2f97e794784fcb5d6c0ae72cbb914645202b8cdf6a14935428fadbd1e372ab55

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

795da250a6aa6133e3770e886e66ffda_JaffaCakes118.html
Size

3KB
MD5

795da250a6aa6133e3770e886e66ffda
SHA1

c1544036900160ee2885552bc91dd159d602d513
SHA256

2f97e794784fcb5d6c0ae72cbb914645202b8cdf6a14935428fadbd1e372ab55
SHA512

52dac9fd09523665fe4887aa0332b89e8049475d6a03b2843490ef0ca75c4393fdb057fbd8974b98d7f8b4a1026afbb822fbfb40e4ac567b5fc3cbcbc5c1c514

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000fbec2197f0f8af7b0ae729d6463d7cb204f02271b092adb556290e5f5775fd91000000000e8000000002000020000000869f37376451513bab030c9208384db527ba97a98506ed2555b17d8a5626e3c020000000ce2ac612d206b3154d6e6d533d722d99ff06eac08dd0bc1b4911a3bdd997c70740000000863ee163c32600620840722044d7cfb1daabc54343ddd359558b0f3ff105e283741ac637659e27fce85c79a2abebe12fb726935bd6a8cdde0c82e710f7bb88d9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422981087"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F9E9F01-1C33-11EF-A7E9-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1073402440b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b785a3671b97fb1f6144bd58d39484b17a8c942cb3fe92aef0411bb570072ade000000000e8000000002000020000000376968fe517325fbe6bdbe02f3d045b0a341cacc4650d5ffe7e086b2e2be871190000000350b98fed1f5e1f2a209b00966649a9476b74fdba7ec64de4d6ec1bd7c10eb8b58be64efd10a56225209cafa6ff5b8e3f811cd7997ae6f008cd3c0e7ce216152276f6ce31c599fbbf187180e9eeb1f7209ff07bb3ff4f059a1557eafba5f34ec56efeb22fdcf7804af720e81dc87e4505f7d968ed6ea47eb34c7dc1bad5079bdb5723a203cacfbf785f2898988b4b76e4000000059ce1fc7f5c19f96ace3aa6f0f3b0342026ac9d02280f01b784246460df0e32b210555272e50a6ff1b14b43f055b3c7cbbb1697f1d1885aa10f8caea7af2d1f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2824	2220	iexplore.exe	28
PID 2220 wrote to memory of 2824	2220	iexplore.exe	28
PID 2220 wrote to memory of 2824	2220	iexplore.exe	28
PID 2220 wrote to memory of 2824	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\795da250a6aa6133e3770e886e66ffda_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3daa0ee7fe4cda0c650f85e9a59d5d2

SHA1
8890cbda61ea5b9a3a2d623887bfe079c521f7e5

SHA256
e4d82bdb8ebc182cc38e7b16ad9f53ced16ae67877ab49984bed8fd95bb1c9b6

SHA512
9dbfddadd174e72ba4fe3e8a8cedb2bd4fa34488e9ca7102aeadfd39edf3ee5c717f0960c5096270429e7c21d63f7042b5af3480611bd97f0d4d23ef4a1db8db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1312bf7412dfafa8e96e33f658d7458

SHA1
5640b86dcc783955e1335302272fd185948a720c

SHA256
7053b533ecb7f40425d2a01318143b77a22a3db11d55542cff1a201e6daa7788

SHA512
0f05c295769394b64839af631bb5fa30afc407233ece8ed2d1efe5f3b979b3e6bd4206e42cdbd1cfdd8fac4117d982382269d9b685cdc7b317b0fefd4163a7ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afdaf69f705d03264df6f2337e5637f9

SHA1
50caf31532af8517f68a0830745bb5c7cdb9fbbb

SHA256
ab92d322eabd2ddcd1380b32028adb9d8238794c56dcc41f942e698b5fad2fa9

SHA512
7b0067e43f440057aef6aea76f8b035c78bf9f8d70d00ca21207d430b316c600e48b2e8b4b551d77561af792ef5bbce20c48077d79a88ac817457d7dd46ea52f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e17b1775d6264f7e9b723a8c748ae0e7

SHA1
160b764fccb060e6fd83d0998501c7229338259d

SHA256
7a3a9960729817c04606a22167fc65f2e4a29bf100b01ac5003b0fc814b2a4f8

SHA512
a204edae2ad492d465a938fea0f9408201650afcd85cf2e0fbb2f47d9f6d63a7a727fb14018d92d73671da6e602038017f1cd53621c8afc8b13977c0098f10f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fb8859fa30d7ac113c31cc0d4f164eb

SHA1
1ed7bda6ce37b9d438cd5b7e2061d53fa02071d2

SHA256
9002bb2e663d3d653e165f2d2c5ef8aa21aa55799d76761981e8b6d0d866e350

SHA512
e85c0988f455dc5742b8b1f3316b1cf5f72062cfc9b6f2892a9e1c41b54e802685627c3854d81deb82b4ed3a9f392af3daef01c5c20bbc4d1ec82d09b7b8efa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf997d970b4faca6a84702e111647388

SHA1
0a2756bb9dcc4f184f21ef8e41d61d5488f1e74c

SHA256
5e6f6b40a06e2a7b5b441a386eb9c31d64bc1729e8750633ff7b8fbfdf5ac8fc

SHA512
580d9ee12924b53e2aa79dbf8570183ee85609097d52c057933405cd167372ab4f218d05d08ee429a33c3f00f79c026fd642a77fbe7f38c226c6a02828d48355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e797e4c5d2836efcf7430a7e9b9ad186

SHA1
2b22ba7f539bd83ecbaae85c9c5c5868e17232e7

SHA256
0b0bce0abb589868e96f8454c6cbf3909b1fa6f1a1538c0a4f33d87c3a702db5

SHA512
5e2c9bf280db2604d94aa42259c6168bc6b3dfcc48f62bfbf2a3276f56dfe8b5bc6abbd13ba1b7a31ba1631228c236e7c5a5927eeca78e6fb76bc8ab4d6ee0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
994429f6af93d495d7f1e520e865aa8b

SHA1
eeac96c12cfd8d3948c7b338690fbea4872cdc4a

SHA256
06b788ed818144423e571243805aafc4d82c2311783edf30efd6abb013749fd3

SHA512
feb86c9b7a23ba1b0f659fb805266a694b295be6eaef45e9edef226c4222e95d9f2cb7c6a7f11c3099e9b44f817c540f6a58d6020074b8fe4ca0e228b871d39c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b0bc09c873141fd050693e01a349068

SHA1
5f18241a6156bdfdb4054f14dd3016c2f21ecc11

SHA256
883c145d6f7626b308e448a1864ec6f33d29a8eac42774c03142aa0f60c8c8f4

SHA512
dff688ff808cb60d74f6aba3fb0f051e068ef1658b18903f6a14d904f91693b8aaba79926de225f91fc32683eff1452ac2822663045887d6a7245f159c6aed72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
475d1a20590a32f2b81f20e662cd87f3

SHA1
d7d9b09a2c81b2d770fb10776d2b7a26de347af0

SHA256
3cd61a2bbf262632c03d9c2f039bdc0fc1c7b2c1ebf0939f9b4a24d8e0b213cf

SHA512
08ad97c8abacb5270f6a29d7bb82b2b23ae3cd99f19b8e1a4cd97f0757c303ac9f3959cebd6e26fca38be09462e27c3f28357cf2fa91ca640fc081418282f5e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e91aadc5c3b263d82ada7412085f0c95

SHA1
c0e647eb833055160d33be15194d4fa672fbaa1a

SHA256
6bfa20c84302a952c06bda2d3a920da99c67219bcb826ea122b2a83bc6cbec05

SHA512
531086475489e5c69d0e8fd8b6a087163116e42638b017a16f8e6fbc15b786ee5bdebdf5dd62520a9e4a40e270a2aac568b37443f0d3e536a4b7d170330db928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fe42769bb45087b45290baf5eb9a19d

SHA1
f37cff339e2e1cb129d38b6648d20847fbc39ceb

SHA256
e14573d2f975ab72fdc905728aa66c602d928e7aee943bd43c8adb062ec65116

SHA512
134db16cdd3cd332d8e4ec63cd81b8b9f4bc9c03e4a26bf3929183036e5b158c2bec0bce12f268e3e5fe9a2c2bf02e48913f64d8c89fa56e07459b3f29d04ab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
446c4980b75b0046a1e0b1d273c81baa

SHA1
dafad50919a754664c536497a92e8283121abbb8

SHA256
32e047fe701b6d50cc5e139c7823202334d359d7e626e0a31cf71360faaa69dc

SHA512
0bbf8cd77a3527b9a97343ba656b02bbd9b013fcd2833295711397b243797612d538ccc3a09f90ea93c95fb76a5b01d7cc06de68d53eaa4c8690490f5e7fc2ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36CC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar36DF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit