493e412864f27067aee09eb9853537c5e8142c3f74a72d0c209b56566621c453

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

929637b4dda31b7d6e13657875219879_JaffaCakes118.html
Size

944B
MD5

929637b4dda31b7d6e13657875219879
SHA1

6d090e978fc37a51585a6c7a322e81fc79d31644
SHA256

493e412864f27067aee09eb9853537c5e8142c3f74a72d0c209b56566621c453
SHA512

6f394fc4a09c0a537a8fea6b4e16eaf4398dcfc0614c99939f0915659b3ca0d0b3b0d1de8e4acf50bcaf373d9d906e9ddb4e51c88df019fcc6821f4fa8e6bf19

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423597116"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000ddae9cf276d35488829e9ab8f53a8300000000002000000000010660000000100002000000000812dc66cfa8379d20f9daa3d54b668a1bbecc64e38a0c7247beb5ebcc3da02000000000e8000000002000020000000eebf4c2d1eb20888b7177f69edb9d82063795ffb3d0fb150026695cacee5ff892000000050d45b144d8c9ca39f03899289858a1fd54aac012821357b2e7aa6d017a02f95400000001db40a6bcc0d188f1c79e3bd50382aed2fd9cb8f6609c3b4aa5cb16d0677aa5c8d82e0b17f631e95f7a8f5efacd7fcf126bdc57467c759e7f2881fe6e65dee25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CA2EC31-21CD-11EF-B671-4AE872E97954} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b38271dab5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000ddae9cf276d35488829e9ab8f53a83000000000020000000000106600000001000020000000bce0f2c2a9bad35f03df4611d9885ef767a5476796a99828a9f8b003cf50bdcd000000000e800000000200002000000043dd3511b0c6bbfa6d62ae7ab39104a9f6a278952f89d8f2cf2653f9a3cb8ceb90000000cbd110debb84e52f8382cd49efca95497d2a329fc205d98c06f299040a8014543a8cfb3fceb049b5abeed43c50062d1dbb3e2c1cd40646825b3ac2fc0bdf674f1c46eeed2c058c1683190ee7037ba2e39b8ebc8ecbcffd7b6f236deedb7477e63c1fff5c34acb142395e32741c45050fa18ac61dcd549ea79838f868d9bc1064bfbce0fac0db1aa6ac8bc371174fd81940000000c6c88272d2d0d055e1618b8c07b4b1e3b8e5d5b588736d188d21612cd53b52646a95d97bd9641dc7649644325af9c5e66570f92871e2650d4c52b0c01b1e20a1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2884	2612	iexplore.exe	28
PID 2612 wrote to memory of 2884	2612	iexplore.exe	28
PID 2612 wrote to memory of 2884	2612	iexplore.exe	28
PID 2612 wrote to memory of 2884	2612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\929637b4dda31b7d6e13657875219879_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a769e04b9993b13deceb4e64aa00a290

SHA1
d9030263d5907db38536c9b527698b08879f2da3

SHA256
4aef893ef9ae7f2a3dcb29239466a1dce792ccd3bf20cce40567efbbcb32fbe1

SHA512
074891d5aca9513a2e230e3c8d4a7eb0939e7024fdd0ebecebd35b75add45eb9061ff912c13c507d6bfa2baec9cc99b5c761a3ed362443511ff4c0cacb5c5579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a95378b66aa87ec5247c7f9f12d95e2

SHA1
8357d335c12aebf56f0de48f756a7e8cf637312f

SHA256
3339529f6eed1a44aba34ed64fb4ca45ef970335bc2ee3f00932d03869775993

SHA512
9467daa9848a2bc40995b72c29398ec05b990936317bbd1f9fa416dcb3db7b03c72dd966e9d17bd8f13129cfb5bdcbb9fa84500e72b928aa673557392bba715a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ac3c3e8fbfb29b220a59525dd68c6ca

SHA1
70c85a71626d26abf46307b7137bfda9dabb359d

SHA256
0040f16e6a3003b66a8e09d74edd3877953fa038a692f144edf8b88605f281a8

SHA512
589617aaac053a1db82021dd2dae4c8cf84b863cf5ef89c8ada086b086fa1e2c8a5cc05c105b46c7a9f5063cfe8e5cc95ce22768beaccb405be64b4d6305f449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3bdf2d6605d5995de966e2ff5d3f8bb

SHA1
68c65e33d8440613800e288eff6f88d17d8941d1

SHA256
196b0c93034b1f9d6c28842335c710f1be2122b0f5c27c5e0ea7b7e02645bb0d

SHA512
183db47b41d6c72d0f4dc149d82f95dd203024c75cd678fa4c6a19afa8012cadaa3946b35477b5072c870d4241c246a69dde24a4275743ad3d8074a572c4eb36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa7ebc9e34e95bf52fe541bc80f1d24

SHA1
11908457ede55fa785546846ffd9589cba9e39a3

SHA256
6f7fbf000ada8352bbf57d31878ce6b913d809b787665d0ddc469614b0a38082

SHA512
67709cf529eda6d775fcaa8da160b9a1f7447dda179fb37868a0537ef212958204ef219fa61962bb37cb8c299d2106c7da4558d891104ad9aee7ba48b2f90995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45b4934f3220b1246a366fb77db86596

SHA1
578e02f55e0d6143e29b759c47ea5b62e96b9c22

SHA256
9859139ab574b4cffa542052143afbefdbbd10118b50cba9f22c9c26ed04adac

SHA512
3316662d667adc45f3ecc1d42018dab08607d88be62feb61233af35aee273de56ae40b64b29b7d6389ffa1eb6232ed3b639784eed11dd75fb6bd6f09d31e4126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc58001449d7b4a84de9a53a0ea6aa68

SHA1
66536691b48b5079cf11d77ba0a627d183ba8bf2

SHA256
2029e7c769436dc48b0637db210e164dd6767cf6f98a1262ae5b0dc7bf93325c

SHA512
eada35ebfd9a7e695de611b0d892996c53b0132086a6cfb17a5fc1b4d21abb2852fe3a7901687fbd4476f068ef5513df4626cfd07dae30a3cde12e3a2bf6336b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c49a8165df94bd16a30d27d916706ab

SHA1
0718797c117e5c6cd9b807fb76c4389239efb153

SHA256
addbbba22fe3e158a20e71130fca30049fec1dfb7666eabbab1e18307c00c65a

SHA512
03d298049a9780a866a711e557b64c0bedd329c441096bc4ddd273efa7f416f88feded30d73ddc60f6f8f0997f40274d1ac6bdc31cfa6918081979eb52938709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bec75e74f41523e7b5979cc8157da13

SHA1
908a5a0be8dfdecf80841ffa87e65ad352677bf7

SHA256
6de352fabc775c0e877863b3e7efaefe732d28c5bcb71fbb3d7402eb4f8189ad

SHA512
fb24b18179cbea51198fea484db5691297ec1cd3b0aea4a003e2471192d2dde0b4f7b2727dcf5e6e6342e17b24ce61de9f8dea60adf5a0c74779734d5904a97f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6e2dbaf88a49170f1e63884d3d95403

SHA1
9d856d91698ccbc0103783011f514ec0d7d9e236

SHA256
8eb9e73f48484efba6476dcee64cad959165b2e917ddbd5d3a7b76bdd4ee70f9

SHA512
9aae5485d9ac8dd5c83c71fc40868f298677e69b5320e4ec3d53aeaaa829ccef74a275fe3ba295e5e1939df721c48e0cc266332c91e7550d20b01c4782e26d36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94519497c3890ddaf1f03033581d1737

SHA1
50b9b4f19f8ae2a53633e3fbedc1f7577d84a3ed

SHA256
81c4a883fb7e9951e1652862bbd329576181fa58c97f27885388615b105d1479

SHA512
fc5ef4a53e723f6217b8d8ef5c4217bd391dce18e59075ff1e3ace67a49638f0eced57b3bc80573ed74aa458d80588321bde353b7066527362fdbbccc56fa8a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19af9f1a65d2721148c6d19eab723e01

SHA1
1b83a498fa683a8bd21b78c29745fcb1f4f0b207

SHA256
b876140a9feb20fe1dc98455dcc9ac5d3aeef5c9b9c7f8a5a58055b6ad04a0db

SHA512
44d5b574dccb24e4cd53dfa9e6f12ae288a881cc59b9d049c5258bba1482b8b650cfb351c04a525d42a664a280d15f016a3cd8a18d8098bbf47eeee7483cc4a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dcd0fee8c061e2070550cec8fa6f751

SHA1
a5ea943ff945e90037dd0d27ccb55c7227fdbe4b

SHA256
30e7ecd4ea96b4e0febd4706fabbdee65d7ccd0622f51f4adcdfa4301419bf7f

SHA512
984e5950567d95d1fe5c124b37899a47cd1b1fbdb882751074912050885fa79331419bc0bca127d69fdaaa4d6d4792d2d846a807c64e8dd21fac0752713847e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fa7ba4535f35c4a514dcfed26b52b45

SHA1
19ee2ae3e1e89cadaa17e5e325765d60b298eed7

SHA256
cf67ec5d26a72e675071f70a4dce907f17c94918450db4cb1f4f99efc5065285

SHA512
0c2a52b5454dead843ccb4f411463b3ec208cbbf9d8747c575e7f90a6a045e96f7fbc10af9c88d905a68a6955165b017c89a78d071bb1e42e9e2ac356959feb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a3788f5c112aa27fe1c81029807f238

SHA1
141e963e2e2bd51a9ec365d3e3e8b466e5834c5c

SHA256
9d4af3959a031decb5652a2926a71df89342e2202074a530d30278c5f2dc5beb

SHA512
d858643696a193710598a8ff1f7699aa99799e45f61a1470326f5001be3a5fbe2f5d55e36ff08ca48dbe4f6db67e1f0014cc26d4d20904c12ff2feb5930af28b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB2E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC60.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit