375d96c546179ab6a44b9d258ef0296ffcde505bae92cf660f8e7cc0711c0c89

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a2cd6544fab50dc5f2160a9a488c743f_JaffaCakes118.html
Size

776B
MD5

a2cd6544fab50dc5f2160a9a488c743f
SHA1

b2da1163d4b41986cfc87c476357f475f8758cd4
SHA256

375d96c546179ab6a44b9d258ef0296ffcde505bae92cf660f8e7cc0711c0c89
SHA512

3a4dc213473e30399982356987072dd83a7778f148678d92524ef9239cad471baf8da5f7619ae73f4b98c3b260a3ebb4981d64f9cf5e6e1940db052445c7c009

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000004472b36183119b1cb25a5516948eb190214a8591931a575a49186d94db4bfc24000000000e800000000200002000000085a57b2a021e52541d4584d3c8d223f8057ef8ae311334cd31573482278da78b90000000a6d4fe7cb05ce754bf7593ae52395d0a9d845b8bea61d73105793c6eb7cc04e946997b1eba1fc764324493d06bcf928e0210c43b8f98b78eea10858a71666c97620aaca58db74cc57c4e13c8729192e7491d41b446b11acc41c5ddc319e6cb8281d7b493bac93b568dddf80daab6b65f5bdeb49544cdfd0a33ae50acbff47d5c3a7a4f05161413fbc5e80631fd0dc41640000000c20f54fb4f692a9abc7c74ae5146ae459d06b2ac8298ea5dbaa28140a6ceb5159322f4c9e6f4ce991220ff27acfb0527bac34769b300a41541b01e75507702ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424394726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000b1bdbd811d96184c03298a674dd42c4ca2d01c893d9134666641bf7eae04eeea000000000e800000000200002000000093b08a36599e84653190fd1c28b942154a0365be3e8704c3386ee8a056ee746420000000f674e58afd803e95abcb42212068b72e79c32b826d53c3bd10c955296c572be140000000be9488227a665633eedba6fca0927bfd8a14c1f49ea35b4d05100e48110a26dbf2d0f515f9c5bbec1a9535283343349b165d150c33100d5d7b20a8d0205a3f2e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6056af761bbdda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3279761-290E-11EF-9520-E681C831DA43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1872	2972	iexplore.exe	28
PID 2972 wrote to memory of 1872	2972	iexplore.exe	28
PID 2972 wrote to memory of 1872	2972	iexplore.exe	28
PID 2972 wrote to memory of 1872	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2cd6544fab50dc5f2160a9a488c743f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
250136a35e42e62e8985f86644442f9e

SHA1
b1bdcb18e7fed9272985c5769d8d79c22575f171

SHA256
d46971468c949aba1eddcc7c552be951970dde4c1b16cc82f7110f6466a720a6

SHA512
9c303fb8cf1bb049115427d33ec40fd8e677ce6972a61a1fb28c7d2acba07b11a550786e6177ca66e0d20327041763141507485439be56baf01232e1d943f67d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ac766d4260a95ae05fabcc7e4a00e67

SHA1
daaaf9812a6ae84df4208ef9e89138010af54c5f

SHA256
9d926a1ae6e0937aaeab5e99851035edc63a657f87b094ca726d4eefd055fba2

SHA512
77b9f568f9a03a86ceabc93f884ff03b506c843d4710fc92b665744db12043a592bbd2dbc65801a6bab31d4720db563a44db385c0d989ee9a8972dc45dbb431b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c523561951d54c14db496bad74b25179

SHA1
d9b3ee0f39ad66585596ac1e20a605f943be9de9

SHA256
9f2b347ec765b854d8d46dd5c35bc528c5b83e77b3f69a17febbd43db5e7c14a

SHA512
bb49ca4fc1aec9f2ac6a4c2469341f284ae02ae5581fd45aaf550e3f24ba9541490ef41932a931cf07d7a665b8294e6b893692e669fdd96137b2f085adf1e97b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
465084536925a8da4b8f93e5e2cd317c

SHA1
a1ea40a70261e1a826e3074fd04a871b0dd5f166

SHA256
f10226219b6540a0c47050f54a7345a4c730da7615ac92ddf4e3f8387f985919

SHA512
b779dc19b128092481e7d12ea3af3bac3b39f45eb62bfefefb8474d2d0edd02dd9cce0a72a6db90df883f3de7cab8b72ad9ac169c53687f5ac04c776f237537f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f280d99ac76815b63aa6a1337066cee1

SHA1
a938c257a6c0a5f69c6302398061a2eb33c0bf6a

SHA256
ed7c75b66b71b4da3a44dbba47caf60f10127f9af43416b5945992bd91199683

SHA512
45f7ed8dbb3fd35f07f58ae70028a2a3662f4cf20d6910bf7e1a2cf15370616ce72d6c20e86da07489e800e7a8b0810684e2e13636b6d804d5fd2f43758cbfbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fdfac1a0d0e8327b1b9badd9ac1d9ad

SHA1
ab1c408662c29ddea9b39c2efaf40884f28047bf

SHA256
bb7c4034f4eca18fcafaa307bacd1faf8afb99c252faa57ee5bcceaf323e465a

SHA512
e8ff781101054abf93163a49ee718df02be1147d78d496a6f52858a61383036fc8615773de78fce452112a6e8f28770dd88d48a2c96f71739f8a8b6d2452714f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f689ef5cd8be5e92f231faba4ff78de5

SHA1
340a65a77470fd5ff3a6fc8083dae946d1f0591b

SHA256
4d99f029fc117e5afdfaca7e4d76ff860b67f507d42c1be48e06599c68f98a84

SHA512
d6de8ae4d819c235835f21f1a15c7bf7f64744eba2bcd95e527d5de4c9691b885d325a6483107b576be2e7adab9e5d9b975d7b5055dd048dfc32f75adbddf6de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ef452360f68aeb11503e4f07decc5d4

SHA1
bad86f09caeb92c1c37c8e89f4d82db878f5fe0c

SHA256
9e415068fa8e2d5e54530d9570287b3361aa3c54fe3a15d7f156432801025642

SHA512
3aa361b2e7621c153549be6c04b3c47e49dddb53021dda60c74a45041660cd024bcfa0d6f28292a700267ac71108c52cb25b778cb602c62004abc677e72d0c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8cd7a0e1dff7d746e2dc0366419675a

SHA1
f58ab77ba37babd2d9aaf39be147dc5be514ae92

SHA256
8b8e0b47cafc889afd1f485f7b2f49dbca1dd09c241ab1d29b532ca00f929511

SHA512
78c16e64303919b29ad72682c57aab3d0a16f2381d6947b4a820d9306670d2826b375c75304a44fe98cee2a6aaff54a697ce9da0f01da616b4fa9400b73579b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1271cd2d7ed14b98b070ac85f0685f0d

SHA1
2ef25e208be9c19ef407d7a8c23ba23de99faa65

SHA256
dac19f504f414ae8e3b1cf9e2374d65bdf2f795a2ccfd8dbabee01c5e32bcaa0

SHA512
c7f6310960254935f0bd52a54352afcfcd0c30613887f182c58236acb872d84b79af1c01202dddb167d9f0d69932d1341343054b3e3a613b1b6cdc727c0773cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bcd5c000c0a72903cfa0727b076c7f1

SHA1
659ba9d3258ed2952827f9c4f54e730896a58fe1

SHA256
dced15ab400c81cac3f83ad8b4a5826d62e45d8b4f7713e6a4c768a9c5eb8f65

SHA512
b4cb7b57d8a6da4715cd6acbadcc30d7b24462e2bd9ab1b2afcf9153fce869edd6fafed2c14e903d4cb2855b3a65001f15bab07d6f696bb5b268ea67d80173a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c271d5db463f3b9b73ddfbe485cb7782

SHA1
66ba8438ee1dc3f0c8f98921bcb32aadbc1caae3

SHA256
2e494c660f9a6544a191c9f1116a31fadbfccba4e3f8f27abf5474dfaed727ff

SHA512
17d8675862d335ca20d33d269c7d426f9bf6996ce41909c0238a38f5dac05c6a2964fdcc0f51505c8f3803c01b255015a03714ec38b22691ce8f5da602644492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98f95f7d8695797eaf1bcde40be17c19

SHA1
0d5fa678f4c93f53e04bdea782e74422f6b2e59e

SHA256
2eadff0d210f2fd463f8d05bb687f299ccc935faf6104083226d0a53a7c77aa9

SHA512
cdfe6c049cde0102a93107b71e382b6eed6e7d2f200f3e69b4711875a5b33fa92533b7875cc0707fa13658a649918bdb781a8619e66d44798ecb65c8d4e91c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09fe7e2f5969591060165f52e3311f0c

SHA1
121ac24c598029d1f9d24608ff5067836255a83d

SHA256
c2f99e065ddd66b73346a8f549891e6f1b8f32ba1bec41bc83a8a6b70834386c

SHA512
0d3e76e0e222637365d6bea6952126d6114e2d3b5be7f2d07c8f0f580deae37d67dbba7c4b145bc8ebe50dd0beb6275e4c7ccb25af12ed47b47a2b0f53ef3e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaeb1a5790c8729ec2806ef04972c70a

SHA1
ef6189ccde0da0ef11c44ea9960a7fdaf6bc2226

SHA256
f106e9c794c964caa4dc9c0a66c65e703a59bba3f33d873cd1cfa760c8002795

SHA512
23f49e9ddfaea4aa9b8d7eec1ad9fe897c5df778d9cb07545cd5a8cd7496ca392749d31399907f0a421af10faee3a3ad96de1bdf2487cdc764189fdd980ad9e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf5d683e143be543f954c53918d334b6

SHA1
a6d240a8af1d6dc686792e78cf9b360ea626d62d

SHA256
9b534856693fc2fb1f066700f6a7a88088fc6c316c97da999257a31212d5f234

SHA512
fa7eed3b9b20be8dc97d74f497fd09b2837e4f5ce725099a302f11d4f26038a3c2938c79b701331db140e87efef2efa2c2d56d1c1b0471f3eab5913c7bde213d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4fb2a21cc7700531cb7407572885eb6

SHA1
1d94cde6162364e9a3b8f0ddabae281ed3071fc3

SHA256
1c880a76a7057285192507287ee910ec24253cfdc3bcab26621e161702046a12

SHA512
64669367684ff072bfd63f928518fc0f1f4d723da1839dcedc823907830d8fc28b4f1412df12cef220b2abf229d9c8acf113a5ca91e956a62cf999ce34870a3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38CD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar397E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit