52aa87d91f0122a9e2f591b2dbe0390a314a609abfe40d3a082fc63212610269

Analysis

max time kernel
141s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80feb340baab2df5fafa1021d21603f1_JaffaCakes118.html
Size

3KB
MD5

80feb340baab2df5fafa1021d21603f1
SHA1

37de12d526db7fc92bbd5e40ec86559412a22f27
SHA256

52aa87d91f0122a9e2f591b2dbe0390a314a609abfe40d3a082fc63212610269
SHA512

e18525afaec1d5e159bed16fcc90b50cd527adfb3d2ae42cc7b39a79af648bbf19816f109f201a4de88ffb30145a43fd332e1130e229e9b34b4c1b3e6e7ae77b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000df04acd873bd3e4da2cef4a6f868e128000000000200000000001066000000010000200000004414f35cde2a70137ba2461a8fefdca71e7bb1235f7df617e9fd06ea3d2172c1000000000e8000000002000020000000e739034e1ffab05cacea3807578c45f46c8031b7af2788ff52641a6a8ed3e7df900000006d79b513bbdd8c2ce7a01f34909e15fabe822393ef1630d58335f86664958c92ac750cf48c9309060d2981410a21555f8da2a7229fc2b546c13de377341b93d7bb9756a71cecc1b3662469826b1a3c278a317f6b44ccaeec05cbc9c89d1c5be78f14b3e31ecd1fde1164158fa01148db26a26cae283df6e2497aba5e48b7d9e301bc30c121571e44a65d977e57baac7240000000228b0366d016310a5bad5c958d206429427758b94c386c535e2d93bd75af8c1b4a59bcb3084392a8dcc90cb39d2045c35d6e51144d78726e286006ba2bc98b5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0730070d1b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{959C2AD1-1DC4-11EF-B991-7EEA931DE775} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423153438"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000df04acd873bd3e4da2cef4a6f868e128000000000200000000001066000000010000200000008e3b5d67b54b065f8a7b26142f987d26601b8310d835f08f686e31d5d3a1f6a8000000000e8000000002000020000000ff30cc91e4032e5e8cf0f194cff8356a7ce3c8d4384960ca14072697b4b7b921200000009756fe1adb0d03eea0b7acc39e37dd5bf684635e8d6b816a6ca7baca17209b1240000000246e4d4f1f19be9eb3cf36a2377fbe68f5a14637dca99ba17a24e90f520c6c2837f9e8869422bb690113ba17efcdde390015620a837f56fd64f487fc814e447f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2452	iexplore.exe
2452	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2892	2452	iexplore.exe	28
PID 2452 wrote to memory of 2892	2452	iexplore.exe	28
PID 2452 wrote to memory of 2892	2452	iexplore.exe	28
PID 2452 wrote to memory of 2892	2452	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80feb340baab2df5fafa1021d21603f1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ffd0bc3074a88832ea097ae1b696b87

SHA1
2b8a93d73366a8156772110452a2e67dda7f6d1c

SHA256
8b5078d84cb20c8246770fe6b4028d369c637fcc845b5d78b30ac45134c6a3b2

SHA512
ff4054407f83d9a817434cdb06ed87890d02e5dd8351dc949ef41d964389747ba15885f150eef12c355ba2b986014ddcba1e7748781089b9f58c626f29f3b452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37c9a21874fd9cf430c6cebb72f8c196

SHA1
925bf48d893bcdcb24665a2c0ffda186c9e44abf

SHA256
b65cf57539e51cf699b59a6ff36753ae1821e75c0f6b8593295a576502ded9e7

SHA512
dfce653e219d63eb199b858aa1ad5e054e947edcd6ea3a65b35ce24b54761faff13e1a01cec9bac9ea0afbbf0733a1df0ddee2ad47e3e33a56bcc360a5e480d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
439a51536f005249f14af138d6a22a21

SHA1
737173b640a4ebe3b19ceb9091a1d34ec4c2e9b8

SHA256
4488ba631bdfe317702edd575dcd00057cc76ce59c67a86fdcc9f010692a0547

SHA512
d6595fb672a938515f826b44e20ae5b99f8606cef6db9167701844fbc043f926cf534d6b687926c5a5c75ce2692c5c22bd52143147b1409ea564cf901c16a0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b606b130a478105533abaa6a30336973

SHA1
ebe29de279497909518d5922e1ff8c8343eabe14

SHA256
1eb4e26ef335296cdc0ab90f9290732332285c50afe9d452708697cd2163456c

SHA512
fa06f6cc10ac10cdb16a9622811dfa6ed56dd9961b4245b7a76ab62e2817a35cf0fe10541a6161f3016dcc6b5e3f4f7aaa6900105caaf679f2b55d0e9342155e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3447d949451407b01f90671c0bb57060

SHA1
771398c5be547ec6b396166a656141f172566a8a

SHA256
1ab7a92c24745f21de79f692205b7b591187633fd8eab9b3cb0e71a2851c196b

SHA512
16dcba6c837c3b74bf451fc1563ffadd2cd22003c4a7fcea304c3c69ed920a146e7846edfcd43a7b6216edce68b0669292ec7bba8412c8df479cfecec8e5ca31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24c4f4a6aac064915eb50484102d61a9

SHA1
6b458b98444d0897916cb3c50e1869b7dfd905f6

SHA256
a2cd3333285b2a57199a6002cd3dfb5d5a44475d88de82951274cfb3d519c8eb

SHA512
afae72247f230cab3c58c611411d77e3c2995d30ec205e8fbde70b98973c11e3d4dc485bee0cda4b8f89d9a181386b67bf6d004b21cf1b8558ac9ee2a2cd00c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa3fc49ff3e7669d3d465b84d57a1a5f

SHA1
c506d2c1d90a7a8c99df122684eb24b948d1f374

SHA256
0d9602f574da3b8aa9c427ee524bf5d22867d8ed3b7814c25aa2f93ae9dfd6c0

SHA512
8e954ad58ecddfa09d7dac2c57f814918c48470a1e13a0f8b7143d4063ebd0641d8f7dff8029639ae4fa15a0aae9fbfb3aa482d68fd96804acdd945096da1a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91d44f20ef7e26043a64025511cca684

SHA1
19eb6e5cff70065c4baebec57af841f8a7d4adc8

SHA256
6093fc7b13320b3a44a80600c63253c6532293edb9945ee2ffe664d3a763ca5a

SHA512
92645b29efb70be7bbf054a4835734ce97d5c6866a248bb45504d1e0e11b4e1f5cb0b51f1f428eced9e4ecc1894d23cc5614fc93f2916374c96dae3cc6b71336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
842cb3efb22343a36f331da91077dbe2

SHA1
5654301aee0197b11b5f0e98b69fde31c2ad56ce

SHA256
64ba5c203f017a35497c548339da753628d69ad0f5fbae001d3ba649297f0312

SHA512
880424feb73eb6782e5697954eae2a90b2cf89c8d7e07e395490a2e0ef24dcc58fe7a4b5305b4c95985df90fd2148a3dcf18665d31573f6aacff1e709bc42970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de85a73964eee4833c852ef36f8c08f0

SHA1
33de15bd455de13defc11d283271dca745c4b644

SHA256
920a1826e59be0d2280767c0e5db1b27299045afc1725f5dc9659a3731d45a36

SHA512
b04a2643b53e745ce5bd0b43b38257e687151766745a7372bbc4bf21cb2828619a233af4df8e4243b9e7963543b93a2d44391ea808f49cadb654c757862ea880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b11496fddf8a2ce818c453f4de21e79

SHA1
8958d5ea61e66bdff412d1dd258e287ba782d4ce

SHA256
af7469b50603f07d34de2d87105b8b2510cd9a2f1bc87ea0c0979ac2edf1ab0f

SHA512
645cd2bf5d6c08965e0e273b85883782c5708183ce7293b6ef2486ecba7253d43816bdc3e6758f49624809c80774605f974150556c419175cfc641d862487f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d9a8fbccd7947862e6464c304d755b5

SHA1
a6a77862a263b0cefd4eeefa4e361917442ac3a3

SHA256
c0145a517c3b66bce7ad20774a1c779277806f34ffdd9b9f5c43d3aadbe061c0

SHA512
046cf10dee5494b4590442ed778090d32e16931da23dab1dfa493ef51958d250d0eb72966b6fffde413060c7cd82fda418c9013cb95b85a7a3d2dda3af2371b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4D1A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4EF5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit