ad3d3e91c9ba2b135a1709c11c573da428680d498850731dd95f827e747549b1

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

77c4fd5b0207e7f2fe92d2fb94e144f7_JaffaCakes118.html
Size

1KB
MD5

77c4fd5b0207e7f2fe92d2fb94e144f7
SHA1

c71226665daaac003d4449821631348e270ecdb5
SHA256

ad3d3e91c9ba2b135a1709c11c573da428680d498850731dd95f827e747549b1
SHA512

f967b467e84059f194fc7577b6ea318423df13f1264a5a06b27d56b2f25a6302410a0618c1a2902b77f3ae8565f23ec1389a23bdcb56945af50887e5b4a6ddef

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000014e345f21a1b2bd1edcfc86adcd71fa4f979da18dc360f6844e97539972aaed000000000e80000000020000200000004f26a275015e8ba01be11568f4659a332e51e8faea1519977938ca5fb40561f52000000013ae169ad68503fbad2fead87193241ecae52c471ab31f7ff813ac2d4fa1544140000000f9b9e71764b9a969bf19d1cae29ccac0834468ee0d18d7e70f20381e64e689082c7b598eb3fe664f519cdeb698e7f784f76c3f751a9e70f14d72009d524af652	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5066885de6afda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{890E4651-1BD9-11EF-AD44-52AF0AAB4D51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422942526"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e4708940208cf615b4321d46f8b10f9fe3cb4c1bc7a8bb17c80be35689de5caa000000000e800000000200002000000074fd27630e42626c053fceba2819be1aaff19e27e1815837a42c257519c2fb5090000000edf879881a25094936cd0da8a160a09e7093a2337bcfcd1d1a3c54b742bfd7eb5ec0bf4deec4c654756b462dac970cf7db522c9d0798c42a7f305b4e78f75a590c8bb6a18e3fd064c950ad84b301e1a2c1a0ff43d2f51b1f954fdae9c160e40ba5858db1499c88f2e0078e5dbe25fd041976db168c9dd0d4b9fe94f9a79cc404f71eb27208aae885034efff8a8073c34400000000b0b3f496488de22dc630737ef0fcef2e97cfc136d46656846cde61993dd3ae9af07dcd71ada8796ab025b5c6a2784dce823283947ea6ce1db544bb57926fb2a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2740	2400	iexplore.exe	28
PID 2400 wrote to memory of 2740	2400	iexplore.exe	28
PID 2400 wrote to memory of 2740	2400	iexplore.exe	28
PID 2400 wrote to memory of 2740	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77c4fd5b0207e7f2fe92d2fb94e144f7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c76712c81849dc1a4b89776d146b5ef

SHA1
07779183372067c60a3cd402826b332db197371d

SHA256
69dd442acdde7dc59f1273845210aabf1ee8aaed733a34ffcdd9a2edae74847a

SHA512
29a59da0a9b8ad67bca81ffa110d9a67a441cb2e9321754da558e8af5f4eaedc9f73177eb3a2fd14ba006333d2d9416fe76eda2fa5d6ceb6f8e9861123605a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45a8ae914bb8a27bddcb49c67059454d

SHA1
2fe1812c6257490d6a5fb53b9dd485b4175b4066

SHA256
caee28f4e116ebf9e3f29c684d1cbf12d0d7dd77b49601216db03fb75c34098b

SHA512
8f12eaa49e181eb49300329257fb00417b0418964a8c7c15c588c2de1e114b9f45c462313c0907bbbc00850be24b2a960c4aefafd9861061fb3525afeb8e4e82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffb386b96ff1b6cf41dccc5491140a59

SHA1
168a233ce4bce9a820fb44bf5127ffcd8df87271

SHA256
7fd01838d29c318a080f9887eceb3fb55e543ba0c9b33996a05dc32add85eaab

SHA512
7e6eeba77106f2a0a1cf779c496f725288a5c15c7f4b75c6e19acb7d1fd2c239439e53cc021a123a0f816832c2278e5a331f018bea60f8c9cd54b84047f003f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f8081819e46e50c65730573a02fabab

SHA1
36597c3dc91759d770c47900b38bcce5da07d160

SHA256
8959478d5c58546637bd715f79c030253e49a2e573eb01b01513e45737e1445e

SHA512
0b12947fe9b949443909d05458afe01ad51efb0f78a7e796b19598691d0e456291daefb090900f320afb00750448a1c926e56ef33ae918997970a8ea936a5a47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
700897a8fc1d7de07d6cabf96ed352b9

SHA1
e123264c4b2f9d44585a72c58897ff98d1fab63b

SHA256
537fa475c71378b31f894005d51604e25d577a329b7db54e144ee721d9ffd22d

SHA512
52908f1669ecf3d928c18a290b69f4aabb7a9e43f037447c43e0779a51bd935fd96374dbedc4257e0a549b3608854fabcae00821240f3ce01cb5cde0846faeb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2da94b9e2f81dbbec6b654d28c1c827

SHA1
04bb95ba56e3b41e593135974257972954e27412

SHA256
24be1f80910875a47c1e0ecaa2e1f8b7096921998a8654f075ebdc54df3e3c8a

SHA512
43e227b4f8dacc1678c9ec3d9b64863a629cd7bdc17d88566bd94281f8fe0532ecbd367a7bb63ba52692a160246875d8f5a87f4873241a7ef7f323310e7ab02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2936bae4e807ddaa88722b42cfff163

SHA1
64cc31f04145cc88b68dbe0deb41837d22aca2bd

SHA256
187a1c41c3c9aa3f95c7614e662476fcb073681458c4d6ab1bd0756e9ca6873e

SHA512
704789fd31564259dc91391a8bada7605e2ce5c9971bd4d537f39d8ff40c7d0f1d8b502ca7d585299e10e6b1f46d51e3d7577ac4d6b0625682b04fe791f655b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f963a586e8392cccc349ba00358e5765

SHA1
14219165f4f0d0a9a782f958f1acf4bca570f640

SHA256
258baf4694894e948ab3d85564fad6a845e31d8dc4d033e6e9c50f525fbbf3a7

SHA512
155a718331269a7f1e27d29f6d1431b44263393a116362241b1f1c97aef6a51cec041def08f91b3940f8994fa0d010ec84f214bd0c07f719adf44e5733aa5681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f85ec3a58dde59a01655bb50c874fec

SHA1
6717b8a3fc892d938b902a5112746bff73e93496

SHA256
9ea1918141b1d6b810a9ae74b372b220f9e2e7bc78e46a9ea4b31a84caa62919

SHA512
b2df725729a5d6dcd81f1c5bfa1dc3e7bb5df98ba265f0bc786a32d8cde5405b1c30ff90faa46d04f760ce8d915fbf10bf684964f629385a7f683555bb3504c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dfceceb761faba0fdacef2b926148dc

SHA1
b527d5b4a8d0670e956adda29a872f54353cb069

SHA256
554c7f727600e2db14171ff4351577ad650e8e6e5b4b5d2275e4a2a685be912f

SHA512
9511fde7a945e3d7f7957d09c365c111a0e51cf708995124926a689bf44be7d9063d7e728f6dd612b56ff9aaec25e14f3bf720617681024641603b9ba4908d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1f9ff3b383b5c325dbf299fbf4fc818

SHA1
45a047676d243aad16e256a403d39a33619e5f50

SHA256
a744c3ffb0732682d5cdd2bf18ea7df2b66ebbd2eaa91fa8f3069119167ea900

SHA512
d1191d9f765dec3d6376abde1a2802e9969143152f83616dbe6fc514f9541c0554622025ba0ce8c9db49ed4634532cd1996c3892af60ecd9a6a3a8784476582d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f631a91f56bfc8ea3914b2a6920885f

SHA1
ae2bb1443f840ba8989678df43686a17ac7d3038

SHA256
fc6180edec18c07ef164ad444efc7bc0c88ac14caae1d086a7d4564b8c21d491

SHA512
3a4d9dcedd580380723821ec00485973ba3e87125decac742230b0b62c81c3ffa8fe34203d4d0e65716b450e217fffcc2be1f6e904d4f535495698f22ed92c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5421f47bc642e6e0f3f9e9db41e28e83

SHA1
4661f65b8aeb1dfeb036fd9aa8204be3297a5244

SHA256
8741c766118c3836940e482678e3a32898fc018b04d7eee0f4ad135538fa3452

SHA512
16c752d957c71f0776519da70ac25babff112a89795fe90cbe33c09c4056776fe54e8d3b0c95aee8ca450faa6424a31003be2edef792d6d70082ef1fe6aa1245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d7e26008eb1094a0beb22567defa7c6

SHA1
3665041817645bbc109080c2dbe42173b66d75d7

SHA256
84a653f012dd32431f54d845d18c7f0300c8884ab66c84bd595ba240ca435e8a

SHA512
9f4db6911d4ae5bf423c58fc56cd3f7f50d952080ad4e60af6a83dac53375571f03823a948a8ffed77c779e0b877f45d487e669531d27a445b48828214930717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c43d1080dd8c0704f773b41fcee85f5f

SHA1
2044639ad169482754fa15573b20ec862c384f26

SHA256
2a5e5fa1b41120dfa29a9f933f68ba25e156e215482da870f9d00e9bd1f582eb

SHA512
a44f05f48f6612fa3aaa91a8443691337006d8968e402732c1643432f4fa1f1dcf40d4f3e9dd8642ad6e29144cabfb8aa74b8835e4489f24fd4ebe9a395794f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a985b2f54dae852b1ed089c558b4974a

SHA1
acfdce0f90ffab5c472954d3a006db1c43259b42

SHA256
474f98535dfb5b2a5ed91548fb5fb6eb8abb333b97fcbfe7608c71e4ddd5ee34

SHA512
6d1eeb0bf34ec6762a3a2a1dfdde998f4d1ce55bebe4163128d6bed1502958e4f43ec2546ef2ea77a2938efe1af7203fa1bd472b18454a83ab01e0c1c064955a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
944894d4cd56189b6404ef7ea2f290a4

SHA1
2bbeb7435547f68119598429bb44b9dbbedd9381

SHA256
ac66f0edadcd686ca885ff2d7becc2d04dc99481f471e31b3b4084b99c047eca

SHA512
2dc4c2c0e03f63dd750011fd09ddbf46492662d3415723b485c335a4e710ff1ccb61a0e14e9095e2cd89db96f78087e8242bb46f39f13501d1a2ccab17e6baeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D42.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3DA2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit