d9cb4737caba8ccd4fbc3c974654b245977f1e586b8eb49da101d151a30b4eb8

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2773808e5427c3f80d91b5778fca5ff3_JaffaCakes118.html
Size

1KB
MD5

2773808e5427c3f80d91b5778fca5ff3
SHA1

1545db850d8b4e7dba5983e4bc796da58e1b5cf9
SHA256

d9cb4737caba8ccd4fbc3c974654b245977f1e586b8eb49da101d151a30b4eb8
SHA512

04c497eac78529261adc8b24914ef33534a08d7c8b3e5e7254800ff764fdb9cada975a723e89e391e36fb80e13b2fd10649fe883c6afdb90390680eebf116296

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426406894"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000006cf1d45324fd9c1b4c928cf321dc0ff8e7349d7ab3103e1106a4cdbf2ea1f5ab000000000e80000000020000200000007fed00d2f4f7b5bac507bf340eb4882f220b03dd6c924c3e01050027d176b60620000000bc7ff881c03ef9db06f1b9b00e75a13419faefedcd6d945be346e4e2ddabb20a4000000090e46dbc33346d4bc16b89382b40271f9d5ed8150ad4e532743f7c63853d3127f0ebcad954e7c84ff7ac160cf7ea518eda1b364c5dadce82bb0b19e7f12c16c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000005258d85e34880a8ceb942344559e56912ff627bfd2c45c7b8e9d15ccebb57c84000000000e80000000020000200000003add35a84813148ac60800ee413f882d72dde1e5762a9c7fe990795b8d4bb20b900000004f476b8dba313dcac932df0ed95f86b5f7f7c5d9626e84d5ebd2efd2e69fd5afd3aa08c045ac1789c1b808146d7ab6433e6da0e4ac8d238913f1a070a30dd48822e4626da51aa8334b72392588f963a5812ce516764690988f169a61cc3bc5b52a272dd72f033fe73a7b25603361fc7b2060addc531c71d0eafea0219ad8352b8c0f55a8c4ab1a734d8e1aa1037fb5224000000016d44740127c874268dc530f47f219a39d0d3234de0b7644419525729c30446daf5b79bae1938b175460c893e13474dc76e0e91a02d990c219e752b49ab3a66e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ddbc7968cfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4BB26B1-3B5B-11EF-B44F-526249468C57} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	iexplore.exe
2520	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2748	2520	iexplore.exe	30
PID 2520 wrote to memory of 2748	2520	iexplore.exe	30
PID 2520 wrote to memory of 2748	2520	iexplore.exe	30
PID 2520 wrote to memory of 2748	2520	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2773808e5427c3f80d91b5778fca5ff3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e6cefdb32800c8cfb3634c02b1440ce

SHA1
87492210c86eae1dcbdcb5ee181d528c45e58655

SHA256
524e6a7de84f448d12af88701d0ce3e179acb8c9c376257220f4d00aa87d9672

SHA512
368453316be7f720972bb6f26734504caa13a3c8c8d9dbdf74e1a87e619b8eff692602077ba2755957ef1fa87f42979244970a08081a50127e1bdab9b6bf8387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33c56e68406b5b56de95e9acb069c363

SHA1
0ee8961617c25774e277aa5262f16abccc9a6bf1

SHA256
3b27503bba0cc04b5c06b7871cca5660eb89969dd00f59e0bae3cc7a7edfca50

SHA512
0dc822df42fab7f8f67be2ab6f09b1e5259121269de07506c63d25b77fc05dcae3d0b0c020cf94fbbbb41ce53c623ec8e01987d8a9efb44d95b792600e6875dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9264450a3c7d9875eb9df6640b52840e

SHA1
eb280108d94b286adb4efb1d82a8bdd3df313410

SHA256
f65617fdad5edf002ab90a2c36a29f2a68a0f663c3f017726cb1d599ace04579

SHA512
1eb098d4c1aaac637a5bc97aaf173c61dbf28f99e9684f3282eed75d7cb0e450e5a52e8c3959ce9bc12c2f8fbbc98a5891dff48f782d72600cbef5fa7a6d9ba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80c5701a3f65aac6423229a29fb78577

SHA1
ff3c0b46fbde20cee7696715012589a80dbb51d7

SHA256
d9270efc5596ab7166873c18e05998c711d39e36d747669ec02adad03b2a1662

SHA512
3f767ca2d8e302f72c35598cd2aafd77a8a8dc97af49a591527543a6da315f96a26787efda779d2fb514576c869582905f1eb317cba62ed8edbae09d3a8a8c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0447bdf6d1229f3d4111619bbdc9d076

SHA1
c820451d8bb98cc3160948bbd7bc56adbfb96f5e

SHA256
62f3e745df3c1ab37803ba5c2cb903ee7347db9aa1237f2d7dc7fc40f94d0a20

SHA512
012690fdb33217bb1ba0147b3085f7d96886b9eec27c1c3f8c6b8fe75c5f1d548a4d2bcdaabf4e9b2f9c08b9e35e9c2a2540083db78b76add70c90d6e0870f99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90ef5eeecc8ef414abbdfd8262c0ad2c

SHA1
246ea9b0b74f46e1e61f48f49d7ea95199bffd29

SHA256
6b99df9e6159909a731b7b0281e89fcf327044b6f92924a1e0cc92846cb706e1

SHA512
f9dca78c47945233c0ea3a609b3fe42166d061071f5ddf2539b64478e1bc4d2b378b1794f7060b414cbc922968be4b84283bfe9fa0415ef6b635a1403f60c207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5479ff599af3ea5ca5c9611d5b1889c6

SHA1
dac222a6f9a0444ce8ec8b1dbb89bca067d95522

SHA256
50945613e1f83a6a73745f62ccf73c22fedbb4c03b74dbaaac5670cf39f7ec2b

SHA512
7b4af594a73e1099a62cf91708c91e203b5407744c3efc35abea1131be9a2e717f14463863a1b10944f7abb68ec5f1f1b23d03ec49644f5993121608e6a33e89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f582ab000bb032235eca6dee3e538c2c

SHA1
76232424f2c0e332edf49acd132cb0d82b5e2445

SHA256
2da03c72d70e9c4be185629c944babd7f055943e4d56c3c0a42bf6443fc9420b

SHA512
dab7305371e2991c5cf8036c639beeef99e8330237aaccf2e67b1a454327337d4d03a4c069496f826e5e7aaa72ce8d31e425115cd4bbc18535fb784928b5f3b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab0f0d29d8a44558f180331d01266358

SHA1
b027c7032fea927091e7af0c1d6d4c8c762d1614

SHA256
cba6de28843eeaece689c236b9c1f51d683c7eed978afd90267936fdb2557d2b

SHA512
445b453661409f360ac1847942fb9ae1cb1e58afeffa82dea8b4c01f2ffe20f92c57afe606da865dcf6a26c423bde561e2b0da156ce18be6dd8d616a35222a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8ff565e9505f690b8a4e40be1952961

SHA1
c2a6912a95a58782ba83c0caa3d0f8c6e8b78701

SHA256
5ed0b16082ef5e3d4fe6f9b14c1b877a03ff69baaf2df0fff80bd6d386f58dfa

SHA512
ba4aa8fdeaf4d28e9659384fe384eb5dc03fe665d18da49654ee658ebc818e2b4fa947625a979932751d42cb085d8a760a86ca6173161329db1eaf29262beb9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7594a75f541cb52f66db8e3313dcf78e

SHA1
491548245b8a424c648955324546b4f574b7ad4b

SHA256
8cf9d27a0f4430f691add4c97be1f53df670d2e28ed8c5067a198f261b34a2aa

SHA512
d09f381899b73010bee3df0ddc763f718cbe23fccfb7354bc351360c83a010469057c55d462c5e63ab83c4b179407c0e4a88926ce323e17ba5ad03cccc92f920

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A1E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AFE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit