0aa1ec9c0b160f51bb3f5c8ee0b5a5af0550dd5e339ab33f405b236333c5af01

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8643afbe9152e7932785a0df7cfb4c8a_JaffaCakes118.html
Size

973B
MD5

8643afbe9152e7932785a0df7cfb4c8a
SHA1

f3ee9f4e6573c587a2432a6dff3faff3c16e8100
SHA256

0aa1ec9c0b160f51bb3f5c8ee0b5a5af0550dd5e339ab33f405b236333c5af01
SHA512

7fddf09a980f1ff45b15d8130b295b15a320d23d41b817a1fc7ee464bf6c157daef59974a523cae874e31d7d4b8d5e805892e5872463e0155637df9ca0a67094

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c8e6a528b3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D083D731-1F1B-11EF-9511-66DD11CD6629} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000400d33bfdae2c344a6e4d8611def7d3700000000020000000000106600000001000020000000c7d73b9231137d819a0133d6617ab658d3f292035c5e3c500764f4916c0d1e43000000000e80000000020000200000001cd0ab36ac45fb30ed130ba75112759ea22e1f4d5a58126100b953bf852fa20e20000000b8e44c11963976ec96b29c69dbb6a0fea2b129abb72d68d3b3be8a49060228ac40000000f7e083f4b5814d6096ea6ac85408f4bf702696331cd347bd9efd84ac86954493b87f567678531d64948317e48797408c8867b41111a56390a89f796b9b4e3de3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000400d33bfdae2c344a6e4d8611def7d3700000000020000000000106600000001000020000000fcee3bb9648f458c8bb7ca8739c2a72f323e526c6eef06fa7d88889210e489fe000000000e80000000020000200000001fe913f3b2965d333e07e9058e925aaccc130931f6a9c09dc6510f658ac49e7b900000004b6ac82187ddc1cd38fd813377bc79a7cda9b1092b5ae659b6730d3eda6e6996c7f55d2f47f0e7d09a4ea9e8988c453a69de0254384fdf534372a6139682bc692181f48d2822c9f3c221acbdbb5972959e38c96e27837bf75c4fba4ddd7027835b7279f89e419829d1779a88214ee34464367994370d6061dfa4be51f7ca00ec98c8c64b7075e2e670710e0d79501b5c40000000015a553359661760c32a8433eae40d16b2dd1d756fee715c786baee78c41da237c445c357348c85497f2a1c42e2da7cee399a757f0e107eedfa36e9e1f351cff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423300848"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2316	1968	iexplore.exe	28
PID 1968 wrote to memory of 2316	1968	iexplore.exe	28
PID 1968 wrote to memory of 2316	1968	iexplore.exe	28
PID 1968 wrote to memory of 2316	1968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8643afbe9152e7932785a0df7cfb4c8a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
531b8d90fb7b2eb564ce55e64e0ba9f7

SHA1
111707f7bcec0611366fd936681db70bf248aa24

SHA256
30753fff0aaf1a6b2327e52edb99742b79aa87f1f43ba88af1e1999db20c09d1

SHA512
4226e9d90473e805e7b0b791652c297816d8fab7618b8b0a9102cff8499b22c2c4745d191608955603d515651318b16af24a0595b264429e3d15e330686d75a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44cafd458b7311e122c9f1c7fbc195dc

SHA1
2b6cd68cde5e13e87dcfccb34943b8beafdffd5b

SHA256
fe1a0f8fc0599a6d602817212c570729f121330711c0ce684fa4d697fc3e48e0

SHA512
cc54c0746192b01eb2f2e7de1718fb4b2ec4010f616fd765ef3b5e72cc0fa770007cd399f61caa0d03e13d2ab2400d472e5d53f5f5d785b45e959d2d88c97ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2874e87f6f2e5ceaf3b1c8e85ef3f9c9

SHA1
a724e51360c9d70cd9fa0f0c48a109a4e6af95be

SHA256
62ae0cb2c8a70dfa06571e9b2968d4d85dcd2a14a1a7346b9b96795b10e04396

SHA512
d126dc883c62a5518b1cbb0f3e4c2d308278e58bac5d9d268081b9cbfc760bdb2f08bb09c9ed483aadec5adfcd37cc6c5d716cbc6ff19e569555503991fa9a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd1b3c7e0152db924d32084f2112d5d5

SHA1
7c8dd6e239a57931d2b715ee8976592a2054400d

SHA256
f998851d41b3f5b0d73aa493fd4ff989aab828f1b29783ac3a9536978708d24e

SHA512
b3e054c833ee8b4325d1ca8b17f4671ddfd509de216ea6f15661082ad983510fc2058b10f8de42bb10089a305918f78a34a46cd7cdf2112c4d8f5ff666146b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cbd8dc57e9bd844ce5a362f4be646a4

SHA1
57c29398bf28872970ae988a9e76a2ca35f02a6d

SHA256
3d233b91b5c95822d6b3541e3e1f270055ba95b228c075608a4e274f374c7947

SHA512
78052f932b44c0827dced40b201d9d01a19a299b40cdb8d014ceded6e034a9e44b8fb7bf90c3caa3097bcc0e2592ed56d9350fe97e5cbaa42f5d368b660b52cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb0d5c4f28b634907fdfdaffb7e43f09

SHA1
9a41024698f1ca5a469b3cf7844536aae3f23af8

SHA256
664afbb36ca0ad799cd80295e658d261c78e53804e47e044caa615e17860d7c8

SHA512
8ee1bab7b4fd75c82f6d6ea23a14a08711862f6984160a65c3339a162226ce9b92f868aa6965f678a5f883186ef55f316797c60b42e66afc15e83dd97828d888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40554f6b9732ea2d9067206d90bda2a0

SHA1
7173c4a393bcf25804e78b1655e06ed13434475a

SHA256
936cb4daf16b4922d063b11e92d50ccfb4693b89bdda0a0f724d82cc957b6893

SHA512
0b1e04dbff2170b88ba39c584322fc1bf3c99d8c05eed8682c5b8d5dc6e07c9e01e074cdd5660070d94e7d40f65eeba365bac03888ed403e8ba705f675113889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
736136f2da17886204618f794be67eab

SHA1
3aa12d69842100f623cfc7a850e6dc3ba9227038

SHA256
ea28c3847a5c36cb9e5709809af2f418ade3d302481f90792af5bdd3b4b8c394

SHA512
f47ac483f5ff59fa654f38a17360cd7885febf249ec674721475d18b3bb3105bdb73d4c7776d4b47b52b25673b0d417a8785e71863e31b0262a5183dbbf89bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf83460ece9fa895925c8af94eeb7b83

SHA1
b660b055820658c1e328e24bffff8ab7eb38a9a5

SHA256
59ff5e14809bc22985fbbf275e6a507bf659d5407042d7de535a3a5028c5eb26

SHA512
2bd31ae448ef99a9cdd33f69d58cf934a1f81dbf2f5d66c9df35c130ae9892c6f179a12bb29957a7f5f68426c6ebe6f155578cec8bd9e95f5d431916849781b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d614e6d8a08c10ab8d66466af88f1f6e

SHA1
06d7f22a9c0d71917c29490177ddabd75e91f530

SHA256
3dbe7b38b99123f975530ab907e967174c1124f1f2199f471a9dbd3477f52810

SHA512
c8244657fb59f7d22d2e6eba9eaeaa84b4ce50a8ee6679ab870b53321d406cbec2f919ff78d499457f4897288be4c8d460db1a08d7766445bf7c97752e785ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa31f39aa5247abec8ff37fe5ae2a7e1

SHA1
771c2e91c308f81699007bd13f6db4905c2c25b9

SHA256
a2a952ebe0b1f6836c20711f112f4e1ecf55813d9ad0b9fa65c32ad158ab9000

SHA512
ff8aa171030d055a81de861d553bacb120d65efb76e42557aa6394ff733c75e3c65c98ee1feb0cfe377c36886f41c10e6647077a0ab2e44bdaa04fc2fa81752e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce056ba8aecbb2c6fb25fcb2aad20fa2

SHA1
ed4cac4eef29bc9879738d741bd3732274a3dbe1

SHA256
c780ac0dd78debd9822e3f5ed9c37eb68fd199bc5fc04e5fe98a0dc7ef9b5c9c

SHA512
5956783b7a6a89205cccd5c82b9158d722077464bf9986729c170f4c177d2d55350031a5ae7351f625a397a123ade5d41beedc748e11bbd4bdfc71496eb9ca63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c880159af61e448a9a9671faa0c77ff5

SHA1
506893cd51f914697d2900344602bf02af73aa39

SHA256
7f45fa579797b05e3d03724d2d64c901f3c157f0fa2c99e780b6371a6f676d77

SHA512
5d5b65f8d3089462b821bc7df5f99fdbc4749aa744005871be04d013d696aaa5afc00c00001347346e4a46a8dabd212441b5f82fe83c2293b2c4ea4e76240830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
298b63a35db45c7766141a875788d9f6

SHA1
fee99f31fe84c9fab3ac1f9e89eaf32d5a3a5d36

SHA256
b28bd687806b036d1b6a85bc64e5ddf73e788291c5cd5dccfab979695bc449a0

SHA512
a494b72605fedeb8342c547584e4679a01adfbed123749c0d83563d06db5dfc0ed9c031e10521055fbf6aef9d21ecb64d35fb57aa0025d4b562559a4bc997dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4726df55e2f98cc132b9468dc188cdeb

SHA1
31d204040b39433905b15a63adc86be813ae3537

SHA256
14e007a5afd4b4a8be64881bb0558aa2e23c4c14f41f5d29274f964b627ac12f

SHA512
5c16b2f7a7066c9c7f1c5e813042d857a3072563801df73d2838e511bf3034fe1bf00665ce3ca0ce8184f55ba2dde6b3620f459ccaf58546e8e25ea8b0a572cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b427807d0627d4973b1d1c74dfc2339

SHA1
a4d69c7656f67e5e2174775b48a1209f3cb40000

SHA256
f81da58d9ca566c1eff1a502fdae4469cc087309135c80e4206a4a89701c1e85

SHA512
005bfe1751763115e81f7781cb99437a5248c245b646e3bc76ca84a4a47133f03adf6651d193a414583f3a50e601877986fe236dea9e21dd7c5b5dfa4d623f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95307fd364f794f2f7d5db454515da4e

SHA1
0374d56ae43e6add1a0cf41e00584d28c27e44b4

SHA256
d07d417a4c2f1ef4c23e6e1bb468c4984009fce42cae24dbe53ba6f5c0a973f3

SHA512
6869f1005c1a019d5f5105c977b632fa11bb9b15e0bb13dea51671ba213590d993b9ea336b0c06c276dae04cd5005e25dcb37946ec0c726a5973335cb2ca69bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCE86.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCFB3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD063.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit