52d4ca723aac6252b28c862a374553ec8de6fb147ffbf5679939d005dfe67baa

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a71971a88d9a80c79580444a09e7b03c_JaffaCakes118.html
Size

3KB
MD5

a71971a88d9a80c79580444a09e7b03c
SHA1

f6c00e24a3f0ccda8384bdbe2380ea5da154462e
SHA256

52d4ca723aac6252b28c862a374553ec8de6fb147ffbf5679939d005dfe67baa
SHA512

2279e3101d61ffb30159af2c7ea7709a5dc3ca092b56022bf888dd018986b5b504b1793cbccf77b2f29e4b663d19405d616fc4d8b31b804b2e834b435e138126

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085b25a1413d5e94fa295c4e61155efc300000000020000000000106600000001000020000000241566b47d764d8ba6693ecc40236301fd7b9b05a9b2f7fae5492de82169b0a3000000000e80000000020000200000005168bbc5874f887eeb173899749ee3acb9d8604858d4d0a92d1112e4b9cb82b490000000706fd84567ce1e9e916a226439f7681cef33e14dc8808d1e28cc3692fe8e8a11160d8018a81ae6879ebeac15ed9f1868315dc08c9322777761bfcab20321c1bcad2741efbd820e91f901e2660c46178fa89702389ce077245e67d06750661f3a6d610dfbd9cf36989a9139f47d7b660a88076045941b1e41503fe30dd66537562bc6bef6f8fed0c3a1bc1d4879ed82ba400000008657db94e8cfb39845bb676fbc12820236f3910b538c9c49072c626b46021326eb08f5d5c4d1bd88230ce7c9fe4e82c053c4ade63b289482ab87ea7f265a45f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424483056"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BEC2FA1-29DC-11EF-BD3E-4EA2EAC189B7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085b25a1413d5e94fa295c4e61155efc300000000020000000000106600000001000020000000dace4ffc1938b1febf26a4c18c8be136b732e7edb3b0c0cc1e7392adba0a31a6000000000e800000000200002000000051d710f4b221e0df004e3f88ff0fab6ab17d256f4415d6f60194dbf84f99a25420000000a4eee80d0f61290f3e994fa2ac83881320910d34b60c6507d9a9eaa0bba7073940000000a0e2492b9a6f9118c748de7fe4ac8a07093008c00cb97a6c76025d110bbdc3b0c0a00eca1b7443e9814939ef7d9a7627e654e4f1af2768f031388e125551d0ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409e9a30e9bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2948	iexplore.exe
2948	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2708	2948	iexplore.exe	28
PID 2948 wrote to memory of 2708	2948	iexplore.exe	28
PID 2948 wrote to memory of 2708	2948	iexplore.exe	28
PID 2948 wrote to memory of 2708	2948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a71971a88d9a80c79580444a09e7b03c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b0582dc586d844015e4eca2fa17fc9d5

SHA1
89fb0cb688a605058ccd29e434d9fd47a9364ee3

SHA256
f941dce6746bb7d1f4e3ec5ccce5f45534200816b0a4215c453859d11724174f

SHA512
645e2acac114970f89368eacd9a6e6a9161c53d29c2d41b05055fa798ed12325efeab04fddfe8f941fcd1078366cf742dc37ce3858035285cf4d60c0e7cc6c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2ae92abb0d3a860b7492eb0210eef13

SHA1
6d42a9b5dad20789bfa68bd2b4926f3245bb5435

SHA256
3b676e05ef4341d007a73d881a29a96e472d8b33214f94181d1c1c5044b0d188

SHA512
7e884bf816578e39a1ca188a6cf483dd7a3eb446493caaec2a70f8c70e164209de9b0d41d09c27d685ac5933e798613cc6cc6ec571d2bc836bb26c711b28d954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
768c969f47d86d4643e88ea6f49add32

SHA1
5010a00d4912c3133a8b5bccd7b4233b88f07f94

SHA256
62a8395ece384f38c3a2ad14bdda4cb55bb3894bb334e4a13e7aa6df88cbaade

SHA512
556012bc1419db642e3c05e3127b4ecc7f0d2999d5c1a0abf9bdf3f85cf3ff4c2b50c89398af8e8f84751434da97c4e145d50c4b38e6f351c9e7f3bc335598aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31a37cc34f986cd82a7609ae2724c3f1

SHA1
7f7611dd7456a0ec910b52771098c7558f13657c

SHA256
140403b6e9b5eba3b79eebedd9119cde04154c07231b1ddd14232b32e2c2095c

SHA512
ff9da168ca8acc674ae5608be2f58222449aebae270dda9508b96e4d10ae9015f59bf2f12af0fd3a3043d10ded136a3a5dab906e67155bdeb0331dd214ffd673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca20075293b905b93fc5390e8b3b0004

SHA1
2b9f330a19d240840002792d2ec312c5ad2d2f26

SHA256
c9dd7d1891fbc372e999ea2be5d1a6fffe23e4a727a00f4119ac98e05dcb44ff

SHA512
384e939a4b3a01713bf17554aab78babbb8b6751a49b52673a9efac767a67e041563a94032d20676dbc1293ec283181cdc50947105619f257c734763238c8c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36dec91907d0a059e0e02f999c0c508d

SHA1
ae6955bf2636ee85a984765709ff3948c7e2123e

SHA256
cef37a6917489f416f08ea99ffaea877697aa7f04a2e03a3239b8b8b5fb8975e

SHA512
9110d84162f2f4505453dcbc1abef1e33f2e88e6207bad70a660d48c609562e0b96120dd407ef51ca59a486cb89648252baafd9358f89eb56ab819386efd593e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b25de7eef5ae9121ee1d62f7074ee41

SHA1
1b71c222528b0c09b398286e8728f03a26ff53fd

SHA256
69e40277ead70bf91f46809c6dc5b97fd26c4a603a97329ca0f0ddf0a4b14690

SHA512
0ea5ad79803abb851689b1cad9a55575765d758b20980bf0e39786a1ae7ff0cd60fc4e1d3af996674afc12b5ce54938a1ea2a6582078e77bda1acfbe3ac2051f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07504a6f4ddb836f76b2aa8c4a077933

SHA1
87b408b19d838e815ac3ccec4ba608c943eaaecf

SHA256
10a0e4fbb61475056b9bb83247eea1a5eb60e16694b93284a532f30953a0c9c6

SHA512
c04fb4ff392919809dc98c65dc5b23f3186c78055a033c3f1a941676aec2024500ffafc1b1f064965360ace6a05841b9e8146547a8cd8e2fb3dfe9511eb4fcf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70794209f328d30e963c6e1087d6dbf4

SHA1
8e78429bfb5ed7c35fff50fe342c372ea54fb14d

SHA256
4c3d523d310b065b4952f673890cb15568c9e67d1959328ea2c7c0db0bbec217

SHA512
41eacab69e5fc98aebc443cb2c9e482f66545a825e3a6e5035abb2f2fc6877fbd3eedddbaf3e568087bfc2b3327efa37231482f174a4be6ed133ec1bb2f2b154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7776527db813203f3cc086a923af048

SHA1
9ad08bad923cd80c543e11fa59021933ce6f13f3

SHA256
9de1c08c35aa322893ff8f1371207f329173cfc7f96ada6e292c383f82fc20d6

SHA512
a06699e67d178ccc9c77d1bf9a070f9d2fe43d5df76cf6cd690901eeeb004784cd69cc910c56fe8d9a1d6687dd1456cdba8d6d3d703c494607b88cb52be6ed93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ab0d698190624852e54753f5b413714

SHA1
f0f22df26cc435da3d88a77dea4956041173574d

SHA256
6a6029bf172eb13b0e8eeac273c4e945518e55072e842cb6e88868257d5e3cae

SHA512
7d92466b6a8d748a3b1aaaaa16da2832839728287d37da71b574a306b6915492d29aaff3494ca4a003fb71e847a571667e2dc1c4de157f149fc55aa54ed544dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
33d9128f9c712b384303d7b19ec7029b

SHA1
978a3ef322625c007b0af7641f5bbdadbbb2e7f7

SHA256
f4d435502484a4218d984fab8d04e260da388a42718d94c9b16e38f4657c6b47

SHA512
7c5be64becdd85bfd008f351039e0aa2817692f97721ac6e183655d43a0fe243c5866f39ecddb4bc1e13a0d185935b9d0878f7b9052558673a3b42b088321986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar83B7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit