bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
215f891222e97f36648486d3c92c4cc2

SHA1
76949c7e2cf357e44fd8f9d4abb2b22416d01b94

SHA256
73354a3f9666f5e6cbaf00de2492ae3dd32a14a90bc48a74009e6a3b4341863e

SHA512
41932b938ec2d93b05e8d565d2bcc3ea0f4f62c6feb60f1f6cea3fea5b1c717124074d3b86baea7da8b100bf96cf25e86bf790ba0f73dbde0db7c4d828dd7ff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8217c4fc9efd73efae9e42fb6860ff6a

SHA1
d2967cde43ec7655475addaf4dba74eb143de153

SHA256
4a9d8bfcffa82d5b161ca9de2af425259c4a108614f7c6169a86a0798f348b3b

SHA512
d035253aa1127eec33a41ae338f11350040f891beb42dd2f94e9fdb49685b6d18ff3d3683b631b55e22683836a02935e0452a876d0c28cfa43b6d1d89bac46ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f441533ad0039d630aa67ccf5ed5117e

SHA1
087ae9f990fa84d53a36f843cd6e7caca7dad9af

SHA256
d5451cb252f48c43e7e026a95e6044dbcb335269245d3268e1f8068445a0f471

SHA512
4ff47b06a6d5872762cf55f19b51095fbc5124ec0bfb6600f9219a99486f26a7abae70c29499b021d43bb51529f7914f975de6918b46761d4d090bb9529d6db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aedd2d1df5ab81657b9435c046958d6c

SHA1
8d29e9db4ee836012f7cdc76f0972082ca27877b

SHA256
062d4e1ba715f6b9bdd2e1bfbe8f9dc2c999c45a27eba01f1bc33b8626d246c8

SHA512
2772ad947dabb6cb284693899faccf8062827374de454355b619b52083965cdf09bddb7709bd971ca79a1cd10933c1f13172f36101e444f81f42a8c18d5f822b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43c46d2626633af296002973ca55708c

SHA1
56fde9bc550d6767e3e9b543d0f594b86f356412

SHA256
90ae2fa0cf435d55d69d369413936fd2b27e8c4ff9fe427cced001bcbad3b73f

SHA512
b5a6ed286aad743d084651981c131d169a9e6a960c1a534efbea56fcd29d0ff4e071707a9b57e271322ef23c06c6029a22a863302cbce8f883ca84c121874181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf8c29cf68138ce9d407d27b871f1394

SHA1
43f0a70e7a3931db1e0b68a344950ad0ad5c0c31

SHA256
eadd9f9f2cf475af7bf9ed6576efe17ee46652ae5c3a7a5aa5fea653e73da88e

SHA512
48031fcca841b6fc2e9606e9b2ec0f48b8476d3dc2300ebdebc30159645809d507a20ccb658914130c8c099f369f891c4a94c5d56344176599ae7d06d9a1b51c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26b067463ae3bf5065fe9ae4cdeb0f8b

SHA1
d755d6245fb02ae33fc1482f6b6491d6398355f4

SHA256
a21d84437c786f107432eb3bc0848ffb557fd3673c0a94dae690c1e1d7e4ee96

SHA512
487a2345601722c6ed2d62ca62a68b79d709a3358511892f51ab864a922061cec1d708fd179aa36a78dee1e646dfd0c1708fef6fffc054d9a2c4c52263b6f1ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81ed3bd6b48d1512ed92c1e11ba40f6c

SHA1
6e840ba617148d208bef5e3551e0512f8a813498

SHA256
86e2eefd9d9d611b032562af3a24ada80f2dfcd8137175dbc522946ef714c774

SHA512
51ffd84c2d977ac5ee1a4fc787de04fd8e7601bd2591469896dac85fda8b5d1825b33f257180954607f59d845272ff4a27d850e6b29edccf76b24ec4db940a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f570c987bb34a503ccd787aac36b0783

SHA1
61f4c4336b9a6f66f735bffd445f1ac29e51f04d

SHA256
58cfd4bbf9b0a209eb51c73d9691f449fc4c39da4b5162e35ca81feb61f7d838

SHA512
43006fce752b624f2c52c725cdbfd9987797286c45753281151a406e2351075e07513f2f7418cfbb89dfc48078b79102aba56e104b27c739afe6c49dcd62ff79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AB3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CEB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit