6235362d24623c6b0a5dfe1fa8b1e4b8fb11748167d2e3d726e0ec0aa9a5f472

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7143e6292982b7b9429bb30698b50309_JaffaCakes118.html
Size

3KB
MD5

7143e6292982b7b9429bb30698b50309
SHA1

57f4b5d581e934b625d4c721be0962c3d68eec50
SHA256

6235362d24623c6b0a5dfe1fa8b1e4b8fb11748167d2e3d726e0ec0aa9a5f472
SHA512

fd93b787db5a2c87464e84b9b00265139a15b06a9f552f93ffcc8f25da5f79b5c671a7bf0f2c29068df3cc73822109ef2797f150075afc45bbacf1f46faf971b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e60dc575aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F056BD01-1A68-11EF-9F07-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000063f303a9affcd34c9dadd14fdded939500000000020000000000106600000001000020000000e67b4264df0d319b85583f74ddf12bd310955dafdcc2bb67223b170087e5bcb2000000000e800000000200002000000062eb859e237fff225d850518a54237da3156dd63c14429f01201286b05b76329900000001bf0c8ee96e984ea11c4f91efc1a5f0a4a3cf497c4aa4474d24a0b7ab27112e357aa9f1193d3b31ea08197e0829421c1dece037cc247a0eb39c15a40cb5b5fe9bb88e851a997b7300f003a8b85014a045188395af515b6ab36a7dd580fa3ef5c37064de0f9d3db45ddfbc8f397d15e9a8ad7fede4e2a574d3472f0b788371d1e17477f900af7df3fe4e8807557c6dba540000000c3babbc61c7db3cd038d29169b83cf1ce688e95104d69db89e816bb2c27a2e17ccebf4149675f1b0ed46e9d8b89ce745381c66b8125b959f4029abf89dee1936	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422784216"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000063f303a9affcd34c9dadd14fdded93950000000002000000000010660000000100002000000055620657b9d2bfcc6fd839329aa4a8e5576a288ea8405bac18596e7a1a1c8915000000000e8000000002000020000000696c77523d13d4b02c127ce88ed964bbf6004f180164b6064b26ef099dc0b14720000000cdaa1392b407195a0a6a782c95667a1f63ad57afe575a6ccbbd26220c4024527400000000530a71e57adeadc5b72ef941ec28a4dca7cae4c79e7f75f1bd871eb0baff18ce7e976fd781abd7d5b5911146cba0c7ee67fb9926a7b4897cfc9c470a3bbdd35	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28
PID 2012 wrote to memory of 3032	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7143e6292982b7b9429bb30698b50309_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
05b46021dd6c5970fb83d15bcf086c10

SHA1
48db6faed78677ef434c9c1934fb7dd420ec453f

SHA256
e1a743289d82018bbc234fe11132b083584f6fbb2b76b7fc8add1257d28f1c20

SHA512
3ef6afc3e665415810781997299c11d67a3d53f96d2bded656eece22ebb7c8ecbb942243b3602fe8a5f9ad99903b45feb6cc402e42f2df5c4ae8a5f3075300b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
687ad7beffe2fed43bced71c4835ae58

SHA1
cebaf90063dc895ac1e88b8de3b82bd9ac547cfc

SHA256
d59c18f1ca0bd2d00af1cffc85b9e2375452264fb5514905c7bba73ffe86d18d

SHA512
e9f8f584c46b1f25cc24290e0ab2a1a6755a9ca03213ecf787d7069573d170c678923e8473fee4d7ddc2a6a02c741a452b5cd5514bf06487d60c1372e91f515d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6034c234bb9b80831373872deb229af4

SHA1
6cfc60ef626ef7652075264a2310501f434310d4

SHA256
9962ec5c78d70902ba01702b73f507b8ca80320a36019b4cd5f87e811aa13439

SHA512
729f746733c4a2e0f10ff2551ee484641faf581bc82dfa62b5b4ccda33ecec257baaa253cdc1d672cfe0b9312c3a15e93b6e9502684838ac2770fbc01dbd65db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e70c83c1746272210b791b79d1f2cea0

SHA1
3584717d3e4e08b49623efedcecffb65f174752e

SHA256
cdc994c5c0711a90661618f7aedc3ea500cf2aedba516032a86116d104422e27

SHA512
3e6f8564b4a0b9fab8e642c8b68da09ad7cb64698c228e21036d2e7de75c3ab7f2f06948603b5a014f16eb04e83eb8f9a1b3de8ae26339ae0fe7d2ab70e2d0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7494db51157cbed7790f4b24d44954bc

SHA1
4b20453dc9e028965121e140ad1ba5602bbff3c5

SHA256
33a3dfd1f71cad27790384cc156bfb06f40ff5c5268bee88574a9d89ea6e2e37

SHA512
1a6f4f59ee288b05a517fa873952cf1fea135645252c47a7f3b7144835c13236075720d194d7e753567fdc45e6003404a6279f03ccf2ae1f3e6f144df03d656f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d683af2776c2ab1185eb753d2f7f8f5d

SHA1
45ee61bf233f2dad8b7107cfb1d054ad9f3e105a

SHA256
d383e1e393fcc62a8306a6e1ac9511947c34c0539bc7d2cd22e11e38eabf6b07

SHA512
f7a42a221dd8b5fce05a59399042ce9e913014ac4ada389587f04299130e4f13fae2739b8fb9ad59823c359f590bcfbe76e81e733a5fb27be882c7090f299ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1e2d540f9571a08e8678e0bdf08562de

SHA1
e27840fe43d83023cfefcf39066400ad10fd4896

SHA256
df78046b34d84144d5c51831dbd9bf09736fe8106812f30bd719d41a14298d29

SHA512
f0ab4f361fbed2fa1c059e0b2ead84acb489e750ea453c8af46abab87e73f7a7da8e42bce5e0f3e161f9cacbeaff55579e8c3ea9415b7484fa139422cfa675dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c4fdffdb60f275bae682383e88934c37

SHA1
7b27fd31bc9757da237a54e48c98ff1029d68c7d

SHA256
e116640f24d66d43a7d5ca83db52d5a8203cf799f23a32886ce534eac71a1471

SHA512
b234e3418a1b803137dc1e5159a08e1881c91ad52aed6bb0f50a98c6595fc40685d1c1b042e81fe7b0839c8789cbb19702aae2b4e104a6f3ca00750b348acede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4a08a4ac2cc1df1245bb95b44099414f

SHA1
e7ebcfe83b266d90290f32d0fe4c9ae52d3fffd3

SHA256
bced03c7ff46b941366ed8215207e2fec9c3d920d7b3c8f4edc6d5c81d041c3d

SHA512
2a6042adc204d2a326c93482dcd09f6ea81594f481597d5feae1a09c1a17935052acca522042cf8bce0387b22d333364b68c94529dbefe12362670044528d3af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5748906b452262447eabd357ac0ec8dc

SHA1
bbcd90c1050ff803b36792b97dc291a13cec3a4c

SHA256
bb100173863f0b4f3b26cf87ca299d272a76d9ace7f0c5e0848880393b83a58a

SHA512
72b9b696a0f3bb8d2e6a9b960c2f71c8d620145be94d7a3a4be0451fde0edfbb9e20aaa7d61a73d18b577c299ee4d84198e775e1d5f22ea36e4fb0cc4e8a41fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab253E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar266F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit