acfc11294b26a1157ab00afa486d349a6674b840687311ca2fadc3dcb214e87b

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29d7c59f0db835a01af0ed4cdcfed949_JaffaCakes118.html
Size

1KB
MD5

29d7c59f0db835a01af0ed4cdcfed949
SHA1

8b66c141e795c6da5c5c59c62737da10ac5ddeda
SHA256

acfc11294b26a1157ab00afa486d349a6674b840687311ca2fadc3dcb214e87b
SHA512

53ac714f38e51de5f78ce03cae2e3ff4040ce63ebeeb09a2edc0f86018fd493ec3ce7e97392abc066ac85383468cb022e539a7c14f5baf8ad0dfd449cfb4f3d5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000006cc060e7dba2bfb9dbfe967695ab7815e315ef9952e2abb9f837e15724502b84000000000e8000000002000020000000979625def051ecaf82e0c6ca77e7601dcd1f35f1250bc3a5d0d8ad0c0742b64220000000871414dc587f23a93362c9da3fe75feda43dd5bd8aaedc97e53330a621b75b8240000000a301d1acd9a144ad20e15ae0f7e2f67e3f873fac2553a1585e38933db5627053a6e46145b20ac6e42adeb04499d3e9fb227c8ddebd9fd2e7baf74fcfc98baf2f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5DF02F1-3CA7-11EF-A1A6-7AEB201C29E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a7d0abb4d0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000005533428bf00cb0436c9e16cfe7b65cb344f1f8927447b6e891c4706d8bc38f68000000000e80000000020000200000005fcc13a330b47dbfecf41a071ea94512a1312b76876dc301a1ebcf118483d66e90000000b18af5e2825e81823eb03ddc7bf1c90817b307e361a566bfbb480b585f36bed5b6ca06afc8e280ca43ab58451b2ce1d7daf9807b5adb5520fc409d64f761ef41eee8606b4730a6cbb1e505009b1ccb52eaca2ad1e7dad5b997daa116fdee8a4ef3a21fa5da3937934baa808a920bfa3e9a6bb17418ba0d470f21b855f8e0b4ac3664a6130d69b3159f2acb3f13d1d04740000000b8eba87fea393591a7a255e7db51f26165ebc81f23b73c09f2a6597020c848c2e8233e5701ec8cd99cc7dc85558f6c0bc8a2fcb71adc49c0362a1a0a181c3125	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426549570"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2672	2180	iexplore.exe	30
PID 2180 wrote to memory of 2672	2180	iexplore.exe	30
PID 2180 wrote to memory of 2672	2180	iexplore.exe	30
PID 2180 wrote to memory of 2672	2180	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29d7c59f0db835a01af0ed4cdcfed949_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c63934638c57a43264173abd0c9a2a3

SHA1
cd58cdc752d4e73026752a7d548aa29ce287903a

SHA256
b59a6731eacc4c079f5ca3a04c87078f73cfd6e0b7f1b030a87f31d447d1197c

SHA512
a44eebd91438969d6c7dba46a049111f931cc4af0bc23be9e3be3c7a771b6a491f08b1c9cd4990dc8522428fabfa099e872ad03ece94f2651ef70fdb794ee726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
712d3a44b70fb7626a41efc319ebf960

SHA1
5902176eb1191828e0a4a71e8ca0c0edc2aab46a

SHA256
e03d3959a7540b8ec4658b9dac1f56109f5fa18a53a9e9abf0891318470180a8

SHA512
2077ec30335d00c39d6e69f3b146d5cad74128484146ee2815b3a7038d83537ffce014a84b5767b5f5ea3e721639d38c073040091b122ec7bc935b8a599b5dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55cee1dd81910424af7f94a569f853e2

SHA1
315ed2d6ae1382700957d4f130d983305fed7e8f

SHA256
0732c0eaf2706d29d1d765e10440d432a72e48a7a153ccea4e40a69e80a079a6

SHA512
97fe5db0a937beb9ebf33c7087d6efc095ea89e80be05c7f992dd307c432d0e0d523f0d2bc34525496dace8159d594029f5f143a14e4a8e1a9134710e91f36d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac762cc7aca2e3b7071268b6a4db4c74

SHA1
f561c19f3551bf339f5e0c725b90d58065e7287d

SHA256
840d6f429f7f4f7e00bef061db050a1f893b0cd35792efe2fb05ddddf7bc1973

SHA512
a1bedb3477ee2daa9ae7588bbabc3e66c9969f0a1feb54b6d2fc8871e9c1dbebd9b1621d5d3ccd09c8204992709cb2503fed75cbee567e66a1626fb744e56a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
443b363af8a534bf6f21b03502dd155e

SHA1
b0fa99eeea4a55ac8c47c033c26aeb272b99a663

SHA256
fafc4e15923ecf6966400bf92f2eac6190e64d7d05fb0ea1a25a7ea19aa2d3c1

SHA512
8ffa4a0ac6096e2dbbcbe1cc44e893ab751399923ba1f20769b364d712bcad6642ce4ebc746fbdb647a97ae3385436ec927640987f4dd6476aa4a4ca96021aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6199d2f3f54a74a9b6a3234234fe16ed

SHA1
8e2486b2e314468d2d53783342c7021e2a896547

SHA256
5d861e5b42d1bdfa5cb5365e5ca4ca41583a0cdd0c9c691b4fd0d89eb2501328

SHA512
70535d1281a95170701a659e000c353a9a66422d661220602628a86093cef7f39cd5bbef4caa07a99e28dffc9c6972a80eef432a13882cd30d60e5ef9d813780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f954375f18ddf2dbbe2331956391fa6

SHA1
38e7e154f1405a6b2a85801e0d30852223bea52c

SHA256
dc971225fbbc42d6a0fcd95c7e32e75612783c89114df2eb79a3e38d0a1d2a7f

SHA512
e918eff1db5c34d96e148b2bd007708af21789e0c5c797e2965aaa3bb860118dafc1e4435585c79d7c5d0d487681630428d8e219576f6bb09945806fdde75aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2621c9721bbd41b4ec7904fc27cc149

SHA1
67f94d29ca6a6f2142a5b87a565b381aecd9d8c1

SHA256
1528c06887c0facc97287cb563fe5e005cb41ca692201fafe31760765502ade2

SHA512
d15eb258b73b1983dd981d6b9b7859c681d31cac61f8a86dbf2c334ffd24fee34136f725ecb101894a30c1413354a8a7ccc0a61844032cba5abc26564d2dda21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5180af1c908ba261c8478cae978b65ce

SHA1
0a06f5d8a1a6319d74f10ca2db30ffa9a5f7ca23

SHA256
6034536dddc1e58cfd80b1d2fc91e03ac2ecbc0ec33656966473034b7f63c2d0

SHA512
a0d587ad873179cb5cf3d04b84cce98ba79a6f997b7b1e0e085369b427c0bfc9ac537e7bc4f9eef2836378bd1b5894fca8c3f30a6827b34c22559bbaf706e77f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c0aef5f05a6bbe041ae06d7247522ab

SHA1
45bd4ec3e7552064b6acca9d6569aac1a4507720

SHA256
aa153149663a983a4500e5eaa61a6d43fbeb0b6aa93acf4333bfc66b4f736d72

SHA512
4489dc88ac20ea29e5fe4fa4e0870d26e431659f18447174c07d49cb46f3431e7bf5f8099bae88fe57f38a91935568c949e782dc54e95ccd91ed694c79ac30e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
181ea21b810e9f3dbe0dbdc59feb1733

SHA1
1adb583a639664cd1ce89e9b4c5a9d18c592c33e

SHA256
5f38cea1b72c8ca57f8e812f0fe60818f4d207cc3b1ad9c95e8cadeb66cda353

SHA512
fc7580a90a479bc5378f6c0ffb7e6c3cf6f69f9181b5ed6f87487d3f189268c594675e8c368a915df747407ea4bd33ab710dddd14f466b9bc81a754f09486882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c99de430318a1bd6e9a7fa9b3ed1e222

SHA1
aa8c222cbb886694fa2c3f04282390614dddac00

SHA256
d89464367e1da2a01b62b9291d6579ac01838331bdaf995c9ef6925ff3b7f757

SHA512
925f7a022446d31c95ec20aacd06321945a69521d5581eb0079f9f7265cd8248b9bd3c889d9e23188ee53146c6a09f7a46f94f25348b5c118c4e74e638aa99bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2de58ec111c0b14aab9b91a145b12fa4

SHA1
272074c10a1eb271dea9e5c2cf6deade57773a40

SHA256
3f01745c18decc1484ff96596a2d0c2b95a886563f7ab3d93d977ca1e9d8428f

SHA512
b0eb8bd80701ab99791b29945b116528a073e590bf6c059d0d6fe1033c68e8c6d6a95662a0f8dd74bdba08f28fc839763eb44f7b6a4b8ba374737d5208072e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a2162738419a0ea7083b4bb8daeb32c

SHA1
4ab4fada9fcdae771b325b86fa0575dfcb6300c2

SHA256
916d9ea0f2b1cb84b631a42f69d6e4ffb50670aaff00889c17e401dc4f04feaf

SHA512
4ea67515aedb18a5076a2916b71fa5d14530651eda9ec87fda13825e7b23802f46eef4b2a219a1f03c18cddc3a4dcdb9d5ad9d87a4e0f0ed13340a8be38bf5f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cd73d7f9091d2746bd525f2c1290397

SHA1
844cd5c5b800e2b23a40564cf15de8169dacb197

SHA256
ab8418768f3469022b4438da7b46ee2049cc71f9a71e043be0176f9bfb911678

SHA512
ef509613866a2739264c3d4276e91b791781dd833366825521c3b8d6d7d8e1ce3cf96f83a04c0504df1e1ce265ae152bdfe4f628ff09ae38537a060ebc27ed1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b649c8b6a00a7c81359cb4d70e4f524e

SHA1
31cec91b0926bc103af43811aef391a8f9e4b1bc

SHA256
940fff39ac175a9d4d45a24138b885b1df5bdb3832debd2a0bfc247fc6a8a631

SHA512
3935d8187a585362e725261a6c825f4bbc6a7f5af19ac047d7a4b335cb93e53369a096f5a78c3218b08a93119e4f12ff9a4c2b60afb5ee5fe5429d69b2d57e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6ca00567d7f672e4ce65ae8961e744f

SHA1
632daab07e72a56f2788e4f95ef4be9bc578cc2d

SHA256
a441177d1935d5014a18143612aa823c3f76e56db4ec425955d451f3d29328bf

SHA512
9ac59028fa6a3cfcc216d6098d74ee743718c4211dd8b0900ad93eb47f5aec703f0f5ce437d44ef71578252e7152f3302c1a6b2e980e9871393abbe4b9d98c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7aae16c04a78805f6fe7cb41fad2baaf

SHA1
809822dc4aa660fb91920ba290fbe05a3f253c91

SHA256
e8ae8564df79829f5ea40ce62a5f8c44c50e27146978c0dce51d2ceb07a44a6d

SHA512
cd732269fccca86da1e9d84c082384768f54a537a1014bb842e231031a6d631b5d5185e013b403abc5ea5d503e7864567f09b3f5acdb333db15e4616e6b58e3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E21.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4ED2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit