a3fdf48b70c3f671a4497cd33e3859f250445d6b65e615360766fe0398e59914

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7db5e40968e214bc50bf6d1f713f77d1_JaffaCakes118.html
Size

2KB
MD5

7db5e40968e214bc50bf6d1f713f77d1
SHA1

8be2f0c53ff679578651d5052c74f7cedf002949
SHA256

a3fdf48b70c3f671a4497cd33e3859f250445d6b65e615360766fe0398e59914
SHA512

0a370a0568186c99dc131bb9772a1571b63a6f6167dd2470609153b62ad290710383e9ee06f6d1f29b5bff568ca24042c03cc32544f50a5ba052f186f4b86d05

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000237b5f72b8191f4baf7c1c50f9e23737000000000200000000001066000000010000200000000976ec19907919ed29fe0a69b46c610eeb3d051824ddd37069474f93c3803e73000000000e8000000002000020000000bb7d64f18bf3f48f8bd0b69fb3dbf2d4e849752707990541f712fe3ac57b23542000000031f73c110ca35e68e77f95963546cd774cfb0b4535e108f92aa9ef9fea0867cb40000000191c769b364f5c7e769981c76b6305736c7750877a03b56478e71941d670faf66b744448429eda4cea73c471cdafc27fb30a1f4b74ce13d0d3d9dd34c78b1ae4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000237b5f72b8191f4baf7c1c50f9e2373700000000020000000000106600000001000020000000cb3da736fa18ddcb5f2a6c6a556d2bfde78abe8fbd476bb18dc9fa14d8a71b51000000000e8000000002000020000000abfe794880e5ea19bccc7c2522507e507af9a59e6bea2c4557654941ca3d80ee900000005633f970413d6a1248c5ad6ce6320680320d46085c1fd684e7f65a91114bfb0f77c7009a29422a5b1b5a3aed0cfe1a8df1451a1200024d36153657e394f96d6f76eb6800297159d865063b1a3eed6497df16abe15475cd4f3af11e9ac1091ffb5d880d17228b848a71ddd2afdd00f4dbcde4acfb3df08fdb532e203c2d57a02370d110c59f9ab4051d434d5387e473764000000074b7cf2bec4aefb2e3e2085b1d6c75cc6b369e1efe14c11619fffe954e923c6a582a8ec20f26fd1dfed95b9d42f79f5222057668cc0ef6ff3a135c2f2ca98f24	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423077639"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0688ef220b1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E1060E1-1D14-11EF-92E0-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
868	iexplore.exe
868	iexplore.exe
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2012	868	iexplore.exe	28
PID 868 wrote to memory of 2012	868	iexplore.exe	28
PID 868 wrote to memory of 2012	868	iexplore.exe	28
PID 868 wrote to memory of 2012	868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7db5e40968e214bc50bf6d1f713f77d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5095f9f8033d6cf16fa8425d57cf1e5

SHA1
6e6e2c6c086135e83f7a74e9a325c144bb768acf

SHA256
f88db493171f759f64edee9593ab2961c627e4c3b34628765c7b356687f2a880

SHA512
40188d480c4449abe66c49b8aba854b4f71b9e519afa8e27de8fd29bb33974a3bc53a917cf00b29aa0076be58caf1cb2381d8d5ca9c6c38eb5780c45541c89ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d68205ed9111500744e5263f5cf755c

SHA1
c1d673348c3352e72dff6b889210dc16552cefa8

SHA256
e59aad5cfea3ab475f3e6a2263cd3f58c37467b8d1cefe580c94eee186e0c8c7

SHA512
32cb095f7d5c74f5ce66fc98b97d9eaedab9db7ecbab5858eb61d3d61798093c936aaf40cbc20000a3cdeaa4f22996767ddbd7070b474456164a17da95f8b3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
945725b2d0212d0b7273552ddfb208f8

SHA1
b02e0fbc9ebdc2946b2d6a298adb42305915ecf1

SHA256
4d8b7749e5e1d7a0622ddd94907bb930dc6baef07dc9114df698041f9bd1f4a1

SHA512
a14dafb99b9cec97d64e547520260a05921e922f773859e1f5e50d83996220b2085cee72fbaea4f4308ea69c6dde79a9c4ef5e01ea9a458241eb6dfaa9b0bcd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56b27d8801230716c929d03b8df3b875

SHA1
f5fd27b92f5743cccb06fc1e339f4005807573b4

SHA256
31567cc8d03ab00fbbf35e728ee5fed9b04ac210462d2d7707bd1f5cc2c352b7

SHA512
a4a2795756f5901937ff968077fb53263f460153770e1dddadde77897ba714e57779a3c99449e850dcc227515f06f5a0c497c6f992edaa9950c02f5820575a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c0203d77b2e6d23a3ae86398da2882

SHA1
05c85d45f64466f8d3ad0df2a77eff05052f9aab

SHA256
dde04e14c74debc462175277444e3bd5fcee508530ef7e3064df32dd8d726446

SHA512
ced9cf203babfbe4784f939e33540c7f0961319c21e7fc5e6997cd09ff9ab0fdc74d04ebbeb59582aba95c9f34315838b4106ede12dede58ca397a10fb1955ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73f9ff3120c771c3163262c596f8b0b5

SHA1
bdad07052ff88521d50b904139e4cba7fd119bf6

SHA256
5dddf034bc5096acc1dff8eed7c06ac8d58aa48da9dfcce35cc88c4eb38a80a1

SHA512
482adfb7eabfb40952f006d4e138b443d3806b6a73767862583fcd12ea5b7ba6158c616848b0eed1a3651ce648b0cc32c6e7cfb3a278dc6add259b380e03588c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7106f49e860b78d71447df3fc5313334

SHA1
2c4eeaa157e2295ee390d2f224a9116e5cd594ed

SHA256
ca64962e7a2492778cdf1fd18603b6f2d40ca17e86048c823cbd2af72ff9be4a

SHA512
9c2798e07c4018f94f4e45812a8d97acb4bd99191a6341c766f217a37724349c72e58bb0716c767fc1cc8a553ec9777213b1c7c62f19073978cb1a1135986692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dc7110b1170d9215ca4f91b35ffdd68

SHA1
96e6dfeb63423f4e9770c68477d8b9854186f69f

SHA256
cab18ae30ca9d9afb629a39bc69160945cd1c4832e35935f943b5c74217b24b9

SHA512
8b59d21654566d6fe5be0a095a9b0a8007c93c960329dc9934632b71045f5a8c0ee1f9ea650c22fa3730e3c84195519b7d199f75250c333d9605cf9070f45ed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc33c818d2fa30e79731ffcbde6bf36d

SHA1
9c121d23368bc452021bad13a2346924af733a2e

SHA256
e6a60809a3cf593961c270ad6c195e47c1503112f475c79359e047d6a94d9d9d

SHA512
27206d68a24dbff5d2fddc4c9d6c0f93982f55dd66ccde4adc441d04b3ec597f2911462da0a84dbddca9bbfd7a8f8a457e933879b0f4013eb3a19118630b1219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44933d49e6413d8e07d81a917f559158

SHA1
ac6d99086198fa7bbeb603fe444732a0e5310fbd

SHA256
2163fd77e3e799856d2a22e8c5d923678d85f49fd833f879a910356bf0996c8e

SHA512
c1540647ed775e890b4fbb444f5c4f6d1eae77b2959b1bc352f16ce1fdc5729ce554eb2a75cf1d5162baf551d49b2b5c5080c010bac585924962cc9aaa8e88ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29E8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit