90a1df83950715f364556a71ece080ae0a457614520e2b3e33bc35dad0dc9417

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

991ada56a7f427e47f83ebea7ff06fa0_JaffaCakes118.html
Size

3KB
MD5

991ada56a7f427e47f83ebea7ff06fa0
SHA1

074b8624a5bf7c92f3c334fe533bd1cc05f42b7b
SHA256

90a1df83950715f364556a71ece080ae0a457614520e2b3e33bc35dad0dc9417
SHA512

414b4c45423280254b1882515b1fc4323ca9080ce808c3b51145ab56a8ed3a65de26236028f0e0f4a274c1fc610aade661b4819e2c8db0afd1728951318f6b03

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFF34351-2376-11EF-965F-FA9381F5F0AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d133997a84984913238dfa17da7b15e7220aaa148419697740d560087f7e9898000000000e8000000002000020000000ba8051e518a1ad8197973217657ac37cc0b97865e04a6bcc9b403246c4654f5d20000000932190a56526e52a5f224fc69ae110a5a583d59f92882bfe02ba5c36cea2d17a40000000416037dcf7d47989076a87d2dc378fc5dc9feb2009302decc8e92505f857e69ba94d833335617ccc9dbf63156b982aa27983006a722c7e9b9278021739e56305	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807533a683b7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008223ce175e86f1285af2aaf37332ad481bf6a78da4f54d11721a1b1db9f191da000000000e800000000200002000000098c828d859617dbbf8a31081fd203887939b3d2912a74be65ab52cae7ed0d7ab9000000061899ce4ac6600f2caf8c33ce6637993926c45ec8e497bedcc3870f059ff5e8ca90f38d99bd99343fb05141063e1431686ffdacddf9f4649ccbf7a780acd8ce1f02bc6fe9275316d2faba8166a5ec42ff4ca668eef34caefd1d31c9bb48c18591db41905e765358aa2dc31fac789b8a5ba2659a136c5d103b16e66183f2e94547f341af7367a6beae3cdc029a6cbf4bb4000000039bdd07b3d86806f538a4666d13bdf5f7d4909ad631a76a901d0bcedf4dacfadc49abd7097fe8fe89918fa2c1314ebad9ef68892f45d21809ee3215316571357	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423779734"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1444	iexplore.exe
1444	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1720	1444	iexplore.exe	28
PID 1444 wrote to memory of 1720	1444	iexplore.exe	28
PID 1444 wrote to memory of 1720	1444	iexplore.exe	28
PID 1444 wrote to memory of 1720	1444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\991ada56a7f427e47f83ebea7ff06fa0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
438ef786637582d2376075a0749db654

SHA1
d254b5cec2fb1aa30e04439dbd2fc38fc51681a9

SHA256
c5d6321aa95c0adb3ca638e486ef3d6279daa31057b24d66d12343997d795ad7

SHA512
097b32d48e3a3578956472b56afb43333f30e482899669a088a76dd5ff8d44ea6f10a1eaa37dff7ed93ef4aa9ab0aedf7012549acb4d736d4c6c0aaa156d3672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5c947e6fdc9dc24b036ef78969e56d5

SHA1
8e801cb0ece896065695280ba08ceb5dd9151f1b

SHA256
1a633e33baa67e967c4a3fc11e2c7c083e5879a7e30212d1820af5dccb9b9cc0

SHA512
a6924fcffd79d3c40de28622ae36eb5f2ec8556f9684d2709bd3a940621cb69042edee2ea55448b5f66629fa0600e36a5f487a4766770f41d457dc8b4b3e6ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65816cf7ad83cbbc22a659ede38dd6be

SHA1
e47405eaf5beb7d703a23e369d537f5ce0b06087

SHA256
c61561b3c876e1ea2367367bfa34e6f19bc36733b0708907fdc4d15694601f46

SHA512
cb4e6e3c9fb34115e2f88b81d8e4267a013cd4a8471e3348975b1c05f3d9e5f6eb87663ede8f2ec51200bc02530b2b9ed535e63093b8c09fc76b8d82fc82d0eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ce8d0aeb70549a75179eca0830d0d2a

SHA1
15ac410133c71548ee3d6b21189c371090c09219

SHA256
73bd6373a225ea52eb3a50cd2299eb6096ad66a1cedf4195002d9277818c21ae

SHA512
993c27da60adf537823156ad996bb2a7fa6d06b32f76967fedec36cc4bd59e08d74d2ea5029ebcbe0354b59ff1a340f6b022cb4bc5649ba115cc61ab03db50b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
062a4e2157d6fac910a5b6867c27f133

SHA1
e9eb3ae240d99387ae24625b91bd5dd58514d8eb

SHA256
fba3b1ac64b40b698780c29c6c9017c6301a4b5fe68967818d60ae1ef30f645c

SHA512
e37bb5e3685cf6b89568a06eca6f3c6771d757611667859dfe7d2865b265990a7efd589cacad822272c36a0592bef4f2f205ddae37092bfcde72ad0521d80a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58de8a4d9fb9be30e1c142dede3cb408

SHA1
72cc2c8f8a44f150e28934340f461468a4c42721

SHA256
ba14531388aeb753f999431172c62c5a158dc3711eb710f43797bc3640619c0b

SHA512
f112b3d9b3893849bdb2b5fcf915d61fef13d34f417114908dc4d2ecc9baf4ac6470a3b72c7279bcb1350edcc932656d0a8fcb00fefc0ce2f45bf3e2784ee9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7684bd2f34052d7aed2171500ad96a7e

SHA1
dbb21761a7efd96716b16341e78dd6dfe6e51ac4

SHA256
21cb75bd4c33c25eb7336e1165d12435dcc74322f731fb013b86d72c1b1f581b

SHA512
3113bc762466d0b443ea2ff8d3da18b9eb53b2a2071c1e7491e310451570df005b4cca9277a80fe39ee2a18c7dcfbb54a86a61e7afbc468e0de9804a884d8517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b09eb6d282c16faeb5d31b3b379269c

SHA1
7f2cc97295e49b88eff4d22acc6acb9395a1acdb

SHA256
56ff89e6760889808bec73e7a62acf99c76ba75fab3defb870cd4cfb6c9f0934

SHA512
e457e1ab9b39c9a7ee881c3c878f2e3069984df8833ed8b0f905745209b65d68fbda629ea07744a690d1621ce4d715e253c2e9e2aecf9d6572a42c899f51d1dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f4d328c08b78ccb0e5a2be614e2a1ec

SHA1
60835c26fc02cad25934142cf2391e72758d8668

SHA256
52b5778ac3dcfdf5b144e8b9ab77ba5d135a294beb4136546498a078112f84eb

SHA512
c464e11a2bc4171d9fc81924b7b48e08f9a1aabe4b335eb6a936a206486a74f8e44d3916ab0ebcdbc1d08bd6b7eed1c20c4850cb506723d17060d171f579645d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E90.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F62.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit