a309d60a4c60d27c47ebd67375cfebc113fe54469fa092fea65c169ebafd97b5

Analysis

max time kernel
133s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cdc3292e30342e78126e67e7dd0d825_JaffaCakes118.html
Size

499B
MD5

7cdc3292e30342e78126e67e7dd0d825
SHA1

bcd8bcec8c9e5a481b58a6fa8ebb621db89ee05b
SHA256

a309d60a4c60d27c47ebd67375cfebc113fe54469fa092fea65c169ebafd97b5
SHA512

48bc8ec9ae00ebd6f38dc8580cade2f4018d568d93eec32f158b4e99ac5036f785db7af841549758b8ab22a4e4745c3cda17838e9c71727f36d5987400416a95

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c485b2c4fea6cc89ef2a865928898a64239be7bb4dd6467c443a014666e2694d000000000e8000000002000020000000c14a1b4e9849e04d22ac4a0e9506a43b466202248bd9520799510a8845817d729000000044a6c527514f4ab2705d400a34a60c3899678ffd9fb64cbed2398fa7c6e1714c2b818d10836c0829e151b9060ccf9a12dddfb37ced9e4077fc2a28c8d5a7578c6305b6389c451e019f81e17f1a44b032c2be287b09a74e9c854e6f28d255af1188e997c1e9f8f39db76be7fca723a7f050ef34b38002dd9b3fd032e51408f9655f9ab56a0f9aeaff3b7758f21fa8769a400000002a3b29ad5e5e39588756ec54515d2570a3500ed33375a43d20cc996ae01e38d15c650c18d9ef6466897e346925a595dafda2d00d8bc8143ce4d969e6a4498796	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423061270"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c843d6fab0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b650c8ebdf569f256f704fa0d45e38d5394b83daaf3263054d008f73dad06e4e000000000e80000000020000200000001e8e0a165b8f6825d4aef1d3545eb501e779033e84f4b6e173019426471d181720000000aa9cef3adbd9725dfc69de79095e095055ff1a358b8dda926b35380a2aceb9bd400000003943c672100d310a68defd2e60365a81d8ef6b05f1eaa86ee58f2ec574068e6d782950b072e0beb05513660ebe77818ca90be39c2cf6c30552ae56913790baf4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{019A2481-1CEE-11EF-9449-6200E4292AD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1520	iexplore.exe
1520	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2108	1520	iexplore.exe	28
PID 1520 wrote to memory of 2108	1520	iexplore.exe	28
PID 1520 wrote to memory of 2108	1520	iexplore.exe	28
PID 1520 wrote to memory of 2108	1520	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7cdc3292e30342e78126e67e7dd0d825_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
829f85946037050b1cbd4e6b7365b3d3

SHA1
2372a001980ba7fe0727019cae397f3caea44fbf

SHA256
621c6d6aca1295f92e14c3865f876e3f0959624945f8564c5446a5330a89e2de

SHA512
ace6b7c549cbae57ba489baa0ae933b14705b0c25bfd044059f5121926c8da99a6222ab3c8e0fa35a01c0c793b08d6a3a0d4d670cb19a79d998f226f8ac48148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c63be049337336e03684369639d2e393

SHA1
5f911681b9afebdfaaae94da99473aa716e8d66c

SHA256
ecdfbfaefd49114ea58c3264cb0e820eeea6404ce2dc1b8fa87ba1c0df81cde6

SHA512
26cfd7846ae9438bcacc0baf0d00a3ae71a86ca10460de9eb7e1c37217d4a0b4894b1e058999546173665c42db21458dabe428310bfd3dce4fe429da5c045a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52cdef48188c388fa0e6275491378a2c

SHA1
99aaf8bf15431d929cac98e6ec41c5eff3d2a579

SHA256
8aa428e44e61c7911adbfa8e0d7868991f1df8edf95693581a47d7b854acaa39

SHA512
9ed4fd69afbfe84cd1a8ba41963773b424fdaba6027ce557b0aa583f8774b58677c65e98c5cce0ff0ecfdb8a6aedde7d44ee3aa64e50f0e85d80773cddaf51d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df3c2f34a37dd9dae9aeabc73a828001

SHA1
7329f1459db5c62f42ff3da16dde5eb9c7dd1077

SHA256
a5578c4491cc7ac88fef62e96db39cd23e1c0255411b29e55e36e284f2c154ac

SHA512
bc84300d1f4a0252461882966302928012ecfe8a4da9b154c224b89385ae5c4fbad0eaf9dc021bfee3f0e5761b788d5e38379e58aebead26237e881491293759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8afd81f0450ec7b1aecee2bd404d8845

SHA1
19dc535af47667db5abcb0c27ef6022792f0d89d

SHA256
0b55c2026d45a11546d162f22fde16ef4a3c46273ea0b9665cf5aaf4a16d6536

SHA512
07e5ea1241660a4cff52aae0811b72fe12d3ef971e2eaf9da0b1b99a3a310d17788c3857d1c301cffc41af9266d60677f5f32bbd62fa27023686c12d661cd76e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16f09b4637d94491afee2d4a3a2b7a39

SHA1
28ccf9919c5aba6d58d06f7d3ed3ce461f912ec4

SHA256
420c77c9a960f68d2e82d43d0520cc209e374830e8f60a4f4fd33709e9b8a5c3

SHA512
ae0147978a07feca9ebf56b2a18af291feb04c979b6b381989fbd0adff71ca0986e1d8e072f131d61c2e7e56c58b46872443fe8b052101b2451d6b82663bf783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d7b1ea6e5b9072c3a2d0b4c3d89e21a

SHA1
2d671fa9c77f2b58bc22567be1fac32e752492e3

SHA256
fa2ee9634314fd2e0f0743fb793f3fed5ded24cba63604487c6aed41259a6655

SHA512
27cbe85b1a206c880f18cf20e0ed9a6b7fd92af59cc8d1970881e40655e52e9387a17600d1ca868baa0d8abeb883b94ebaf725d1b19939aee52f024a80bcaf34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0fbd80f01e71957df683c1f80ea060b

SHA1
b63003d76022b66e3ec7865bf31e85bb92143702

SHA256
0c368383ec22364638cffafd32ce733a0efeb6cc40eb6aa918a6c0399f127aec

SHA512
a61f8ffef330f01e8063e25e643913b98a98a9c1849bf957c4328416fdbecfc141fd7d7f8e1fff0a12c2d5704ef348a6cc6056f35b47f37421195b4be3b68c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecb557cdeb5605f1cc8b37ceeb0b9f4f

SHA1
3677b3a55b989492c9429ee317c3b1d3060816a4

SHA256
ed8c1875898093d94b3f23de3d1041d2f7e23b759874e235187234ba0fe12e5d

SHA512
3bec55373239a9750e225df36e5e72c511d2d3db1cced892d25702f58a8041fbf9c3f7a2b7300eaaabc8630dac96759b014edd70180ea59b4130545249b0019f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c32987ffbcbcb04e235b0539f43c7cd

SHA1
aebfe9c755fb7b78eb3f772a3cbbb47588443a98

SHA256
95ddc1b83483ab5cb908deb6b3734e43d9984c5b0f708dd7256233cebf89b4a5

SHA512
647f3b3c0218cfa969ceef3b6fa7b7cb0614d42ce89e6d6c7a21544c4d45618e941411cb2d4894c232dd2a6cf12c9af40196efb2fed12b6a2835d6c6559dced9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9633473c2f2e51b5db2182d6dd378337

SHA1
42abadd38ce8634e08382b337d2a70c0e0f0426a

SHA256
962464707821fc46a10e80efd535cbe59c2a8ff0686362958c869b8c769aa89e

SHA512
1ca9ae2109f001a71200141ea38358dc55d1c222cb9f444e9356164c896a757e3f3f2c9152bf93a5ed6dda2eae17a82ea5192573581bb272090b1a8a6367008c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07f57f563178960c24af3bec7cd5d76a

SHA1
d9ec1ba931ba57fd715d3706b3ee250fd9e92a0d

SHA256
b93322d29666fd0de9c16d0fe0f82f873f90b0333d498a484e4b4735c559d96f

SHA512
d4bc64d811d219bd1dd366826c66bd0e3d3fdff195211ba36f4186bf494fdb91ba8f2764b61f8c22566eeafc93ce307ada5eba8a3fe6f902d4b242da459caaf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24947140448415da899750e8b49b6111

SHA1
95c2fe34d3f7125a27bad091689e5111f5c79cf0

SHA256
4cf2e90ba7d9b2f1f5afa88eaa8bd3f964e8011e56871411c4b9f206cab479fb

SHA512
9c8b71f43bd9c58a9e40638a7f41b5300244db92de4e469a886ec4777f41969d3ebb643d18844bd96370aac093448b598ec4ca79848936ddbc5bfe6560177a64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3696ca873707e9ecf0a5bb8754826fe

SHA1
0c7892c090262296d534808b138649b11c2a81b0

SHA256
0fe09738c623b22364ab44439ac2b24ea0212a9f8497cda8a79246512182bf50

SHA512
8199a64205d097d6827749653c5a067e1b8c5b8762b09e8157981cd0d62450c9330d412350f3b8dc596fba823e11febf38c57e58b26e53c9ccef31f9638fbfa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
598462c53c68a9cd7a299d2aa64a672f

SHA1
7c974f830435ba3f3c499c95dc22ab55bc9e11ba

SHA256
6ffe6510544e6bfd9928fab70e1a108c9be0619f68132f0be32f10e391c76080

SHA512
7d556acc4883eb6dd064a09ba684746343d074177e2667120a6aaed05992367118cc403a4a54e3e972d4719c1288937bded1395347970106f7943ee2417cf1b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35845ce4144c7a8c7474e455f026d614

SHA1
a29201d60d2634ed0024934893479e0b979ceb7e

SHA256
8ab7409a090686a07abe9228ca205399e351facd3beaaa4580cd901711929a9a

SHA512
915df65773f7a410e2c0c92bc8334c015156a3c770aee92c388e285a95a71dafbd9ef998db6068e799a2bedb6a0d51c24fb9a294ebcc465c872bc2f9afec5fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba78e3a6f4395b0cf1d241b142eaa926

SHA1
8fc33a429b48dd9a54a37ed9ea10a78d7987a0a0

SHA256
a3d9c8e7476adfd1c22f4b1fc86bff9fc2b3fc7060ee731fb5d0bbedfb533d4a

SHA512
a5e19ecb6330a08c7bdc445bd19fd3d8fdafea0574187163c997034d05beff965c416205f7846411712d329af8ce886d2a4467b2ce72678663859546179c540e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c00166509e9b4521745e10a9285ce2e

SHA1
b60c84cdfa55e4d8b7e25342d0993a0ea3cc7a97

SHA256
898bf278c668e59fe0733a172928e4c43714c6a91a9c0e68de93fd1c05307c97

SHA512
d74b62f4eb08bfc4970e8d6c809c9216c098af6b0d63c5ab1c7cf23c64ec63d1b5711cc95337aa896bcdcc342269702f93ae9ab0922a764b55e4d230bc9e37fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38CE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar393F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit