e998a9a89e3b3d8164a6babc2b44c67c29761c2e495ec22ee55f964c484662c7

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9342f8746382a8db7e33ffa0f3992562_JaffaCakes118.html
Size

3KB
MD5

9342f8746382a8db7e33ffa0f3992562
SHA1

67d4ec15791496e459c90c6708658d81bf582b28
SHA256

e998a9a89e3b3d8164a6babc2b44c67c29761c2e495ec22ee55f964c484662c7
SHA512

0180628c6246137e499ca75ce429ed7910e32cfd7154c4a20184e17558fded27341bd21b0fbad30f60c0ee34b0efc80a23848f921342c1f6624b8d95edc33ec1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000001e90ddd3fcb1831be0a25ca48df1b103ab5c338437f510e61ce97de2ddf1b730000000000e8000000002000020000000b22988b6e36ceaa9510ea07416be8fdea914e83f092932cac065e697647ae45690000000702f870ae864bbde4a48678f292841db538f9f3227de1f603a00323abc1042b2b1bf278abcce8158022918013de9cf63ae79cc44fc6288e5f45c645dce5cc87170a3f5d2cf64f3c4df361ad6444e3c1cd5748b21f3821368f68da8b0fcf2e3a595c6ad85353285725543b2a5d6b73dfde3c37aea6fb60ee0c9afefaa7273df62ab1f9fc85040a62d7558b4567d844ee940000000b021bcc44259c4eb8c2b0135df2842909a03becf0d2b7b0aa703cab2e2799eb443d103de9adb51ed80409fb0524ee5dc73f6a1b0dfc7a0cd8a25465916af2e05	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C058B9A1-2210-11EF-A5E3-DA219DA76A91} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423625949"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c079ef941db6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000060f53af400f770942ce7a8fb1b067988bd26d9705674d43bfcebb9df92c00daf000000000e80000000020000200000009859c76f423ea67c0201364887c511cc04a2a64799856a30dafeac2801f0a58620000000876ed5a40b775f1962c8ae087a1cd0832bdfbeae21b461b2ba23fc293a738e9340000000e5bce5e21b9c3209699a17f4450938dfa840f724bc9c0ff96eb05b7c8a21feb00bdcc8773622d5d8359afa3db99ea872ed011a347c0d988f2cc9e68b2c44a238	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3028	2008	iexplore.exe	28
PID 2008 wrote to memory of 3028	2008	iexplore.exe	28
PID 2008 wrote to memory of 3028	2008	iexplore.exe	28
PID 2008 wrote to memory of 3028	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9342f8746382a8db7e33ffa0f3992562_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
917713c1c67204a0b9afe68178a192f7

SHA1
f62f7662be68897ee585d28931988a455abf48b8

SHA256
51be942dcac4fd83d491c768eaddda9e32677f7ee1fc8826d0644565a4f2a9b2

SHA512
678f1a18b0714bc7a2f66a1b62cd39fb1cc2b20b7e54ccd0758345fa21aa01ed99f0f1c71a8270c133e54d23baa07bbe02546d9d4b70287ee921e8e8b9f0ca40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67c7c55ad3c10ae3e2211bdfb184c61e

SHA1
b14e827a09f1c72602261f68585ba70b04e343f8

SHA256
85d5771b5bfa6f0541418a0784818a1edc9cc060ed78a3d429dab6ef9bec5534

SHA512
1b5b7d25c7b9a8efbdc67cbf0f2147afc85f5403797d04d494136bb81da6d45bf07ae0956af7ab4a2ce4b64b939b3820fafa788fa975d6821c34325a6cce2f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31c1ae25f8921722ee175b11a3ecacec

SHA1
a9f7e06df8f22688bd231dbc7ed2ed1a0a99ef56

SHA256
f086c3b7ceeed135c22d3e18f3a36da96cd14b91e2acc4176905ea15a268937a

SHA512
c09c3694e8bd3cb137a9cc113ed1e89c1af2510913707de5b40fe9ec89d6e514ed8369445b9708aaa5fefece95c0a1367a1d26ed2cbef9f1bc6f7735edca1aa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f4548a9d23e4ac2e02972d55d5c9b37

SHA1
0ef57055e9f12471676d3e29c30038f3445e3528

SHA256
a156f0df3fef6437dd3a1aaa87d8975f7693847dde6dcdd721b8691d33a271e4

SHA512
748b8eb03793e4c71904fb8d304363e6f03fd4ae124ae9dd85ae489dd4e1eb7d192b65a82740497dffcc59f62b0f67309483a4165db82d130c3bd4512f66c405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58edbbc732eeb62eb0c9a1d804471045

SHA1
65f4632c68898ec9a9dafa6541fb13a2a378fb28

SHA256
5ecf5b965fb7576de2257c5be2ab5e9239573b9033d12e24d6fed33557cef5ab

SHA512
c61779c8458ee9dc596da9126b3f0462b4abe5848ac281bdf5f85ec2cc6663ffeb0187ff66d622afb79f65ed35ebdd55c91b7aee2b6720201ccb36d59f2fae07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cd63402e9c0093b8b2729268c66442e

SHA1
7d7945772fb182345f92f7b3b8c2948b2f511f8f

SHA256
e4f06e01759efadafdb789fd38acd2e8119a9b47c03eb0ff8515a7e9892ec0ca

SHA512
942e2300b985e07c4dbfce650ab9b715c817797efb372e007bfdeed70c98afe0efce0fe83a630b23a0c9c5dbff570521a61b72baf3d7b16d7aa40dcd9630db80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
188fe3a4555c738d0228968c3f0e084e

SHA1
b956a77acf6c62fc09258b95b7aef951f5373972

SHA256
59db6a6b6ce6e6d0382d343452f4da4090d85132204ad2f04c956512ce88d438

SHA512
0be7a14fb28ff5ccb184c8eec01994a7a4f7d1ad6c2311477c56580a4524a1c2bbcf12412edb1e4ff4e0aacc1a90a4c2703961f8bc4e501de0cbfb161fd859c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
977d19b43dd10b6d251e62f288c1b399

SHA1
b1c45ab26380b5eb54b9067ce285296e8e783f56

SHA256
22d37a6df7c5ac27fcecda81c9639d6700527029958e9b8c5974019db516e961

SHA512
ca45ac6c35674b1ff4cb8a0cb663d03c5d6bf586ec8baa9e85201c5699c7c509fd0c83f2632cd6ba0c3647b5815ba554be710f489b12a405e8f560f4e95527b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
473146b14c206aa0672deec283b2656e

SHA1
a48f76c2442d6ac3e6b1bede9c6f8d42b989d604

SHA256
4fc717a0436ff3a140d7de47ced97d7012a71350dd7d4abfab74ca05ac244ed2

SHA512
b4cb515dd7e46e7c06154ef383eedc25daf0d08bc618f9e615b28ca8dea734a38bc6cdc24d0b0d4726c49c6a83112391a33418cee00372231d628f05f163ddf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c66009fdbdc04a5a3730a03fc52f144

SHA1
89d8a73d82706ae24f427e63589a9d778887c565

SHA256
8a0ac312fe98ae053f3dd11494d4c0124d85a3834821188f4a9017e8fb4d5539

SHA512
63ee9cece3a74791da820829160ef053d01b11211b59c31c68396be7a46c634045789b650ee49d366d81837dbc47725d2bfc0c0fd72511c192cab6478ad4de29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e4925ef1d9f7a8a4fd8d33b46b5ae5f

SHA1
381faa8e311b1e3183d16149da95751174ae33e3

SHA256
6b699658e76ae416c87a602dd1ca7793cbae559a64f71e9243134d52e025742d

SHA512
832f5bc95b6d04379091509236ca1e544c8226d1bd7e7f3570dcc5ef808ffdfb776ac1b12ff1c3138ca70f2eb526dc792ee70dfd182c77d81fb2bceda841e090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7564efedb246b4595bf9af43e1618bf

SHA1
56925bd1fe06ccbc501dcf347647b1d6884dbcde

SHA256
b2d219ca5b55007ff334d63e7825aa87e8782601169be4874eb65269128899ec

SHA512
648657558357522b8494025ac2f5b47cb284a0ef51c42bf291b9887a92ed29c0f154cfb5875ca77c2ec06c7ad6ab15dbe9a23656a973d2e6ba84afad154c227a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f1f715e543eaee228b168b470133c0d

SHA1
25f7fec99882140092c2a675d907d8e83b606365

SHA256
728f79d9ce6d99480988d98fa5dc61612a756fa45de786c04c3a8e1da81128eb

SHA512
56ce01e00d7f61648b1f7bc55da78dbda566b4105e098bd1f53d086d69e83692fc602525a160506d00276abedf05de2d1314fef1d879b832e41bfdcbfa1c5b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a45da0841ff8a266d6402a87dcf5d10a

SHA1
2560c8802f8b96cb7d9ba6b0fcbdf1260df2df58

SHA256
847338925d459fb6be74bc4bac894bf145b378bc648178b9c8f13fb76f6305fe

SHA512
9e18dff0b566bc8cf88a709f686607dbd3ff4005b54c9b421a90b5ac6c6cfa6f4b6184875ace953d14753d9c8f0952d01c342b8128c9f2980ffc5de376c65d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c19803b04456c94eb06acb32d50e4871

SHA1
2844ef8fa0eea9e12136307cfc6a1e3b203774b2

SHA256
488a6b07b27f37eea058ab461b1fd3b9e78eeee281ce56c4ab5f371e9fdc8c22

SHA512
3bc44cc37ab3ad570450c19b16bf5fd931687a3893a044f2d9528f296cb486696c3d8ca2ed4a475b2375d6387090ba0e4daeec7e0efc481098dac51558d6c9fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26E5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2792.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27B7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit