5790256dd6e1359a47422662e35367ab2e2c3856f7cd4c4362747ce71fc55d50

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72abc05ac70afda1ccbab7823b962820_JaffaCakes118.html
Size

1KB
MD5

72abc05ac70afda1ccbab7823b962820
SHA1

73f18888f916dcb50a402979ccb822821ccd68f0
SHA256

5790256dd6e1359a47422662e35367ab2e2c3856f7cd4c4362747ce71fc55d50
SHA512

6d83b39c767c68760f8bf5a9595c06765665450a180976409c3146e3aaed53bcfde3cae8acbf9bb63c0b26ae56af47a7ea7aabe7b04aa574a27af19b59e710c0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E87FF2D1-1AB9-11EF-8E7B-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d24bb604e8e4d34ca7e270b3e910209b00000000020000000000106600000001000020000000720e842e00c3c6f7992493c54fdd87b8beb388bdb8799365f96680a3d585be6f000000000e800000000200002000000024d38a0776665ef799c6593392b52e13385b9a5229a226c3fd4eea4a5439172e20000000ae13dd45996e5d936196aa861921a71522226906ee0dd477085c20c6affa3cab40000000db2330b5612ae804fcab57cf0b4b31f952b414ef50e6c1380ce66bb32b581476161ede46a8034ddff9bff2bd1ec32a4ca9670ebc70cfc5d18820de30556f82c0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0fd5abfc6aeda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d24bb604e8e4d34ca7e270b3e910209b0000000002000000000010660000000100002000000096370b4497d163551c8149a3f69d3979578923eb77d793ac5d10c01d2a33d361000000000e8000000002000020000000d476830f04769f5453d4656296fd2b311aa7fdc4d361ec7f736c0d5f091f4cce900000003a464d0ff20d3f09a27fe919daf83f46f611dd8412de3704653ba33882c4317ca5d0a9504056ae1b7973ce799f9ce9741f3d87f084f10e4a986456a3610e6580927b045ac993246e78a580bc7070c58e73578a874d10914136599520b242997c97d0afd37f587996aeaceadb94b59011b3886f746efa1be0d5242ccbc1a79f6e7259a60b2c5ef5b90b5be55e2eef79b940000000e327aa68c628bde02843440bd732cb77de7069eb6d158df97b522ad7378703d43d6add357a54b6afd5b004425f512f49ff167889abe612a23b11235f9ae2c2bd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422818992"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2112	2240	iexplore.exe	28
PID 2240 wrote to memory of 2112	2240	iexplore.exe	28
PID 2240 wrote to memory of 2112	2240	iexplore.exe	28
PID 2240 wrote to memory of 2112	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72abc05ac70afda1ccbab7823b962820_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a05038fc389b49697a3117dd820c42a

SHA1
c1c144f59de43eeb08340e5bef782e987be16eb5

SHA256
5ecbab06994f1278c362971fc5ecd2e257e1a74a756e941ab40d4b3c435eb3c8

SHA512
e18d3d9f0d42a772ed8b96dc6ee4e1aa6420a442fa68e2d0a475f35a2ab8bf6b3946553c4598ec57b6687c131c1217b8b0ec259a9306da4916447cd88ffea072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef56d09a8a68a948e25c3250decc6c76

SHA1
4e0b5886618f6f5ecb45b230486557a0dfb70299

SHA256
96960e530058eec96938e757ec26b8049eb5ecbe92568107711a392652f9844d

SHA512
d2e86a42fc3368cd5b0b22065fe5d1a9de6b86cfdb37c3a81e06e627a931ec653986d38392ca860d82da842b0f3e7b5e30ce741463e4726da51c65a11e9d56f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f749d9237c97a69bbc7e6dbc83d26cbc

SHA1
d9c01f47d625f40a8c1a62592cfad2617b26574a

SHA256
53bcfdfd64ad6b889bd3e48adadf4aa0f1cccc39b844292d686e0305e998c5fc

SHA512
d8c5fc2008e6e548c4f38a86b9b9acaf722cde8dba2585a6a37cd4c3409503256972b351483f980a1b9f2a6876238bd3262c569c840e2fcec559beff520f0531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11cc9d160817239c8d67076907a60594

SHA1
05dd67e0a56e367f73d5a14b600927459cc8d299

SHA256
7085ee31c564219779c48b6ad138be3c384f77f9ae261fbac7c0316eef642631

SHA512
0da72d3cc5d42e21c4d995d3722755da5b60f0afddeb3aadf27a07698c20e79d2912d0c1b44d63a35b00b6dcacb29927e92ae98f409986e067403b03c5834a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ff4ea6557aedb0deada725e3c7196e9

SHA1
0648872618e4818eb3c4dc708b3735845e65d328

SHA256
806f4566c5623a276bd522b63239e11e7f1ea9484d2062856bcaafa1903d7e09

SHA512
826a824fdaee1fa057d57e21cae60981a5826cce02154fc960a134ee540bd18154eea4c544e47ff52bf7ecd6571c6101c0d9308e1fe4517c7d224dcb71d7f1ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cc58bbf7cde4dbef0f149194ca71c4e

SHA1
3bbbff748a0a62caae87063bd9ec21ceef2e6f2f

SHA256
3ef1f3c3836d9c63fef72e3843aab29b5f60be8d0842dc9f3c1edd506607e751

SHA512
2ad3463a4812afaf63afe5b471cdcbf2a76ea016841f4e21c15ca309e8ac7956a10b06dc14f3c6382b65467be67d11778fa59159559187443a23cdb0cb01c5cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a60a53f0c164b6e43956326ab2510c30

SHA1
734d27bc4e2b52179f93e9621dac18403e46c55c

SHA256
384e00fd1badfc2ff27ac6b6020fcb7c4388599c3d7e548fbc1f8f18f39f1edb

SHA512
e1e7aeb5373731693e8a14de06a5895675c0d81149d1204293f46ddfdf484b994687d9f77835e5c841f8c57db57f9fbdfc7e405985a22d6e5f23ade11bebe0ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1fb59cf51c7c297b7167621738d73af

SHA1
1709413ed519bcac71352f36c10e5d8bbb917590

SHA256
20e8cca8b9215ecd90dc342b837696c45bb980dc703347d3006884458e8aba4c

SHA512
7c73a9fdcd6d85a7b5950601968a636e6ba57ff782220cce093d32dd547b419ca25b330c5663331dd03f19190121c918a7d0138accf6e2daf2ba5567c08d0ddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00e8ce57897a18fc5ad896f7c81c355d

SHA1
0b5bea110e2a55110bfd2a7f01962f63438a8ad1

SHA256
e37cf3c1212dd646b32b06e36bb17e91a56795918570ab42a8790c1e915cf9ee

SHA512
5f85bc5c24a629fe312f5e261566d9379e8bd978cd7a1ed1f3d38dbdf66a713abf5499c02d6f5234cb8b65ab4f8a4376e8d4a9a18ef8fb29bc2870e5b9524c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5021be64d56f504fa115f735f747e921

SHA1
f0a4c25d92a7f698a109b08a14248524bafa9c08

SHA256
4075937992556ce81b09e62407a2c3e7dfcc977c893a54dfb6fb60491a07b7a1

SHA512
f2d6675384497f5351517e5708ddbf1300e1f13e411ee6e03fdfd4799b64ff6831ab00e43497a8c2f56ffa519994dc022df84a6031008d263e3ecf84d2d27ce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fc8b41d8ac3544d56e735f6505aff4d

SHA1
f8877e8bd915f8db305a199d44c31bb1102be4bf

SHA256
50edb3aeac4b6abb015a7c2c78f2b335a56088141d175dd0961041b027491eaf

SHA512
06e55fa1d5f5e77561640316213c5c043051d48bf5598e68721bec0b22d822c9e60dbb4cef9c27a977bc4f8f6a0d90913e1f402328f461f5193a276582e70966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8da0f8e602b864507d1eda0d54546e7

SHA1
ba73ebb3885766420a1c9fc8009da850fc96c4b9

SHA256
56752470e273246e804f40e411f9e02ef20168934241623386c092fb00e561c0

SHA512
3986626bcce5c9d1e73fc2d9f2afcd5be175b6211146a78056fe9e763d2844aee9013f269a131c1cdbad1c1ba687f100597b6f2c6f51429315d909b929fe38e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0588473f725cb27250fa545b016e16a5

SHA1
42302d6eb2ee9b6809b0a58523b9eb3a42b07fa9

SHA256
fbbcc33dad5a57abedd346ca438f9b7ce35f404127b66e5af075a589f914db27

SHA512
195c4bdf9309e14047843a3a27d8c2986cf8e1bf0fb0de2e8be1a668d6d440add5337935f04f587b2a020050680d09022afe62474a0430534aaf01ca12a04833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaa94b92de88cbe675ee56c0c61e0116

SHA1
6fcab104c16b6589b19328b965df07cbe00c4ad1

SHA256
00f791e3585d5f6ad625076bbdbd4ec13165d2856361e05f06997528de73b239

SHA512
a3fc0dadb741f45905ce200224e7eb819f781649978734a1fb9646581e0f239647a7f6b048cd473ed7524c20d6365128e852c57538af17b98a7379ec69128274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1891cbf9f445d9df1fcfe344cb66792c

SHA1
a59495329af8004d90e653cf7eab3d7fb50d6ee5

SHA256
0ebd730126d4c01e9135a6996fbddcb7f42770aaea1c9129794940e3c32511cc

SHA512
c448d990f1bcc8f6cf1b809949d9376a6f5e8b00137b7d1f8a7b4809a47cb912a7c7754bc05b0ed15e1c5d28ad21da3b07b9c68374f5b39989edad8b94ac090d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1adf9cc5807605668f69160b82c1ae0d

SHA1
4ded2205f80e1546af58e9d925a4f348a16c072e

SHA256
e83faa26e393e79881c6a3f0fb4ee443c78c0c05bd03004e69947a7d2cfe1912

SHA512
3abe011d279cff9924a1e06e099c394a5f4a53e22774c8357b75e17fb9c01f81ff928dfa3df8dbd3dcdd20dabc6699b53354b0d2f55300c35a581970333ced63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BAB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CCC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit