ac06a8bb253a21f42d1cc4d9546d45fa3647f5877deb33f214e096670743614d

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1df489db16b6447950e172cbc675b58_JaffaCakes118.html
Size

669B
MD5

a1df489db16b6447950e172cbc675b58
SHA1

5a9ec316ce38fae4ecf4368ae5d1e97b3a05b6ce
SHA256

ac06a8bb253a21f42d1cc4d9546d45fa3647f5877deb33f214e096670743614d
SHA512

79f224698084413b1b4b77ee4a249e3959ab233ba088ca599a0896292df3b168314de668edcde2a6b5fb4ae5c712fe97fbb718bf01f92117df554bf11a964c3d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607fe1b9fabcda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a9da9675811a8e2ebc68dc6d238bd55b63daf3f7e44b9df51aa290cd5b4a4204000000000e80000000020000200000005d3c96363245b5f07cddf9a10a2aa9544ddf0f04b10cef784d014673298fa08c90000000f28695e8a7a87b41845ea8222e4aa21bdfb3c7dcb86fa602e468efef4d77a27da9329225a4514f9aeed2fac21de207c4e6974255b2dce6d11b85183befaa8de593a87940e41f6bd608c3f13e664a5c0ac1cfd28d6c3bdecd902495df3d82e28885ae853b5dbe80a221db9f32d43ecf43c69131921cafeccc56fdbfd9038a510aa24a8ed39594a23c2b5c2fc14e2cc5a040000000bb80ca6d99083ecdf8d71543eb7a5a34cfed311d8cea7c609d3e747ac2506aed3b0b8c643de507afb6cbc01dd2cc696e282479619ff66d3d2fbc8781811389b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c5a52cccf58ac97b0269efdc236aaa56f42ee99b134ea5fd005f027cf4331585000000000e80000000020000200000004da8669eff2d9acde7b4381a0afa2e24d3f5d68d6a9c4db355785a1cd410437c20000000eba28e2e50268732962e5f16ae06735f547c9657cdba9e1ef9bbaf9701bfbac9400000002a43466d7c31a56b17d0c8e8b743be2d8f20222bb477093f9160ac6731cff276739b97e7ef19fc4a828691a29ad06327054ab19c7082150f31a20c1b82833682	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424380637"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4C47841-28ED-11EF-B848-DEDD52EED8E0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2568	2072	iexplore.exe	28
PID 2072 wrote to memory of 2568	2072	iexplore.exe	28
PID 2072 wrote to memory of 2568	2072	iexplore.exe	28
PID 2072 wrote to memory of 2568	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1df489db16b6447950e172cbc675b58_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9adcfe2f726f0d435e16bc3e29023155

SHA1
a6da5c43f403991257b7fbd5b87fe67566f10a43

SHA256
3bfd4016b3a3a20b5660cfefd1283b165b5e372f5509b8c700a08098b645ae3a

SHA512
dd6c949c7a702308625fbd96e2158bc1dbc9b0afdfc54100b859d89d0cbbf96f3a0a6c8dcdbd77e646236b858faab7968b8c414972e58915a02c24418e6eb92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55062cb5b761fc85e4182eb3e239eeef

SHA1
fff47dd23ae12d51d89d0f0cc1b5628abeafefcb

SHA256
a8594e72f0b89d8ff93f7839a75f4d303658ced3fb6795e34e930a64e93ddcae

SHA512
9dd671af0831442fdeee0e266a09acf34ecd525127f2cc2f8fe9567c7b01022d491a473ebb9db9d5022939d37205e3af57e933e1f89314affd2e7b55096cc24b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e48a7ebdeb6faa6f533c7709524b483

SHA1
0999698cde16e9b8c129b06a1c9b3b2958453581

SHA256
6996d4d699932afe640003b0e56ced23a57ff0a8e8f9aca6222ac140ed3a9c13

SHA512
b0c384c65e07cd4e921d527742b14137dde25e52c5d780955acfd2221eab2cc235b4a35e053a3be4c3ff0b8c0b43da00b7102565b8e51db91020331430748fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b251d8bfe59b21a458a31b16b1ca029

SHA1
416dafb6574aa04fced6e576cbeaa1b27b8a75a2

SHA256
2f22836a7dea21c626a31d1c0642d2c20bc513f8ef2bcdc7112bcbe39b4ae2f8

SHA512
ad8e39bcdec46ef91f71d71711cb4d580771c66a33fe8fa0911920729dd1672a9c08cb47aa515834c46870537b061f9b4748fb3a14d482f65180496226370fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6703cf5a38df9febdda2bc6a16738e7d

SHA1
0ddb95c9beac0fe6df82f6a7522626fc08c57e32

SHA256
b15ea92670fb5a2b80b48318572fa4395e0f63fa61f5f6e6e0f65d5c1a1d4b34

SHA512
373febfbe371094463f19736cd32613f805c9c2af4a0955789f5b614224d11c331882bb0d77514d8138072d47bb6f83149d2eead89ac8c7e971d028fa53b7e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aeb5e26c3088403c19f377f5c3ef8f81

SHA1
01cdb04eaf2c04a4b885e3698cf05ea1f7b23f77

SHA256
fcfdfb3c43313e9555aaae80067980b348f8810eaae1da85dcf9e5af92578d4d

SHA512
4bf75acd89fc51ad73d91a3bc6e24c703da83ade7e41f9af35371b5b33b7b89d13f5b0b6ddd57d4956cdb7fd30b25015656ddd86640c44b9ccd22eeb283d2c33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4750f30b9d2e78bf9fc1b2133bebcf99

SHA1
0169aefc1deebe59476a4f586965198c2a88de95

SHA256
5756e8ffed67a764ac06fe1f2aa750f49c35c4da4049092897ee959d5366ee9d

SHA512
f39005c5098b56cb62b31b7743bc81a9ce585a878b627561de2579eb9b4336ce6ae078ee5c90c6b6a939e72135b690481a72832cdbfc0b81ac88e4bf41ecee70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6970e6dd604fe29b484cf6e9aa1765ef

SHA1
ff8172ebf1af6e9d595e4ef8b3661edc6f99208e

SHA256
984ec41b35f1b0bc75d236e861928c513b98d28f2ffb019be3fca12b5092928e

SHA512
268d26dac70cd5f31895702056f1411339b78a57cf02e94b4abb7c5393607709a06c0f1eadae0cdf48251dbc0300dcf8cc12723821c39c48c3e1ccd8ac46f552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85884927a0b71afaa9076db16bfd3fd3

SHA1
8a05c0e57652b8bb0cbfe59d6d1342c202f2014c

SHA256
234b5eb91816abb05de9256e98cdde18346763b2e094c3e73f0f95c977461158

SHA512
620c670c35e7fbf456fa8eb54999057e8d783c019c359f545219502cb8f5e7936d52b6da23c8760b8083610eb7c48a550edba331487b3b3e23f4c0d92fac1f1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67bf0f8089b4626f9826027f837c61cd

SHA1
18c5e4d0a1b5b59567d3d0edefc63ac2a4967409

SHA256
d85a1afa052c3b37c06c9e44cf421952b5b7c02a32e5ee8ffa3f409739c6c25f

SHA512
80fcf428b750abcad151c9960a8904e38790690bcf8c8911ca61925d1df1d5f094fbebf6e22b6b440f3a0780c37a7890812f362ff8e6204cc17a01c7ba6ec67a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d29077fd49ac3cfff8143f9964d4609f

SHA1
a207ad0f28101d4382fdb1710c3c97fc169287f0

SHA256
d9a13c3f4b71b9552ec46dbe24a4229ce68d847c28f02aa8945f3f0e4b757fa5

SHA512
ede48e64f8735a2257a6f99630bf3d0df704cd733fafc605cdf4196e7244e5eb07fd4ab6a2d3c9bc75ce703e493d9c424816b24d9d0c5fcea7fa6dda0fdc7d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07f857a92800bbebb0092c1ade11ecf1

SHA1
21c7ec4df62ac1d9b64927fe8adc660427a3ffd1

SHA256
021e276fa536cb9db953624ca09fb10b0dbcab8fbb28757fdd650ae5f9a7b85e

SHA512
98865f70ebc696222be9c0c4b5ea15e5cf7aaeae7d71ac59dac15d5467b8c3de97aadafbde745281ac43e68998db701771583dd21b9851a76f740d5e38a7abb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec5110fdc960698c113945bc22f49826

SHA1
cb6a4ca23b357ecaf8ae96115eddc5d645140f4e

SHA256
30babfa6175d4affe8aff2f2c79a8a4d9816542c4c7a427d3990f8c4ad22b676

SHA512
e46af257dbebcd36a1775c4113c0b9f5113f2cfa5ea08c87c77dadd6f27dc6de2846893e28dff0036e599d41eb60ca5ce872c643a686a22b248317a44980c25a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2a5c983df2b866ddc48fefa982b1b66

SHA1
b5f2dd79d4b4bf68c4ebf51b20d278313c50aa35

SHA256
0a5af3d0e013dcfb4fd51942de61066230566a6866c8d73368873e012619e705

SHA512
5082c67eb3834a8aa112f362f1eef87defcfa3f82fc53274512fc1aed078b244564f63ecde3a5cfaf189e00c8f6d2196eea843090899f89a6ac5a13195f0458e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f366f16bc54b4de008b56af2479ee1d4

SHA1
0a9f09070bfa6bf66b729e2e4fd33db52d170e2d

SHA256
eb7e75b517df4ef10008de5f9b62f9df2ed628245939ab7d28ae9c62ffafdf6b

SHA512
97fa1d82a295bb1d5e2b425be9dc3bb95fa5f288894ff9ad59ecc50b6efe5c6c95629d5dc08a5b5953373f14c28453101e15642d78f0b27b5aba9be35d2c0c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c15539b5ce8f90e28ba538a6ca9d532d

SHA1
9d7b9ff45a14b3254eb1797962667080f14f5cbb

SHA256
da275cecaac841228cabb7112c42c5e84797270a9ea241c4a9708b7e2cf7dad0

SHA512
276ec737242e1869b77deef87bf3a68d6991a1d39e15a95650b0fed7c980b09cbfb243c506c83e37a0afa1049faeaaa32333a4399d06bcc6fbf1acdf652b87e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92d461e5b6ae2d4b5e6e514552d6b99b

SHA1
4814e474336d6e472a5d151ecce9a748ab5bb9a7

SHA256
e423c582b267f65e293294b7609e63accad94dde2b6413bdf8ade51beaff52b9

SHA512
2c379f44416aca391881d342f316e29512dc001e553e0ae16619ddbb54849cab1d288b0b6265c37fd4de2f5238d89b3df5f35acad1e5f4c4159ff3e2de338dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77C1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7880.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit