becb1890f11953463b6dc3b7fc943eb57cd4e491f7e689256e17b3e7c43141bf

Analysis

max time kernel
139s
max time network
137s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7579050181f1009cc039f029d8f32b7_JaffaCakes118.html
Size

3KB
MD5

a7579050181f1009cc039f029d8f32b7
SHA1

c73a057fc1b5dba761e18212097db7f3edf7a569
SHA256

becb1890f11953463b6dc3b7fc943eb57cd4e491f7e689256e17b3e7c43141bf
SHA512

ea26f4aacaefa68a56b8882c74c6aef55b4495485fda79806060fc9ae7482b223cddf5ea163c5dfc40bd280d084e13901f6bae7d61919295b6df94a6d9277992

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301c9310f3bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000006541a3c30d0b0f18e0cad2276168f44d6af6c5107be496cc00078a43805d9ea2000000000e800000000200002000000079ae5906417ba9fa75520f022e24f840ded5af6ac4d3e10476f918a63a4b76cc90000000ecd94e67d43a29cce7a0942f9e378cf7bfcec49ace987d82ed0571aa6b541634dbb0b5ec6ca51212a0a172c951704c056803fde9de5ba1fada27bf1cd338219a7b80bbb979ef278db28084d77d89039bec1158a081c9db8ced10925f42a72005c4ff4b6970d0d54e87ace0eff8e7e4b6edeb901721fb7c3bb27a55baf944931576da2c80b757417b21b37c218b0e470b4000000011788048302d37ca0a614548027695864168b20d18493751786d6849d36e80a34aa17f5e87ce7bfa56334d758ef74bc6d90ef95da5da8414eba91a42c3bd488a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B176AB1-29E6-11EF-BE23-DE271FC37611} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a365ddecfe42111100552629ff18da64a416bb4fa3f16581d02108ba847cfa72000000000e8000000002000020000000d4777b24d749bf80b979a52c988732af240c2ccffe3edd216aa88b642d7434b920000000bc3798f8f6c49a407dc3e26480b4e4ae595d664f9ce69719acc9914867d25680400000004531f53ddfe5b48b4e5a49586c30734b89589738f9190c4b71938cbb5e5a843f047bf86f6c2a06c3b3b3bee70621773edfdd5db59529a1969f09ab0f2123d2d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424487301"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2300	2752	iexplore.exe	28
PID 2752 wrote to memory of 2300	2752	iexplore.exe	28
PID 2752 wrote to memory of 2300	2752	iexplore.exe	28
PID 2752 wrote to memory of 2300	2752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7579050181f1009cc039f029d8f32b7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b350d8f2e2e7ff8fab313dd2f6310f68

SHA1
d8f7448b512c4e7a965a1a4bac2ca33765587521

SHA256
6bbae6c14c1255773ef41e441d74ae62aa763cf75a3d4c279df39c723a9002c7

SHA512
7b602b1b99ee24046113b18e182b3d4aa688664b9121ca366c8a41520c04ed4b2599082c185c6a662304cf44fc03709d91e6e8bc1600ae5dfbcceae547318d97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8bdd856b97897645d7f13c789328920

SHA1
8da2a86bb30f2b7aa5e34139c01ba59428dcfe40

SHA256
26d8fe6803f88d271fe230fbfa5edef25fe59839667bc9c8e5ddbbebed7b6a2d

SHA512
7dc728c28db1552f5753a04443e685fa03d93812a26ec9635a9d9fbd0d74f2e2c5e944a4065ec1c634e31c8d708b2475e103714678a069559816af7ec9829859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
838a8f3a3b33afac01d3cc3569e014eb

SHA1
a83cbaed9870b6f8837a94a882ae1b626baf8f94

SHA256
84b9c6f1980b3874edf13f90470ea8e7eee27ddb441c13dc5e8d672559e27a6f

SHA512
d017c5576f4fef5a260995f1c022d8c8156e630f9549d3ef8acd8dd1ec2a0e80499671ffad0ce61ef53227376780befe20e9ef5e05a1bbb68f604e9268040c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b46de80225f95b724ef89993ba47c000

SHA1
aa54513426012c6f60ebe6baa8cd0a677090b6aa

SHA256
3a7f34e4f99162c1d159b28bc6c7ed1f8342ae1187b5447c123a10530bb9de26

SHA512
6bde277260496762e2ddd681c96654180ccd996411a4a9820573f5bc75e3951b8038878e7c3ae30c9ce7e4c4a5eca209013f70cb4fa08f0c9df36f4d9e1a74b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
015a1886819a1752b8aca69cdd95d7a2

SHA1
fd61553dd673d8174bbb6c36d2732d13122be52b

SHA256
94aaf99b9f04093f8094a3ff9902ef3630f59568896ce0443311ef39bb18e545

SHA512
d857bca1c6a9de7012719f863220809a776e85d0eb6bbdc5dec92d6d7939b202a91c3dee06d9cdb4e1abfa456b125ceb5e3e529f00571f45eb15a55096269d7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9db1df542c6c35bbee06b2d3672bcb2

SHA1
be30d500380f8f9b39f58cbbed292a7d4d1dd756

SHA256
d3f1974e4dc8f69ba836d0f4f8667e8bbb2d98bd1b77d4867cc887f6055af231

SHA512
218e53a4030bae887e4d9ebb694df8677f2fafb46786b3b6be7de03dfb9a12fcbe43450098005f70e0ecdc0beba2c2a9adc7666aa9c6402b7b2bacf10c6c42a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb580d2d849a6db8ea983d91f9668e32

SHA1
2143afaa5da0b8196328ac2e81e6b44140eea25b

SHA256
c20df68313dc96b277a7fea0534579eea43cadecc1fc15192242368596ae3e41

SHA512
f1b66a69f3a14d71e925908111f0283c17fca7722753b6ce66e02852cfb5f9faf0a6b1b79fdb52ebd6de1f01392c48a8823173df29b21d0763e2fa67799adaaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f77cb9759aeae98baa76628e9da9302a

SHA1
b581326acb7a513465b9b4deb66dfd6566c7ecff

SHA256
8d388ad850fa096fcc0477276da73779715c75477a8bd2176d4e445000abadde

SHA512
b463d3e8f365a9552964a86eb427d90999ad2cca44488d253f19cfd1fd70a2cf44e28632622438053d0f1ecf52110a162a2306817d6f993088ac61137d6c76b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
940ad963f53cb5dc0eb903f243d9315e

SHA1
ec59716e83941ffb5fbe9ea8275bdc48b3e54fa1

SHA256
eadb7b48fa85a32df7df5b0784247cb778b476fe53059fb12a8be258870a3074

SHA512
21a78de336f06f96a12f12314b7acbc6fb34dcbf350999952ef5540a5d1e8e7cdffbeec35eb07f135a147e232379a8cc71f8a5e7b73c143f8fc2c9e953538d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
716cd28a550b18f34900297d28563977

SHA1
90fa39ea1eb90fcaab98e70839f1469f999fe577

SHA256
f478443992900627eddcbbd20e7eba97a8f581e67210c71e7a3c0f053f1ef287

SHA512
e0cac6d6eaa87a7fb718f2d44ea03103986f3f9a1a2bc07f8d979e440703ed000c7f380e2830e94c7af478e600f11c335edf846f1771fd5aa9a50ba0e05e86e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6c647b46a262fa3cdaf05904bb1e6e6

SHA1
5469ec52ec032d698f65363be46a93c3dd486e79

SHA256
c80d3f007c77be0d6a5959fb23dd731bad249ed279d846e4753c6a0adf972593

SHA512
6998608e991e4ccb59b02e2a8154071920739b4439f7b882f58eaeb2e4e765d08f6f9e8916d27efd3f97cfd1cc918e1b2e9ff6e79e772693c3c93f42e02d9776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a59cd8f36dcd98e25425ac8963e73638

SHA1
38473566dd7e56c708559dc6d9fc532d97d93de2

SHA256
f6875dd745d9f52aafa3b641f843d3eccdecb06559b9d568581d6b09b47bb8f3

SHA512
56dcc19cc1a65475e6b40fea8133e6055e441c1a44077d02ed51aa6d60a03c66071e4f8017256b17d81648eabad6c595cfcb99b84a6829b3cc043b84bf758c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
402f12fb135b00fbd3b4f94dc6cdefd2

SHA1
567e1eaedc549291847c69467f79212236e94148

SHA256
395254f5f3be8e0d2a20655038ea1c03a8476c921fcea548d2806f426eab4443

SHA512
42cc7085275d122a1f255353b4331492257adb280b7c629b94c84fa449e4b86409b4fe20b58931a790844ee0eb054d834355c6aad76327621bd12c7a5b248544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38d914980f774e17a58e2117bb5d8363

SHA1
b5a6b1d6313b6e05d5ac0d864ceceb11757d3c58

SHA256
ca9b2249f0cb4bf229d144feb01d7d1a03129a8f9a27d4890abc609986e3f83c

SHA512
4420f2372c553ad69cb7fc9ed853e99fdd4e5f284e28b45dbf6d76200424c8bded3a7afc470f7f7e5474fbbd0b9c8e52bb0767205b0d5e777bfd951e34af9698

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA335.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA431.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit