4e02d2b72c216b3a5c0bb3410ce8a4d9638a4ad8e82df7411bb36c780d4788ce

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22711a739aafdfc516ec1c698f702e2d_JaffaCakes118.html
Size

2KB
MD5

22711a739aafdfc516ec1c698f702e2d
SHA1

1ef25ed1856837d9352b13e49e51dd491fa84fc9
SHA256

4e02d2b72c216b3a5c0bb3410ce8a4d9638a4ad8e82df7411bb36c780d4788ce
SHA512

1ad0ff281f271f429ed5e43377389677b50ffd58a2fb786272a9bcdeee2c3850b4ba0b4c1266abacf6185dabae64665e6ff88f049049077695d78fe13ab6d2d7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{840B00B1-393B-11EF-AD30-660F20EB2E2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426173193"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dce361339a4d55499edead415945aa2c00000000020000000000106600000001000020000000b9792b7dc4c8795b16b41682effb3d527dbc23375c647d9146f98e05fefcc0ac000000000e8000000002000020000000dbaaba92413bc4f8d77e9b0d4918dac5248d051656322205ad1ec13c498f9e209000000015902e700d8ebcf0016e937ca716d0af9283783cbaf55b2773caaa4d7ddcb7f9bcc41bf27f4860e97db3d38455a260d4e4cac03337d200fd62f79f77d360891aac41e0fc8d59bd4d87ab8f8075afcea494872ee9f38b02a8c50859406438b9a5320001cc49bc8791e836d32564e2d0dfaee66142549fc70d17b2681049ad91bcdc108646f024cdcc3ea8a58e89e0f0b240000000d866744b467817dd52a14ca9fae83773853fefe67cc3032f32718d87c639e0f06eab52279dbfa5382eb4137e37c5183ddc127bfb1f2e9f59a91afb4bb88524e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dce361339a4d55499edead415945aa2c00000000020000000000106600000001000020000000dc205b696dc5be9c126ef90591451de5901510ca0948c63e0bc0127481a18585000000000e8000000002000020000000da3d0311f0c89849180280c9575c41194ec569df118cbddf14711a7f587fb327200000006889f209c7e2eb9e301cfeed58546e3e3f4916c1393fed6bdda2a40eecaab8ee400000005744116d9f919c2a4b030ed02bf673869d3f68c633b036051695d879e3462372d14425ef6e1530c1d6729867266334e763517983554044627fe9a07f23bf1be4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4026955848cdda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22711a739aafdfc516ec1c698f702e2d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e0a267ac4efa65ba554af2f82cc036a

SHA1
2a511fce3f2e9f5b7eaca3180e68310471f9bc12

SHA256
20bfe121abcec207f0d4c963096e32a234da4287adf1cee82456b61286ab120c

SHA512
1cbd7e48387c486795880c1f37a2421508f1fd4b78c93522359082b2baa8f30bdb2638fe6d51e96785a316344a314f36d5451cc118bcdad1e732d7a2eb960fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fb0fcc9ef0b9a8845e76cdfeb157f8d

SHA1
665d69c3f33871c0aceb0ffbd83d8641d4ba9d82

SHA256
eddf379d3188ad51b3cf1592a51f8ea02d12a704b1534ea3a6ddf6b85f7cba1c

SHA512
0504ede545cc476897f14b96c76e6d4964140d2e8ee21a676d85caff1049a805db94cb525a57fe70c28b1103f7652d1f32ea95748afd7f5a1db4f031fbf1d18d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3705dcf3a8b23841503242042be84585

SHA1
2ac1c908f81f5eac9c47a9436a018e9bbadd4b50

SHA256
948b510820f38d0ce17a96f7dcc8bef58a38dbd058f42ff929610989616bc6f2

SHA512
f816a5e182dd209563875de59c8f1865f297d00209dfff247467a198832f6bfafbad5c8da7d00ab7c3f4d20bcc13113ac7c8a37933aedd5506c33d6c5dbe969a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
152248369dce62f3ad4db05e38384005

SHA1
8c08b493319646dc0311b7a57289f3cde9cabf3b

SHA256
3f16579cad2957e5811e6cfa8f542608c05a681d276a38661d102d8b944c3425

SHA512
85e5bc8ed652ff00d3adeb74cbe2127b001bab0f16dbd2b51c54425074008f925abafc7ac4d1703ddcd12fd1e75b4d4fe9dc7b262dba403159c70e6420698006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a2082a2922f9e131ea7cce0fd7a77ce

SHA1
2d41c647932dad046e1789286c0c87a62c74fa84

SHA256
316d0bdeb23da3fc143ab67261e996857414cc376dd18da75b7477fdec99629d

SHA512
d575d358b0868a1ce26a1bb6c52e7bf265a01b566d867613882eeb537baa4ee32a8f66225b7082c413b296b7340b25aae08e4b65f4c470ede283fc5059346143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50713f24ae7bb9c0b30a8a35acc7e2c0

SHA1
47d296a7fcf53d41f54580ee4d3373f55873fc97

SHA256
07c01e8fba2d1739e671bce0590a2ab7569e631a3747606478912955b4dc4e38

SHA512
00f344041257447200c5ee6fad49b1ac0c2cba5c1777506b2292212180552c80f6df32bc2dd1900ab8ab4123dc7364b435f030f7fa16ebf23feda9ce5943cf94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70cecf403ca5e2f7711419408f67c0d6

SHA1
cc8c721342cade93aa4656839c3be78de50f83c6

SHA256
0d5a034d127545353fa74087447ba085cf5f596789be7366cad9fa7665cb4303

SHA512
f66abf1d7f5a4eab266edb4ef44b6b5384232d1f49e14de3924f25eb81319f4872868f2e1854c17d7b503def50d5629d89666b14c098713360be784c2226cbfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79607a09a7db800c1d559ddfa9bbe00c

SHA1
d876cc4e03ab2d24018d5f4651c73c0118b78810

SHA256
ed996c4a67ac7e33833ca7dfef1ba847f696faa4ed574a186d7cab10bb5858a6

SHA512
815dbf278bc2f3fa883fbfb10d04ec80aadb6bf80e5c12916616b2db0c67d966c81b751773a79bb335ead53c60ce4ff07fb4f83151b25c6b155d8b266ecfddc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3347b01e9aee0f487e53a70b7193351b

SHA1
2cd36d11ee34bb69d331c3a1d644d9890265b317

SHA256
469d74fc6802a250793717bd389a853f0b100e84fe7cb7ba9d5fb8f672bcd1e9

SHA512
a998bae75ed9dc4ec8b65b74115d47f8d5bbc703b8f2a56b8c5e2c0e4f3a0245369bdcc2e7d0807f2f12c74fd5e2a88c701ff46cd4d24e72a3b11e32961142fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ea19a1b4f617f04fad1bc268e8a3152

SHA1
acd482095d2d4e8ecfd28a44e109ad74ba3bdca4

SHA256
ce7ed131684321d9d78dd8e5bc562997544af7f7f73c2d5e1dab162c87a69989

SHA512
afb9c10fa2a5c7de5f25b6987ab179d343d175fb56c5f443fd5f4f1ab02b8a9e3b3d5bad3b634e0039613ccc2cccd0857071817bf0b83539593b73268b6d0e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b812f2cb33b91b49b7ae5717aa2f37db

SHA1
6740ff07cf0d23d4252cd0e1234dce08f9d8e6bd

SHA256
1c4b117dd1a52d30fb445cd9942806b1a2d420c6454d98d6264647c685d528bc

SHA512
dcb54f61d819e6ba641c8a3486bb3165d78d7fd30591d67a6fd17d11debb8f1fc5f5db4dd3967215a41fb97a9c876fa030052636256babbce87e1e7141a6da99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c8c0252831e36fa64812d446c6ad774

SHA1
12d5fdb89c9b3e34855ef38db5b6fb9ce6f19320

SHA256
3b0faaeb8b74c897768b92cc85bb607cddf8f5aaa5a01f4755b5437374617d64

SHA512
6cb03f48136490964f904bd34779c687b9ce937feb77cd9f1b3f726574b47c8a01fc07d3337b31713447e951d2b2f53eb2a232ea227281ded9dc0a167bc0ef70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
777e814d037bc8da83c7a23a2a96d44b

SHA1
196c39a700c1c9ba1220adbe1e4cef8f9732dd02

SHA256
41695c96402a1666b35743e7090912b1d6894d53a2be1d7b94b7095bc09eca1f

SHA512
da2e95b726ad15efe80063d2ab13a1ca51d0f150444fcb7f04761abf597438bd16c19b76572759c84be30da18649757f245fd4c1983b85333168328efcf9dda0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25a6a1f59845c7873128dc4afa4a4ff2

SHA1
9d4a81ed88ecb8d9b3e01940f2d0ad8b529dcaa0

SHA256
1e3e46bc67824b63132c29222778b05ea16e0d8d0c66be5a966a5286f863280c

SHA512
37319d9b6ce70aadf7141faae849b13355f367a634f82aa8de38a4ce0eaa5766172d96700a298f0dfbf0f3b77d9cb94f74ab97363f9705b429c83ac85d057577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98222c30dfba482c35b35511dc73d5ea

SHA1
0fb337ccf80cb5bd8efec147a90d21f82566a994

SHA256
744cc17bfe566f59a5bb9f6d6cc205eae31fd4a249f5492e6ae9d01d39284c1b

SHA512
dd9257f641319a5ec509e059521a4c8eaae52020030444c959934dfb4d5eb703e60a41267588a375c36d073d5737c80adebbc4d3e6952a30a2c14d162fedefdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D98.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EF7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit