e80975912d3587743148c62ae3520041c3a8f0a0bd64dfcc3c55381f79c5a127

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c0b9ad9dabee005094076ea5abf524c_JaffaCakes118.html
Size

3KB
MD5

7c0b9ad9dabee005094076ea5abf524c
SHA1

6458806a6cde2fd41454f3a109d4dae90f1ad99e
SHA256

e80975912d3587743148c62ae3520041c3a8f0a0bd64dfcc3c55381f79c5a127
SHA512

2f23fa6faf1c555bddfc4919f0c6b32c2b85d6f293f24c4f3624ad8998642cf25f72a09d4ad451593bf98d85e6c947baf7895347ff2776154844259125983be8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f4de34cab0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002c038e4743fbd24fb70d47dbd955387300000000020000000000106600000001000020000000684079280d6db9dab4257f23c404e039139fe10ca0b0bd123c63c7b33525adf2000000000e80000000020000200000007c56ba7be400d346651e721403224922005a2ac22100658efd851376d14870ff200000008dec43b92e0193fa54e5a71380310315c43d5b7b6e59cf1829957ae4d0be27da40000000985e18d479d63f5f307ae3dcaa77c074a04252778f5acd51d13543b80f4baa4ac7eb0708345eb428db672b6a83c9d41f8e49e21e4507f55ee2ee7a55bbf55b99	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002c038e4743fbd24fb70d47dbd955387300000000020000000000106600000001000020000000223e0de98236c2d3b42c68883328a163003f1dd8db6953b2489cd3ed1817a09f000000000e800000000200002000000066edd77332452018afd319dfe32a3f47b447a5f0053fd6f820c8eabda77732a09000000088612a3ca124b278e694c216ed85d48a280e2225d9f6675104fdae249dec3dfce4322aefb29cba07fe069e626f5aa17b65fe1263148a47dc93b9c3f742ba620c19fc45fa5c3478caf3ee033ac84dc91dbce9bd35075f2d4b2d71291a075cd4c1ed246c96d3af8cfd88a445da0b40cff96ee47c9d5ee524ee2234af553b98e17a9d0245d40ab498fa1b9ddc844dd56e70400000007c0a64a96301eea8e584f5b945e45cbd8564965204db004bc5ae6c3e3efdb4da3e4ac8848ba4284770c4e45b47d765d67e2b50255b46e4ee58402dbb36fdfc26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FCE7001-1CBD-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423040384"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c0b9ad9dabee005094076ea5abf524c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cb15555d5fe5dccaafa1c7c17f2a09d

SHA1
60251bf24186f7263b5714451eacab62889bdf22

SHA256
eb9b16bfa4c14e41aa63b8a7b4ff6349aaf87433d8e5f677450ae161f194616f

SHA512
8e87a287b57ce5d2c13c3f00c66d608dd7b5a16a72d537e5ddf62b2f407e0a8d10a7746526ebe65a20672e512c7cbba1246f5e0d51cf62f3619aa5334d633c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ac58551d8b56cdfbf78fc403d5ddabc

SHA1
a8feeb22673f5139e19c24d18d3424d9c37507a1

SHA256
df04726612e246e4e87d1ffdc3e28e82f83ecf0e5a131713c15281989d2ea817

SHA512
b596a90096d2c29fa9865c31790e1e4ba3e6c50c7271ada0a74928321a6f8f8ef064547d2d7d5d737d77300f2e0c4194f014d8c7691a2517a8b856cff08cd085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7e4d8517d7ac4cde5db751a1d2ddc79

SHA1
b2e0f079852bb1b227cc9caef2606e079cab073a

SHA256
93c71d657ee042294db08afacaebe25bcf94b8a37c07b9bf57107b616e2b8c17

SHA512
4358de9f3cb08d83c5e9e2994cb50153b650c0ecf28bc479c2ebec767f860732bb089d97118dab821fa8207f8d9660c9c767bc58a689682c94233e329afc88f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ea727fa2b5b6fccfd6cb71d900801e9

SHA1
067d11f5bcf2d395cbadfa6f18e3774fae800aa7

SHA256
3a51215b37f713c15cfb88f61981f5928ed042e5fbf5b90fddaee60f870cf045

SHA512
86690fee4699c1023f87fcb22429b8b1d69d31497485c3e56598a225bcb05eccccecefc05fc52eb4c1f7a89cd32c9ff4994b5585e9ac2d96ccbae6fb285434e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
239b116a59d7339c78a0aea4d9b37590

SHA1
03877bbf1f64b3954234c837a7e0cad46af98b9c

SHA256
ca11520ab46794c680f696e5110c27316afd93f7e1b7031d0fe8d038b049d1c2

SHA512
0d32984f995bf92c113e7715b8ae4ab8d73c6991e33b20d0f819052243aafa6388f3e02b86216a97313fda9651c73deafdbb55237de7dfd7a5ad5d9d6ef647cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a5577a2ec9ab1fe6e33ff98d048e48

SHA1
c08c45dc3e44c85940a0020509b0e43b4687d620

SHA256
fe5cd5b2edbdc047e829a953a19a3cf0d5330fa7e40316a61038ba237cd72b0a

SHA512
5b9534528269d0424c3ea34c028fa55c9059483bf8fca662291380c14525ea1118f45fde8cc08af702db147ee680da285e084a5c9ea7b6d3f94c3b0b62ae2a24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
081bf2146a9bc32ee755f9b8f3ac76e4

SHA1
b774439c8b3e2fd840d081cb98c75ae6b7584622

SHA256
8d39c31b43cb6a80abfe3ac9e28a28b491a6caebb2702f9e86c93c6bf1282344

SHA512
caca729143f8c952d34f2e719afdaf54b6062c05f16261bae89cffa79a9b22778da3cbae420691283606522ba6d15ca3959449e75a510cbb9fa9187eeb70fd44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fdad4e6201f158fa7920ceef3abe31f

SHA1
93b2dad0edd84662f4555c42184b6d12689ba94e

SHA256
9ede741ece577ff7bd9a3128895385b030b726be80cdf34364f3498dd6536fd9

SHA512
9a849e810ee23974b769f5ffb7e0473d30c8cb489f6c0fe8a529e132710f51e0e197e56fdee8447c7d6e0c8ddf921b1eb97a0c0e6dae96a5927e5ce12205ac2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
740d2f1f7847d50c53b57987fd9c7114

SHA1
f6f9059d39167459821845c7cc3669a7bda2a8bb

SHA256
085a6454e566534d2a8ee6e58442085715bbea48b0d77070309fb36a03d12b8b

SHA512
18b3e28cbaed48c5843bc0e4d2661a31093c3e9bb08fc5b127b08873dd4dd800f76dc69200fd2622c4ba7c9dfcb9a8b114291a1074fc859339853445728d9fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47312c99bb4d7669737a1d83d357935d

SHA1
d4fabc2a6ec89bacc8b7e9ff42988e94af49b3d3

SHA256
40ba8ebcc8ba92cc1301484bb4fb5791fa5bd6cff90ed19ab85bfc27298f0be5

SHA512
a21c33a07346a63c7896af4999f329cf2a9203e7fdc043113457ca5ad6a44c27b211614eb042b5c308390b3befa928797e90951076b3b4eb36c4dd1cf19cceeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86606841513a0807c8c157687fec41cf

SHA1
b130310a5c963c55262cf08dcbbaaf741053b941

SHA256
5f38ad6973f6b2b90a0654a5e0428fcb39e893f4eecd8e402a6ce5d812173b65

SHA512
eb6e8282b93f91f0bbe1af8ba16a259a7bf5ec06162393d4b8277baf5f6135b783d87ef7fc21878291ad02a2dbf81ff45f05ae1a01c2472740ae73c4fed4d4e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b2443465b7a0b068584082ff8f6e1b

SHA1
c7185ffe7a03e142d0dd6921a6c29be79c3eb1a8

SHA256
01dfac736cdd5831f6dcab30d78b697ad807ebc4ebfd1be5ef3f4718b8ac7bfe

SHA512
42139b9e282a379d561fd2419825e373f8f9f4aff9dd996d529d668dc2b6af9d864cee0995b650990091c4fd52b232d1a334c5b992954ab25a249f93917980b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a8bd5432938990e7eebee907f45a905

SHA1
e7146b8444832b96cc71687fbe82f4b5807973fc

SHA256
135f6fe0a15a704fd03270e1e50a035cef157b8a61d10ca005b809f05b3a1c5b

SHA512
3aa8b227ba1f92a6fb4a20a146e3b5187bfbcd1b4cc5571a6920a9048b852656503a3020975c415349aeade8aaf2991aef58de83fb98027bdecacdcf2dc011c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB41B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit