fd619c8069979f3486b28c85d7ca698f8dd3f6a9047330699c3b71e1745228ff

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dcbac209182c439744657cfdabf7aea_JaffaCakes118.html
Size

3KB
MD5

7dcbac209182c439744657cfdabf7aea
SHA1

3d96f408f025dd8ea799ccf717e8da9ac7ced672
SHA256

fd619c8069979f3486b28c85d7ca698f8dd3f6a9047330699c3b71e1745228ff
SHA512

fdbc10eb2d290c0a9d243adb075b7f638e6339274675ac885288b0b9eaba63b80de3034ca8c912d12e9640c42de9fe1f04272b85da80f5921243e21fda18f433

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44DC0041-1D18-11EF-AB84-52AF0AAB4D51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000520b15a8d65fad55ea2a3459234df7dde0f7cb9c13597d8d8093cfefdb6c0781000000000e8000000002000020000000ace5a919b84addac7b154167989f6b92dbff4c891396559c64eda66784301b6c2000000056ed4cbe9a81a2733d09bfe865fa8a900e7e9d1e6c37d2bba0576df9814e7cfa40000000320c1fe63b292997aca5c359a74942e6f06e0e4238a8f37b80b44d5990e138cfb314a7550735e79575eec76039820d73bea1e83e378d6a73ef850d927b10b72e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107a721925b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b2405da25afeed154341cba3a95f8abe362297b5b73991fdf531585a84301ea6000000000e80000000020000200000007775a4b1e6288ceceeecca5a13c03883254ebdd8c2e4f385118fec3ffbe236bb90000000d98a8049bd21653fd1b9ff5504df95f8594bb80dcb8fa05a681e73b3a1a8e11582bde3322f9971cd7be0cef2c4c6370b9aa26b2f3b3b429cb179a830478969a4c43badfec9799493e2815c1b6a73c04073420313c4fe9060c2c23da5e3478dbaf1373bb3b00be945f3172b9597c59d17bb452454e67b4ee550314d9a8a141f17026e5d658301e9ca514b7a1b01f4171c400000004ca9c72d65087e8bfea90cf6757ebafbea2923f231b5c4dd981a213fe06c470ea8c7134eef0f61df109da973a76ca25e7b61dc839f6a4c10911072b227f12bca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423079421"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2860	2372	iexplore.exe	28
PID 2372 wrote to memory of 2860	2372	iexplore.exe	28
PID 2372 wrote to memory of 2860	2372	iexplore.exe	28
PID 2372 wrote to memory of 2860	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7dcbac209182c439744657cfdabf7aea_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3b63c7c389444c7aed6176f10ca5f66

SHA1
b7cdd8d7c5dad4dc91357c31a4054c117ca2fb51

SHA256
908876d02c00fff39b56543d2b52c18ca02770050e2d6272189bcbd58b5412c6

SHA512
d12d808bbb1a2d97c62f0ea20b0291700b100726465e8375581ce8a99db8d7620b43fb88855174ca6733ce46ea8bf05df47cf1dd0b117173363c21e4d983b941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2383fd17b834487cb241b722250bf0ab

SHA1
a8d58e33fe3a68cf011ce8ddf93e49091a871c7a

SHA256
b736211b1182995d398b2640d1b4cd2879c95fa111088f17706be70010e9956d

SHA512
caaf66d2651519843f51d4eea5ca9ad1be50fb428bbe158a814c20f0b044fcaf0921906e2a0be1e3f2caa98f392f9bc47ee0f5e90eb8ae15cbe71a3ec2c158c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb0eb210199b8bc99a0d1cb301b9aad

SHA1
37763a8cc54545f81b490d1a6ad5484d3e7cf3dc

SHA256
90398a2dd8a1561288f3b8a8e5d31222451d82b9748b61b6d1117d4b02f3eaac

SHA512
dc501101cef213d8fc47b4896ef24be5f3fd82f26a4e090089af6ebe486aa96a02e9c868f28056b61fa7853252b7772084dc178e29307e6dbd8359596810b323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
747fd5ca3a041b3820f567afbe176f17

SHA1
eb522ac37f39bbef68a5b5fce5ab9e2ecf6fc4e9

SHA256
bb1ae8664a7cf56f8c9c3ac4942cc7aa4cb57f3aeaefbefd5f99a978138c47af

SHA512
4a11b715a014851d55c03ce0a52890701a773b20c15da5782b392bf26c92230329fd5aae180798cc2b6cea06e34f27cb31193c2021df9dbbf2b524a5bc10ef2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
715b3e22a7b79f180e66c7ef258ac6c6

SHA1
3848561fb3383a16a893e519a4f4a4dcdad276c1

SHA256
a97f452bdd3db6acad3095352f79d87b5c2abfeeb79deb991622a246482e77cc

SHA512
a961b4fbdcad3b6170e109188a2a9cfc69a3904be95e3af2c14e927a18e3d4dcaea958b89ced20538d7f27faf56a85f262558b5ea4fa75b8fb80d62667cb52b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27bd4a2a5d2ec5f8fedcdf9ceec033bc

SHA1
9389e3f2319d8c8bb8d81414cc81e7a247268a92

SHA256
d9f27cd7b4abf65c09f21e45675f03be3fbb717bf3d139b4116531e1f7454e58

SHA512
571985db8b8c8c08a699abbf535a27a8b84d4a730d5f9de17470d4f8e7ede7ccf805dd69b2e17720c96202bae9e50106675abdbb682ad5af6e903c4dffdbab4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a58d7c344641f3af21785d62d4c13b9

SHA1
685ef4c50285173397bebfabfe32d4239125a18b

SHA256
369a9c691fce6398fa30e98c38153a4cd1ca146877de919d71d9e8f297ad972d

SHA512
cbaee2bf3707667b9d9307bf353ac5703667ce35d8dc8b3d5b6a27e8b8b86d75e7e16244b378dadef644e101d7527aa451c651c9d27ed264824227ba15185463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b4bd4753f20ef0e6b5463a5f54858c

SHA1
7029c2a4e745f4bed660bc32d45d195e85c9a184

SHA256
0e13fa329f66ae1e4b50350e3921aad5f767d4eb2645eaca1f6a3df12fb73ab6

SHA512
4e8bd90baa56bbbfa61cf5c2c77161259b6b6e39ffcdfb25d8e511cee4b2c5dccc77adb45fb343dd23cec9d7248a4127ef0d6357b6ef58edd66a1fd74a894e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c462b8d6a4aaed051117390e6113ecb6

SHA1
9587647b8701ca07631766c60de97c5ab42db6d4

SHA256
57aa21e47bf9235f71f931b075b259eea33a0e8cbe89839a60a7a1c985055e1b

SHA512
6ce8aa082a98944b82f01f2304ebf4f4737ef5fa9726831612210073b55d380af3b0d20431ef0cdfcb7353696b2adae553035063d9be690701d6e7a87ef3014d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a905dde4a24d199fdc95038cefaf680

SHA1
986cd5293db913e6a8a3b1c183e01442497ab6a5

SHA256
d5d77aed876c6df5992129d04d859e7ab7566129940dcef6af84f41d79357ed2

SHA512
6b68472300136ef2c2125ebffb733b5f0dc37849a7c66292e1c72de1db40bb5c26fe1b36bbbb795a92a1a1c82521c9500f9cb8dd9a3fe09a3b41ae797b2063da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bd21505b2ced00898ec999e69a4c6d5

SHA1
879ce1a97dbb268e48d31a2cee422e932e079203

SHA256
4899d87c6bb5db7cee4011c6a93ff9806665ba5ebc6230fe1b6630e75c1cf11a

SHA512
1d10b22c1727234ba48f6f1081d95022ee73d076cca37820024f959d4af9e973b5b51a35f194dfecf2300d692b0c918afd78a8a83d4c3d4851c11dee827d7e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8d76223f25d41121594f308945caf4a

SHA1
6527b509258493620206db3fe2ab4ae83102d4fd

SHA256
b6cf48b96ed42ebff3e24fe1a5443696592f2ee0bb77d425962b34321c1adf66

SHA512
53183b726b0be40a5cdc62bff524a4f546556641d72229261069996b78ffc53f0b2c7d4811ec51e4196813ce391904b2c06f39500e52fd6b541f364b48faf1a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4994e6a4ec690a4a38f6f1657a5edf48

SHA1
a601e823166aa290621eccf877e5638ddb6a4686

SHA256
c0658084cbd19d200b2b7e774c3e083841d26bda7a01896c963a1db0a85ff3d5

SHA512
ecf02860f39f40fcf034a559c253a9f3601acc0fa995cf2ee960fd692099ab3e1206219535bc14f69968034efe2ef0be94374aa4698f530cc2b9c6690e2fb1e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c2381d28ab96f0722c881481ff74dd2

SHA1
429ef87b59164b07dcd9ae6880aa493e327c6c42

SHA256
a3d2b4f511c1fdd359a7e81f7d6ded891d8474d834b3cdfa827cfaf4a2e71003

SHA512
24cae1dd83a53fb7c68701d27167c09b67d0e005eb5f3ceb744f3a99faf953e1dbd79ac6bbff662a27e3bef1005d1caaa71c8613d2a4121ec023637da2da0eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c8a637410554b2cb1dbae01acfbbea5

SHA1
2868ecd0ee3856c031109369483b395a56f1e4e0

SHA256
a35dd5a7eb8412a12c4d88a58dffdcc769f7926ca0ed348bff6c890457126e95

SHA512
b32b5d796e0b0b9a84221b6ce087a934ab49c8441e95cac881ce37ef9826d13ca4ea5322c0ed64062f2a0993c9b6123b35292b68bb0b0a23737ce59a24958e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88436e236110e805fcdaac68f57eb45d

SHA1
2f364d495e38e76a448f96c815e3d5d4cc301ffb

SHA256
b5176f1f34f6c0ac4c178e1d14b856aeff223a23829cc98fe5133aa440acf2b9

SHA512
0b4d2543e3b7898cd2d5395d952f2d4bc2296499d42b36344b636e0e2e51e14825e227d3f8be8e8fe1b4febf388fc4975ef8a9a9f5c2bc06c115181c7874a287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f74b512c0654d96b70211564c005be6e

SHA1
38f1557b725cadbbac61a1c07b53fccf4f75414b

SHA256
3e21d0f6e7ce4f35922c7dc867f1e76dec5bf27c17bdf7e1ca4aa02aac9c63ca

SHA512
5441bd825678b0018db4b7b891ebe024c5b11ce88d97917bca98772d68ec030a9a82c885a83bb622b651504ba79dfec495c516139cea31287e8c73a2226de757

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D9D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E3E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit