121834bac999b689b565c4b9258e27c93d4b8995b3dd6101d8dd02150bf03dc0

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f52a18cb8d161a256561d45898524b2_JaffaCakes118.html
Size

940B
MD5

9f52a18cb8d161a256561d45898524b2
SHA1

d5c64322dc4f03a7e918339e0496467b54dafa60
SHA256

121834bac999b689b565c4b9258e27c93d4b8995b3dd6101d8dd02150bf03dc0
SHA512

e6600618f1acfa2cfca4c91d9b988212ef218e38a9f50dd6bcc97f4b4cd3458c842414079f1aaba895f73dea2c010174e445724c8ff470365c9e613bbf108b99

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcef878aa199e64e9e871b6fd9b0b93700000000020000000000106600000001000020000000dbb0edad8b3732e68ff323def240074ce52a03225192b60012e43dc4a0eee861000000000e800000000200002000000065eeef9bd98f6fb2db8e822a5b4731779c0463f78f53de9fd04663abb41f261a90000000a834c7d9c9b7d452f12f9050797023a552c929fd9c1ea1c37fe0b0cbae48a778b0ba7a5a09e38f52ac8e38d0b8320743b3022509497983fa845e5762ac1bc4e1c4bec06f43b277f5c3e234f0e4bfe26b5392b34456f1cc93f67915a80fd1d2787ff4213f4473af61546793404ec0f841430458049bfd62cb2fca4ccdba519b5f8fb7683b5e0cb14df3df29727a492df1400000004a6b0a572ae9396f16df1a31e41aedf4dd64817de70053790d6d86540f2150d18163d62761088ce120f5054f74ad590bf6a49b8e9d5e47d9ae804d9d2662329a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CAFD751-282B-11EF-A3F8-62949D229D16} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcef878aa199e64e9e871b6fd9b0b937000000000200000000001066000000010000200000003cd08be7785789b3ffb8b4113a161f758abec5ba3a36b3e37d1cb7b76b3193b9000000000e8000000002000020000000bb6ba2b7395eb412b94ffa90f2c8dbbdc563a31d6412b9d7c9790d15d5dc2a9120000000662e2d18faaf1641c5d2319d32ebf7d72b1504263633d8c502664b28a578779740000000a8b45d36fcd318c83d32c3961cf24f963f21e0e2a728f9bb0ad3d358651ce659e8fe7a60f746d7fed7839e1486a1aad2ca7bcfafc9dd28b2e4b8669cc3459ba9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424296951"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309042e137bcda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2888	1976	iexplore.exe	28
PID 1976 wrote to memory of 2888	1976	iexplore.exe	28
PID 1976 wrote to memory of 2888	1976	iexplore.exe	28
PID 1976 wrote to memory of 2888	1976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f52a18cb8d161a256561d45898524b2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00bb1b6ec86b021abf4cde1d77c0dc6b

SHA1
aeaed785ff6f5cc138a8f54a7157cbeb7db6c8ec

SHA256
adb809b24fa7b722cfbb5d16c7d82cb392aae0537f02745ba8a08a7c710ec847

SHA512
04d4819e676d1edc678e770409d4a6b42c6674ac08c8f14bd787502deaf599b92a5f882cfca25dc386f783dafd129b3f32a4b5a8a66e475bb8a21447b86c340b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa046a4ea863634ce783a165cac83444

SHA1
ac00ed3aea4bcc10f34894f045dfca18cbeb31fe

SHA256
d2bc67552db636111ef8250c81f29939ec734635057d044ac5fc4386e37a0536

SHA512
7fa0c47d547cfd6863caa32f0aaf0ba08af6444a9a9ccfa565d54f82c373578c9339d468cbda9757e8c862399ac462ecb3c2ae254aaf4ba0f4a02003c8968142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
794bc1690173823fe5a4ffe1f09f5c98

SHA1
218c8af2b8720158411710f2a57cf73b011420c5

SHA256
a3b7ffcdbc7c64996431a4fe29e9b2d1af830c9a4d467ca1e27bc59ed2c4c0dd

SHA512
b2e47a0cd81d47893825f3a310a7f9ccb4c28aa342074ca3b562e04f98ffa14ab50bdc0c5b0c08a2282d12562c40027ff738a2e0eb41aa1c31af29271864558d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82b06496a4e4e66e1d3411513ce2f56f

SHA1
a3d8fd7ff225ac9fb246cf65feb57fdfcd281397

SHA256
7dffd12e346b2de9afb0a319d6c043d1100b3e7df91cd9d064d0c8e0a41fe038

SHA512
d2467421b694226f6f95f46bcbca57c33a004a0db33dc4775893c02fed6fd1bca66bacd6cc3a59af30bab409133a2fb64c2faa8254c00fb76872de515c9075fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a6dd11e0f24a0383835829ca86aa9b6

SHA1
3d5203855d6eda77c2ca7766265732f73da48856

SHA256
9d731d29a86c84d601fb781e07c119c91de823faebd71d0a1525268b7bc6e8d2

SHA512
fe772a55554912315fd4a7877d8f23eea03d2daa291438db5daf6bba0e1089b50a3ca3704da8fc6e784355f9c6ba270298693e0b4c049a760c1271927e898c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e45e96aa3b13c07c7ba2395204f59b3

SHA1
857d4f44ce3386d53aff54b73e11a747ec90197f

SHA256
8fc1a14d16371937cdecf57e6379d14562d8ec1a248d62e1dc4d57085629ee7c

SHA512
d271cb40c2fe3d6af9b2746497f18174c86b0102e1be4dd3d5924649c6615faf13df12d9bcdd801811cb588bb17e1ea8e4271ea453a44dcf2661003107684791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86d71066ad8b4a4e6b799a1c34591ea7

SHA1
33433090e4ec4c8e14687cb25fe9303ebfb63994

SHA256
17dbe7358bfb152506427b3d54d185635087944b6ac211e9f2e9dc26fe3fda7f

SHA512
b4b4531b10aa8aa0a998a421bc25f9dccbf4f6583c65c6ed5787d295201124a4048f2f1ccbbe023496d26f0ca91d683012f6b378fa1018262e4555643050b6d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8e3116be5830b7ce4de91103cd485c5

SHA1
f28626d51d0f9e53c405d9083fdd922693a147ed

SHA256
89ea6eda9aaba01b95da3e9f17793f93fae7792f412c5d90cba5090ea82b7afe

SHA512
ec0eccee1e185a5c86898feb053427f605b6c4e1052953caedcaaff31575272fdd7e9b10dfc2cde901600c5375011ec4ef03ee01d1db84f184578b3c8d86d57e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a072cd95e7a098dfc4f99c0056f2b8a

SHA1
002b7425e3f0bac31fbcae839e56cc53b6f75c09

SHA256
5dd87b60db9885b019627c35d365103678413c580f611f2e97d95b4ab3cce4aa

SHA512
fd8047b8db3c85e7bfd162d2eb80fb5084f959e4b4b12f9d183f1cd8db0dd4a71067618cbf913580de21be855b2aeafdfbf36396a7d2ea1eddfe54bc980252ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9ea101c149024c4cbd6b1f52a3581f2

SHA1
4432f578c0a8d5f9046d6fb1b85b6ce7326775c4

SHA256
d4f55d60a50abb941d7684f28e5c8a8cec2f7f7908c5f92224d6bc8282146b99

SHA512
7ba05310cc4bf0b801b8d5ccfa9482872b7e9e79de43baa26b42cd033e46bb694592bd5675c86f5811c07a3fadc7614bda33c7830bce81b84b71cb7336a92f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c25457e64b9513fe635279d874ef516f

SHA1
155bb4a97225f816cb143fcfb76df68fef9286cd

SHA256
67a59522fa474abeceddd2a80226298d3a1a578b6f8b2c8f77972226d99cd371

SHA512
4d4beee17de13355f466c235bfd5d270563008fbb43741c37edc8df6dbd3a57fa762d6c9fa2e5980c8f093cdd1c40f1415b626654c68ad5409b576d079e00c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8daa144dfa00b4dd2602814a67a0db77

SHA1
edaeea38102b8b2bf194a430b0f58fa8cdb9a618

SHA256
ee845121e2a5853433da81f0a3aa5743b87a0700f2ff536f06dfda0fc30b7486

SHA512
449c0270e6ee668f5867dbd95a85dc6b261d4692b5d22f4ab76bf1c3fa767ed11cdfc66a4990b62588231f905f70d5cd389fe4ae7e0df73c4a515f4c463b2cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f0d19412dc083973ce1922680dbb5de

SHA1
d251cfce1082230a59ed6d1eec9e3907590954d2

SHA256
ff981d729325175511458d241577e03555d06d134c3a37f0da73eeb27dd5e6aa

SHA512
0d78a2035168692b4f1b6b61a24f657a7f78acb955ead1a991bc802ac08bb7ad3c51477129f362698458a6911a5b0a196498842ec613f16f495215b879ca7ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b2dfee077dcc3a64405fef3180a5a89

SHA1
ca2b633fdf0348bacadd4739741e818763cac696

SHA256
9908efc8ed8f1f654fb71fbdba3f9efe0d867ee8dc004e3f2e7f475405ae1093

SHA512
77349c23db24ba7541081e22ea6c6c682066fd648b19cf9a09ed940e661aeae1c81093ea670dd733ae869debf255ee2283172c43d7d6ad29ef08948a1952606d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e2e83b4fbb77212cffa23bc29bdd4d0

SHA1
b21d70e318e3f5f3ff395c0b31a65f5f78b61de7

SHA256
2596fa117d7ad737d88498dc553de678ab5637f824e111e73df61656183775e3

SHA512
50c8f9935740634e6ba9438e4c3b918ee03a5d6c823784fa933a61e84a78bf7029f0da0afb29c7bc90e799459303a27592214ef395383822b53470e778b6372d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eef67ea721a9a878d85aa1574a025de

SHA1
8a3f09fd2e4dd77f3c1683da4302b7e5d985fdec

SHA256
3d1b194792ad4c3e09e97c2a8e2f3ce2c8903a6bb306a43767a56f4e2f866984

SHA512
d8063e9c8f86353b9f76248b424403a236782bdbd06f6b7ec83a4f3318c6e29cbad2fb5776c1d4dbad8dc2c57badc59a3e117d23c0451c868a98aef0e1348914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bf2e23c4e8267b2653eeddcd45140ed

SHA1
f1e00cedd690827c3b2a53b068739209bff3178a

SHA256
2bd37b6d05ed9209f7afda753de65685871e868db8b60c19aea26c1630d6e349

SHA512
91ff77913bfd706832074e8ab45930270d1985eae4b8d8408221b9d931ebfb84736868d64b442b9e52aa45af2a2d2de46a1437326dc17c15050bf9ac13e1a1bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab174B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18D8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit