4b61a22811f54623e7fd9dab9265d3040c8a10a65b087fdd832bc9cee367eebf

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cffa226837db41c1b327141359a37e3_JaffaCakes118.html
Size

1KB
MD5

8cffa226837db41c1b327141359a37e3
SHA1

01745a0f2d04d408327aa88f362cb40f0734042b
SHA256

4b61a22811f54623e7fd9dab9265d3040c8a10a65b087fdd832bc9cee367eebf
SHA512

f29c50f16dbbcf534cd14810e42f98cf478d56d296fe39166660c03105dc75d55137eddef7729770bf6a44bd59765d535b628740f00a6d2d3af627b60b328cf7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000061082b61a669e747aba101ce87042c8b0000000002000000000010660000000100002000000011b2517e6d35af995eaf0ff1a20876eee00c5d81d68cb878d9a715bc433f9e46000000000e8000000002000020000000585c50d2208c8f057d596605006ce40af26f28a23ff178d5e70883f0d0540ada90000000d957d1c977616094679a067ba92edb7114194b1ef35d092054b5e28b56e22642f8ad56b39628b4d4c95c9ad38539bfed1f58796c94136405110aea3391437ff7db1b1244c61ab510f4b98f733fafc88e37ec07b14466a0d59770e1905d098296fcd82bfb53e92c83d9fcc9fd018f0afa8825d42321103f1e0072c3c91440c3743ecdb3d476e131996c6927ff0179f7ca40000000091566522bf963f5c249bb48566770b6d45aa781cc7e14265eb4b8b563633141c7f9eb2c70a8a457bc07bee965072e772d1647f1846d6d4ae33dfe3ded675a5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12866061-209F-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b69be7abb4da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423467175"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000061082b61a669e747aba101ce87042c8b00000000020000000000106600000001000020000000e4aeee4343a08d5833db0f7b1d3bd8f24f9656e7673e76eb3d55e9a2061d6c8e000000000e80000000020000200000002baffaa247adc8e19320f94b501edacb4342dd4adaca57e238a6f1deee774425200000007b3646f0846af16f0370e8454b95c927a89546d23cc76300985ae3252889aa8c40000000514ec2c27c4634a9e7014b17901af0872dbbf23c7b96a4dfce7e1e6cad7f1f77a7bc52573bb17ca51601f140d219083f5d20768e2dc5081194dcbb61c5143a7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2264	1936	iexplore.exe	28
PID 1936 wrote to memory of 2264	1936	iexplore.exe	28
PID 1936 wrote to memory of 2264	1936	iexplore.exe	28
PID 1936 wrote to memory of 2264	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8cffa226837db41c1b327141359a37e3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c0eebd5c1dd6576c4de3a52cd2d4e2e

SHA1
03161e8edc1dedfe637340d39c3252beffb81a25

SHA256
7f0f6ee41a1e27054211322369dd076a697df065a240aed6cceea46e913ef400

SHA512
b8458cc7d2fbb1d486ec87f80f7459dff255c41871f4871ae140c5af44841604cb88327be3ec7294fe3b10c16d99d917df36644d68e2a4d597732fd53dc42c8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6457cd7da240a14d8aa7cda4336811a8

SHA1
f53f554bcb730e797557641722a7a9cb4c22b66b

SHA256
c92cd79aecc71f3732cbb284284c75a25b4cf3124930895739dbe79d9dda3fd9

SHA512
444c0667fc60d9ca3194967f649f87120651fa7618f5a65e5cd2e13cdc92e56d58d56508fcf58c4a71c9e75207addbbd8bc9abb1f03601bd0c7d6bd6ea76a1df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68f78d688441caf769611275afa15c23

SHA1
8af34d2b77e9fe614cc64aae439cd4f24e9d8c34

SHA256
20acf2b976c731799337cc8318c6701aba120f1a2d7eb3e0acce8cb0c9a675fd

SHA512
b14e5bc123620c30719cfea09b9c7f0d51c5af6deab7b7c539e4aa89d383734c1000aa949e4c7411f535414ef115f88887d36be106b175a2e86ae58788b0b28d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbe478c18c82d60ee84268349db85212

SHA1
aa0dda8b6c16fe76cf5a69f6b4ed9077e12c73db

SHA256
36948350c886f0401f15a582b42330210267c8f3868b011f140e540090625950

SHA512
f6249c5fb79678218a5681198fbff59cd58c68cf02a404bb13ee11065aac507e6a848607df4c6b93962934b36e0b46ae129c4cde2b5abe0af4daafa0187c5378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7bec801bf8b373bad1702c42d9691f1

SHA1
6f02bf411d9cf79aa89ea4d6af23c8377cc6b03b

SHA256
8f13b9c5de4d1e6662bd3aab338d3f78783cee3939bfa8e243e5456dc6919810

SHA512
ecb89e4803bcef6a02b3ad14b079a7c782b627ee697760c9e89a59f9baca8f471cc5095ace4b426853d82b9366e43f5a0a2bf6a6dc2832ccfc49a437deea4288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eae83519fb3b532be36c5bab0a2f5c1b

SHA1
1e5b8d0718a70158bdece2279316005064e96391

SHA256
a834f1162d9937bec1c01d824506bbe4767dde22393621a5ff907a3640f28873

SHA512
ca1f3de618f3c591fb3309aa548c6335299a3f5119206d4c5b6341200d616c0c0db65670a77c6cd58fe2596fecba197f3b7d0b6ce31f30976f404f2f95daaa25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5022590076d2fdda6299a151fae5a7bf

SHA1
f06453a01527dabf6dad46a48406593addf5ecf9

SHA256
0fab914bef35180dea9e8cac0edb7ce6e7ad726d84ec671e377e7f3229f8c80e

SHA512
725779a8b1791b6f5e77d3b5aa4666afef93dc14752ad735eb747b578db6ef1c29878d827253c4c775c2eca184b54b09ce86e7a0c4afff04c9aff080bfe917de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1a5f8fd275b9182a920dd2d2cbbd308

SHA1
0e9509ed809dcdd9469d5fa0e29986a82518514e

SHA256
5bcb973b91a19f53f79e69f75a81393e0187ec49363148c61944b0592d681127

SHA512
7624a69192e17c45b3a99f555bb3b9f570d440a77284e01083a3b992b268c95f007b350b1ef106855834b8c2d8d5f6713c036288216a9ba24d65b13cb539e2cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23ae3c79503c155cbee79da362342906

SHA1
237c7f190372b6460c9b403610e5a03f80b7e61e

SHA256
81fabe4fad573aa1e3d0de63dbe399949acf64035988f90a30bc9c6076864f8c

SHA512
0fde16585bf3f881f8b94dea840df1f07cb71eab1f756bfbb9710adb9348a0ce7ba837845eb360ada5aad4d6d7b9ea7f928680afa248640a913dec9c6885c0eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6352ea2ca24b4f121ea03bb91a04606

SHA1
3c39efc10623f2ef283552ab64ac852e2a83a29a

SHA256
27c8f3bff7facea946f40d8b0fe8ed1acd4aff50603212350e693f9044629b80

SHA512
9aa1cd6d6c54e08f66ed46ed5e67fe6dee8dd28151a0b636644e600eb3fbe1bc95efaa97691e200c194e9c5f9814f80754022b39d1c36d9ae66124df613be163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2ef4076744589add35c33ebac0ae528

SHA1
1f8ca71b7298e249f65568ce2674a660517bf715

SHA256
ff214c804303f9b0b05d1b5a40e4dc8e48a33103834d437f5ca611e4ae35acf5

SHA512
1415cc6abf311d52a7dc836e5fa37cfb24dbd71588adc589e33ec6b109a9bc6c6dff9cb6f9d6113ae89f12be3c53a1e8dc18a388bc6cd8e08c0979aa155f3360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e2dd09648f9cbd3baa32181d06c8808

SHA1
8f871012daa97adc58e8f185b3fb04abfd1db49a

SHA256
77202ffb814b358203c27cbb3992afa6a2c59aeef6dee480a5e88dc4187805e1

SHA512
e8130cdea07243a2d4d929575363d1e87f324a2b2c36afc890bcdd488bf256fc3eb0b044ff0537e90359bb8c54754b684ec6263e79e219c4df623b6adea517a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7badd06fe1054ab47fdd2217b7f5104e

SHA1
bea44b0c325a65f94f5deb956c3707c8f9dddc9e

SHA256
2c351944c29e876e6edd8bdcb14404627cad111b578f2aafc504a60cad86f53d

SHA512
6ed5ff46e74a33b6b817c534bca91a2555ab856bf9ccffe266f37efd5079343527827d2ad3a810118d6c5a546c240fcc985fc63880ef173843ea16cb8ef22880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80074aca7c1bf600ccfb52d330b12461

SHA1
ddb47ce4d90b1daed1cee7b61dde645e9b13c23d

SHA256
c2c0c1d0d5dd222ff5921a371130dd9223e5bb20822fbc49eabfc18e64f56abb

SHA512
a3d014f60ffae93c5aef0adb55cf3ec5fc49dbd07b94b7fb14c0fcbcf65a65b2e99c0346a78889c824e23fb6e04bba205ce6e8b44d28d3244c52e8d6193c0b2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a8c30a8536833af81dafdef1258347c

SHA1
5da53394a00df36dd7c47d42df5aea475fd42383

SHA256
14de1f5658dd5c1cd80509ced8ca6c1cc6e20b839b7eee572d6283a04d9883d2

SHA512
79053bd07f0a141c019741dd4f66a591f9c288cbdd79561b307fd145c99a66402fb980ddf4266ef1aca8599f323b8d065a5b5f3a623b568dea65a411aa110ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b9255f6f317b15c306cfcb910cd0671

SHA1
f4b15ac25c7bb007edd91788c8d6c7a755cf97f5

SHA256
64e66d7292c4debc9b1b6c20c7728c908d6665d07fac419a61215024c8022d4e

SHA512
419c3f3f5c92b52f27db417d4bba785dd1e04fe2fc2a7dbcbc415ab4814695e509de380ef91ec5652fb5ff86c2f2e5ed4d222dde12f86b62ce9bcba76fe50b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9BC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9F0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit