f83392f51150c601e881dc6c5f01b8cc4c2b775a8b0b3080aebcf29c51508e14

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93ddcc5e3b6ab9d5cd2ac837d166f520_JaffaCakes118.html
Size

801B
MD5

93ddcc5e3b6ab9d5cd2ac837d166f520
SHA1

56104b8bd5a100088db72b85aa6dd796b07363e7
SHA256

f83392f51150c601e881dc6c5f01b8cc4c2b775a8b0b3080aebcf29c51508e14
SHA512

776c0fba8190899a7a7fad6cf40a6e7ee6e699d8e823c97fadd896a447188a253712d62850165d60c37182588f0d14523828ad7e7cdf7cd371be29f90cbdcae0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e7f13541df5ddd4b8b6dc89f1a0d9de700000000020000000000106600000001000020000000dc74e582acc3f14c5e785f63817aa7785a15fa2ee83567b82d02fb25de16ca68000000000e8000000002000020000000cf9c80db56e3c8e97a6351349baf3b4d5d24581dcab2dbac07403c1e9e0e445e20000000013befb5542bb9838fb8e8c5ee7f796529070d8733ab5aee4dd125a6f524af2540000000278b1c9b0fd7347e80e4561e19a42086762f329fe1ef47ef1fcb09c7c3923d140dc5bda345f4321bfe6937540c60c2bc300496a4690c0d97a550469889eca54e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e061856248b6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e7f13541df5ddd4b8b6dc89f1a0d9de700000000020000000000106600000001000020000000397f6a92e688ec7f9351eed120e8702d88fd4b136020f96cebaeabe79cd10252000000000e8000000002000020000000f4c5e8530de43005bda1f068bafd74678f0935e42caeac1638a1efa0639426bb900000006b20b252fe7bdb5b2d2cf5bbbb681c98e51e3444674ce8ba596c0aa934de7a8773aedcb448d9c9cdc51dd42662a6737d67a6b7948d870b2b05998408e81eadf9e5dbe4dab4b20ccb0deffbbe340787ef692f8267f908287c457fe71bdfd5115e017d80844f810c9c8b13fa358c4278c708b153b56634248af01f62e324c7a2666db34f919d7b666af106ea536ebbe6fd40000000f660a88ae9fdb2939c1d8804ce8867f7e45b6e8ff9633f15aa6456b0ed095c73446334c362546e521352e21d2b37332d71d9feaed1c6e440184c2fedf72f8da4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423644362"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E93F431-223B-11EF-A1FB-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2744	iexplore.exe
2744	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2500	2744	iexplore.exe	28
PID 2744 wrote to memory of 2500	2744	iexplore.exe	28
PID 2744 wrote to memory of 2500	2744	iexplore.exe	28
PID 2744 wrote to memory of 2500	2744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93ddcc5e3b6ab9d5cd2ac837d166f520_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12aa1413a7ccf783130805d41717a3f1

SHA1
93a540e390625d2a29df68b55d29a8e2754a07f6

SHA256
bb9e1ddc11080d92e051dadf718a8596e2bebde77d6746c9540543693c965a99

SHA512
62e8339e4209a69a00554336a0655f1811855482b6b76b4b35c6c5fb2bb1a6e914f0172958264074be39489c9fb179ece31065b852f3e94ba5333f92216c6c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8004cdda317bbf7bf691f38019cdc24b

SHA1
f69d116d4904ec50113551515bee7e69b810802a

SHA256
92dd2dade8bf8e3ef630ca6b3829fae63d876d54615ce0934828bc9e64616a78

SHA512
0b6e92b715cbb298989f80449d5f645374a42bd8ab84332879d0bae08a50bc8b742a860a767f714b2a76222a239d03aaf352df41b2839d94cadf69a3b4d89816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e62763d50f9b7796d421109bdce553e

SHA1
14c5b854a0fc99506570676566a08b2df67e2259

SHA256
1bf01233100fe04e625db080bdf3f66fcee67dd191195c4b50cdadfdda51a767

SHA512
b90a8953c5af4a661fc08504185aa0f6dc845c70ce59a88013760075c2da78b1b032c7335eb06c276a6f70d80c8b03ce1f249bb2e0a77ad327dcf154b63f413a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9becc3de3184018e22978926b3041f4f

SHA1
5bf6804697c2820a025982f3895fc46f6f38109a

SHA256
2e6da507320210c9c4046a665ecb435d66d42e68103d075509ef560a24f13c21

SHA512
5a271d0b1a8f9bea6cf6eab73c644dd12d77383498f568ffad8162c71127e29e6be534dcda823618c42d78f6c743bfd2e5970d8350a32f7e14a872a187b4da8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf4acc7ee31c54acf1563b3f18c50295

SHA1
0355b73b93f81bc825d57d5d3aff53190f72f525

SHA256
128a0084b81eee75da8cfd440007b54e35d44fc09a08952159c4380268778436

SHA512
273adee2686977d0b1bfea3026cba3549e06adb2666ac23518ee11f9fcf961170a1528e8144f5861e966f6009107de05ea89ba3b2214494c253d0dc187f56253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e00a4d126a694e74d2b189b478560b3

SHA1
df7e23afa6586dc743d73ab3ffa124c1fd99eb5e

SHA256
be61b473672ee90b59ec234bee1dcc1c497313ee5c05598817cb3f9580d49b76

SHA512
1c5426035afe67fca53f8cd973c4c03646b533944b48f6c0d984f4ddc0aa6eb4d78da05e9227ce823a35ae04ea146ee1130ba92604305c03befa86596ef57a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89fa85d671c65259a3e462b2b699627e

SHA1
ae2ca305ef13e4c49170da76e97d3b85218df884

SHA256
ee6587a88ebabf749e613fcf7d493ad650fcf1432f11e4578dafa1e98c53719e

SHA512
ca4adaabb6d00c4f61c2f1890f1730bb2377a049ada3e96af6b7d317eeaeadc0933d074e8ddb4690c132b48114e5f45840f4d3336526e7acca4a4112cdeddf84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce229991843cd2a87e53be59657fd72c

SHA1
81a161fe76d0fd0092910770e2ee7e1da91f5644

SHA256
2f8d5b6f7fe53c6c8c63a9a45922879af5ac9f32147bfd917c5efa618ba600ff

SHA512
e7495b87630d59b6e5f8ad82af2d06e5a93e3ab1150115b62cec86d3bc5a078cc0a32cb0463d01c821771fc9ff7602fcb3a9b15ff7ac47ccd25cae40ca32fef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a14ff47aba7401f11168994a159d345

SHA1
bdab0f786bb0b7028bed76d19862adac557a8c8f

SHA256
29be415fc907e73950390ffb78e7d0ed5e21388d4f0d502fe582ed18f7467b28

SHA512
31cd56287fabdd559a9724df25e7e696cce478204ce78a771f6796fa2f824495330f5c003336ed8e5f70b660dbdfdd4371e620b41a97aa744197d034c93898b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d4fbd192265217d70c5fcd977fddf1d

SHA1
fc413416e436fe85c9a70354415e9d30568e91bd

SHA256
8666de6730ab0d6d441f348eeb9d8019591878f78c96117726206762db81c9db

SHA512
46bf63cbcb7273dfb5e894dfe22f30fa9d7a9b59e648d440f882b194ffc5a86df8c81b7015dd726c39d3256422be252150fd5370f76e5c17ebf9f27131257a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff230fa3a484ce60e064fb7be92c5ede

SHA1
5ba09f02347c7a759bb0671752b84bda6c6c4ad1

SHA256
2c4be3d7aab68221f2b98057eb18cf347e4a2fb5f885f3b4e1e7adc88073ef02

SHA512
3a8c89327b9c2089cdacbeffd01683070da20d5c8fa093e5433ebb28a69c3c315314ff17c22177a7ab761a4b14ded3ea7068af40d0eea170cc5564b1c4092284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e106cafba3b9949ec94f717561dae52

SHA1
92905d420b9173f28d5593c519753db9da576353

SHA256
75de9c3d89a4980ec13ed9aca1047cec96c359b20c9470eb98c544a159397623

SHA512
b43ce1c92036856c6710cc50b7cb0b9bc82ecfcc9e7f7612cee8041be7c2810385590e2c9ed600b75b54a32a8d8db9713714603725b6cf2d829546a0fcd8d6d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fefa5fafe285793eb71e7b5cb2886d48

SHA1
2650dfd99aae47e41f750b979ee0a32872b10d27

SHA256
bf8435c26badfc2b1c21f8ff943c839bd209619e8f5b3c0cfd2d1d3f1fbcb72b

SHA512
8d83a19f69e1d2c0fb4dde0b83febdd09b924a0f58873606e4f2711d732e010714eb137d07c722bda6fdb58dad261bc049df92a4d52ee18b72b6135a6f20c7b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84ea7d124d7ccbb940c8086558132ea4

SHA1
8552b4f02784eace492a6c05a8734b55612e2bc5

SHA256
34038df0f375eb6c4360a0bd7a77c5f9debabe7f99c7df59956f7d8bb332801c

SHA512
a812e38ad1e1af15494175ad4294cd35dfc494b33cbdb95261015d6c8ddbc7e7af26f114d24a76e2807ef0ed540404e47ec8633c9a8f1e68a03043516b782fc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
091810afa350af86ebd6d6bea89d07d7

SHA1
3010e43d8b981d5e3aeb5510c187718689bfbc40

SHA256
b12d32dba774008ced4484799c13a86549232d60cce64d830d2d5cb18dd5248d

SHA512
e5a67632f72ce6f16e5619faa901cc9db4f2f030f4af5a6709b9dc6951b6a09a2c386de31a1beb4620458c3ce312061a12a179d948800315c376d4cd39adc0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d73121a02a1af2708a51a81253c411e3

SHA1
d2b8d38b097376a53529bfe02a269d074f0a0b35

SHA256
f4aabd1d935158c3c01eb9070c4690725f80016e3ac97d7d361482bf119231c9

SHA512
ebb5941ea314f42146f07e54cde688319a6a928ef585fe6d8b9e7efab32ba7d60d4056c16e34e48fcc939baf96d307339fda0348460f50be8e1f0c34a7f026a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbea9cb1cd01913d1ef261e98a64109e

SHA1
32557fbbc4f4f6ad1b3dc1ff06b8c27d6f9dec44

SHA256
87509abec216c5e480a1e0571dbb9a403b197c4c5f35d6c1dab194ef7be02074

SHA512
0e62a562f7afa839ce441b999f139e21393e5d225e531d8845ea3444d45d0eacedfabea02e71becff3ef3e0158473e15352092dbac8810465ea3943274ec3110

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8FF1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90C0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9105.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit