d5c8831467b848ce10dca4e7dc578f101e95072638fff37365b9bef9d6eff378

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75f2e6faef5f96d4e9ef991fb9cd6560_JaffaCakes118.html
Size

3KB
MD5

75f2e6faef5f96d4e9ef991fb9cd6560
SHA1

c051dbf343a4e0601e7e0a4fd70d15c4c58ce6d8
SHA256

d5c8831467b848ce10dca4e7dc578f101e95072638fff37365b9bef9d6eff378
SHA512

f9467aaecc3abe303fb950eaa0592e5d96418f0ba212acde0fe338633be9f1e522460d9fe48668f9aef3905ebff04f853a1e33b90ad2a547d788a47598094f8a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422899633"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ba18c3ab816b045a09252b7ac7d9dc800000000020000000000106600000001000020000000e774511e3596eab1bf041352e417f7be6b311f67cc1d5e5a9d11fbbc3972a77c000000000e800000000200002000000052f03bb654b2eedd494fd7d82947f0772e22f7cde66470e12f32ab7819143df690000000aa54bf226574ce02c71f52e9058f2331f667184e0cb9fc18ce38ccfd93f4786195ad265724edaa253b84c457f4de2228d366623c36087abd231221c6db57d28c2f8ddb434fc7a918f2103f0e50cd9a7021acf059c7dbb32165d3303a384cbef5ccc3a93bb520a641ed9839d29fc7d6baf6cc08fda06be0c5ee80556e0af8d301018536489f920589fb6d3768070c39fb40000000c891dea6d74de0b45b3c9d1a96ae9fee907c2f17dadf9aca26a640426d537dd64d530d15e2d35b1ddc8815bf731c4addf3ca9b9cb96efc44b8f0fe6a338164f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ba18c3ab816b045a09252b7ac7d9dc8000000000200000000001066000000010000200000004a08d295031111e809faacc6f2c7f25d05c855b58f287e52410eacb35892a228000000000e80000000020000200000003cee03d4cc386f6bc45a0c3903df6f02e313d01055d1a7771cc6ba852e9e4ccf20000000094736d7e3be816a7f67cc3087b4e0c591859132d65f5fbf2397334cb25e6f024000000018e513d069827ed4fce73689d6b581cb981eb1154ba3b98c38ab27fa2ce6ece4f56f9cef6c64a41a2dcacc222492b22dc83c3a9a0e1a15e89a72f9fc1fce7d1d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA3E54F1-1B75-11EF-8456-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a0c48082afda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2808	1712	iexplore.exe	28
PID 1712 wrote to memory of 2808	1712	iexplore.exe	28
PID 1712 wrote to memory of 2808	1712	iexplore.exe	28
PID 1712 wrote to memory of 2808	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75f2e6faef5f96d4e9ef991fb9cd6560_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6086cda398abdec26b44ef74f427df06

SHA1
f0cbd35ab67dbb13dbb64eff021aee6bbf781bf8

SHA256
6946d32f513736912fb15368601fd65efbb4879e4275e99c7f9840890f834c12

SHA512
d5f678e857be27399537162139416ec26fe93b3cf6f8959dc0a54657c8befe47db4fe47d1973ce446fee6adaff3a53d52f46093d16dcf6a8522c8149f606bb0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
986a82fc1202130f8cb47c09a1a6574b

SHA1
9a11c4fe97427bfaba6efe7e5c44859ae21976bb

SHA256
cbcf7dbda84bbcbf9ca58d4f3718ab49faf4acceec01bfb4da3a7547c58361a4

SHA512
4a96fdcf6a16ecabf55a5a2c510705e743de65a9408c0246513419fd3481f647f3416c166ffd846eabc6f4626bb80e019596fabb335655c40afd6a6ae362e0b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a121eaed417bc3fe07025514f7df5ee3

SHA1
190f94be21186b8defe06f0ad7389234e0ff73ae

SHA256
3d4a54d7360af9d8e309b75d8f28b4d614ad918631f1fa065513884af2fbe3de

SHA512
19a64b9a110bcb75a8f377c2719693663c0ae5dd8847060e9a200ba3a5188e5f10bf9c80eca7b4b441b0a699f4504cba4c7748e9f7bbd2ef0df11b03dd326210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0a12e23685fbb27d04f080ba349ebbe

SHA1
451e5a90ef934c427f4c3050c6d70f33efc33721

SHA256
f89a2f2e7a124e32c0bf4bf0875868ca6968d10647513527f52577cfc7a4a05e

SHA512
9f182594f49521e8232cbfd1a48c58587eee5ca3defb24ffedc25958a656866e09c7e03da81a4826da57b2a3fd9f9333b285467f371f2ed1b78c16fdf0e0cd69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
368757e0af25ff51d2736caa556398de

SHA1
72ed9e46d0964c61fc26f2b180ba5a9430dc015e

SHA256
9102cd21187a9d72c8cfe8f0506e4926b3a4f682c98e7b09f20bec19e930c3a1

SHA512
f964c2ca28b2b53f76614e8fe70f44d2437baa0270cadb27aaf9167b839666edd28a82a4c5bdf3e7c708ba5c38938543f35ae470c988de368e0469d8cdf54f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b483c329e3baf426f0bdb9aa1eb61d20

SHA1
8f26d0e08a64c44ee14c01b4ca7ffccfee617e66

SHA256
6fd067f90a11ef3f9f074c6a302a293fdbe9263c8cfb0a276d53a80070f28704

SHA512
860bb3157ac32315857971f0ee8344271dc0cf371a342f5559fd84935e092c3bfbb1898bd194f6aed98cd700bb2dc6253055b59525ef5c082f7b99bfaf4510e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
626c80a419b4cd9248afa6759741f3f0

SHA1
cfd8c6aa21bdbe455ca0615d2cb40277be6187a8

SHA256
caa34b687fdb789cfeee48fec4f4e16d6ee03f49b6a101dedcb4497cda4c95be

SHA512
cde8e5682869fbd13125d75dd789a3d2e98c9ff2e4523edb2766edfb0405bbe4f663c54642431b2e8557096e38e642df03b13931cb698f0a6f2c5f0a975ecf37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fe213e3635d00b31cb91bd8ea49c5be

SHA1
f7e48fe7c0e4674f869b31e7e44a216505ce86b7

SHA256
5ebf09a47e2f77b9ec90c2d8941127b5f656a95cf10cdb667722642e5088a535

SHA512
abde0af2df32cfcbd501609d137a87b3d5bf80f9f6684f41b6f7cc0a0024b9228a3f31829675ba597f26929313a9fd2a6d02ed18e83241d00d2305cea873b641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99e0cc010369509b238932468d3b068e

SHA1
f457525aad56bf6ed410a287beacf76e8479d626

SHA256
29171299f8114a065896518d4c62862d595d4138b5669042d3e88d8354e6fec0

SHA512
b92dfc55babb0e21c1170967965a94df4ba69251ea7b68922fb6cd1f68c842378b18cc6992b15ea9564be0b9cff4549dc50b5c2a9be5f35ba8eaeb867a30e878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0405042123ac484516729618a6fb566

SHA1
f26abb9d01aedd8f21b560612d54cbffc93e04b8

SHA256
5f993f45e27ad8a7c235caec72ccc4b0fc489bb5f239b90f681b7220594853f5

SHA512
3f5a4b43bd628835cf084fefb439406c206c4287832b272cdbce7d6fcee0c50f2eb83934407e418f13fcfeaffa65446d3fac9f0c404793b54bf98e6c04f41ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1773ab158bcd932fc56eeb5157f22449

SHA1
a942da4a824c60b4c4ee3279fa8d5183d9db019d

SHA256
5ab62f727b0d5de4b53a4a5d15bfbbd478ccc41555f2aaab3b83c5220f7302e3

SHA512
99f799793eef0bf4276b247a1df2276f04cad75e93483d9737839701360b6d9377d0762131629ea11a19780693a88b2b33deb6860db18d19c2eadc6e348d5cc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F28.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit