65b1c14a09f8c81612d7456ee2c0dca181d867a1f447e782bda8b58f07420770

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e6ca531ffc35e1ed767c4a896a33740_JaffaCakes118.html
Size

2KB
MD5

2e6ca531ffc35e1ed767c4a896a33740
SHA1

6a30fdc995948b919f4f17f2a687716fa0bd68af
SHA256

65b1c14a09f8c81612d7456ee2c0dca181d867a1f447e782bda8b58f07420770
SHA512

7d077ed0a468fe70506ec58336592331eea9a51fa0ce5a1ee939c01e00b2623e05c93a760c9c93738c4d5277116162247d90e7f735692411bfdd3b8edd033843

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000060e3d5c4c549d1bb0537af07587c95a5abc1f87742d13776edf02ecedd07c118000000000e800000000200002000000032ee0e50b315e58533facffb573f8abed32a6918f66282ed362027d4e8ccda0920000000e3ccd9197d0449f3eb72fffc3a93e462d243df781d1bafe4dbc99390aca781d740000000787ab99160fc4b80e01374306d088c11632069a10fd8bce19f1722140899a48dd93909619d1d834d3c2d252673a9000f56b2361d3742ccae3453eb14b58d7653	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000685ede2c8f472ccc8d133a937fad45417cdc6cf03f2f24dd4c6d0d1680876eaf000000000e800000000200002000000019b6135d17004718930644b0e2a62c55d4426abf0f7d6781870498cc0e463d8c900000008ef67d2cd42f19e1a52629a17bc87d80f44da980b47542e08f8d4fdd2e09eea3b6a12249de7604aa01e4547ff3f73561e483bd046cdcf1c19dbdb266b55e6213fa873c0166e3572c1a46a7d5de2d6fd0eeefb9a61600d038edfc33107bc5fac158ba0251fbcaf28d21611064a57008c5a42a0a822fbe5d59db59bd4992f508af117c667a674d92abbbd93d14a3d997c540000000fc7a34eece24a181c26aa1eb263e275f125c31f25c3e11fa036ce47ef2e8e435dd4762ba0a549b76eb4a6e104853859b59abdf4f3fd4dd6e8f09e8096a78f3fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{219B4D51-3DBD-11EF-BC39-5E6560CBCC6E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209225f6c9d1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426668667"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2824	2528	iexplore.exe	30
PID 2528 wrote to memory of 2824	2528	iexplore.exe	30
PID 2528 wrote to memory of 2824	2528	iexplore.exe	30
PID 2528 wrote to memory of 2824	2528	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e6ca531ffc35e1ed767c4a896a33740_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca9746ce0fce8f29b842a0b08d9abb3b

SHA1
237e549c78cb0d1d8c2be969e85a35cedab4afe8

SHA256
26236fe0a0bcec801f313b57994f9161c003c0c6ffd0268286ca62de47d469e6

SHA512
c7013d773ec9b349d69dec2234a3be23fc1de80dcf69ded6ba5ffbb404b7bf374f6cb6ba4943069b73e6afae348f67a02f73bc203d3e145551f6394f63778fde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96e52137b21f1bf796ee745ef8e22f66

SHA1
09692720ec807f2ce92397d38cdab20959f5bfd3

SHA256
9163aa94be5b05e9f3aeb28a7b42d876076bda954e63bfb9c73bc8afc2d2a10f

SHA512
86c412f484de6a0cfab42f6368e0726f9e4afeedbc7af69024cb1c2e14aac4c823b7de64f0cf20e652a3cace510c9f807152f0e3b6d828a4eea92c98859178cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44eaab374efc4373f065b9b1c45b37e8

SHA1
842a1d1f4541185298b54fc89693409e54e3130a

SHA256
b75c09fd4d3ee6309fd0d63919aca654bdf34c56786fcba7e46b79ef9ffbba7f

SHA512
74e357210610b39e98922cfc13e85fc308e72b4078d95bb263ed953f958c8a8d3353a8ab62c3c1bf4d86c32839bcf103223e5a0a522dd8b48bb8d01c7f46ec1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c61a0b1ecac15cfb199568631033de5

SHA1
2e635e469adfb8191e62a5514183521652821e0f

SHA256
2f228749d2a18b69f6f04b20c96012417ad58e023fee7ffd48a4e6035c39f606

SHA512
9f649c63ff76f6bd9fcd44b4993c90901d7b2b76b227ba06dd80c5eca185d04785d4943953f9a66bb26c9c1494604726c0b86047cfff74c3bac35a435f27aecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ecb033f30775622319814ce05e08efa

SHA1
0d31484a545ae228e755828f0423a6254d0ac553

SHA256
83382429aaf051e6b0095552b624c72fdae77ff4758d6deed3160087bd2d62ab

SHA512
e71609a41bb253aa89a6dfdf4ce67af6fd91b36246cc07fc7dc0c4717627aa38564cfa537d589f0f25d3d10bd7c3317bdf8413538c2df6db738d72aa7dcae1dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
103c06fe6328e6d490123670485db17a

SHA1
31d3c188c1329008d281ff3b1d2f43e97ffa11aa

SHA256
aeae52a3ad7d46e86bacaa12bb4c70ddcd14cebee2e0199fcb88dad4c8fb3929

SHA512
1366167243f8f2bf37ebfd1689f4c6b7ca2f37ac9ba33196056264e211ba986f01c6291173a0017953b1925682859ee5fe827fcbeebfc3de970dc0f10e4bb96e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4328238b31e440cd53356a39936a549

SHA1
90e27f13f2cad7afa77bfd014936699bff64821b

SHA256
abb3f257581160bc13715eece55a626ece50aaaf1623ac3216031805111aa0ad

SHA512
bfab8e41beed1cf4f602131e14f50c2f22314a46b5cc9b5e65d2cd40b1b26ce0ed49951f0da5e98253a033ff173d963d89b3757acf787d91cb78e465435a59a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a275f721c775f879a77f0267fddb716

SHA1
d991a7775d91277bd2f9db58f19fcd0fd5824064

SHA256
7b523f52fc6966ee43888a2ee484dfc73ebff9c8877bbc5c181dae07e317aa59

SHA512
849f41c61bca9a2f6fdc80366d2fcc6c92c5d3e7bb978f7a2c08a2d1ea7fea21d21b9b44dbb069745eb0ac3ed967e8c5c789050a8934466022f523c8d3c3f5e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5da1403243b798e72b194ba5a8bbb019

SHA1
f3135f57b2059705d3ac2c49213f06ba377d0b6d

SHA256
1577405cbebeea4ac8752bd0d932f7c9c9628337f71b05205e1adac63bca23b5

SHA512
fc002ed2dd15609ff625d12d85923a2e33acb7a9fde29e1834644c4a440ccefed46c636d512ae3216d3f753ea99aad6167e87209c6c6482d98669e18fa0cbb11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efa9ee66d35fffb46f28767dbc1b9d20

SHA1
b1df72db9bb9558ee94b2ac422a84284e66c4c85

SHA256
7c6155997a26e85c047f57909bb28a58dbb806d614f280327acb7e402d5cb22c

SHA512
d3d781b7e771d1776b061251237f6b622dadd4657c3ac4c134b56174b69ec8cc53a08ee51012bc005728b0c7b5853181f7308dc9357ef83b388515e468895414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5317fdfa887d3cab973caf713b9ffbb7

SHA1
fd5c21e27b5602e4b03a5ee799c018cd41d16bd7

SHA256
67bb05f8ee8ba1be1a0862678c35bd372a1ce24876884a852f41fbb04fca3bbf

SHA512
97293c1af99812cfe85f1e88d2d1666da4d01c1640fea5bbc0301ca92ca652cb276e09442e6994bc70582b44e98c457a00cec81ee4f96767082998c1d4e4d0ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cdd3840c8f8189e61af237f6e3ac8e8

SHA1
dac2172f03ec2b84a63735d685785530f10aea6a

SHA256
81bddbf6e7d0969c41c714adec658dc1a6cc76e9139e3e6a75296d3de5c89845

SHA512
d758f3818409dc4f4799be32c5a6a2a0ea9883f9e97f77ddea18508135891468c46f1ce35866bcf2468699a39eb468fe8da2773a033f1d1b3251fe6115bf052c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1da37c4c9577d98c2f45942765e34bbc

SHA1
e8494707e731f67dd0c44308dff23ed41cfdf629

SHA256
6d1ccff14a8d07419303c77b49d4a0f3599bb162cc87a7a88d0ae186813e72ac

SHA512
33f35b29ab7dc8cfed183b39525b12e87175f36ac09e397df745e4a7eea246e629289c0a32e3191e55ee6be3eebc10d7c751e18c6142dd72603d109be3dfd0ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b4c01caf61f7eaaa54224cdb6ce4a57

SHA1
c896b80fd656c470f56cb28d568eaff668c7f1e1

SHA256
c64124269ecc59afd4d4a81d5fe1cac09892ff901e2d6a8f12e1c7a2fdae395c

SHA512
178b366c4acd90f7f42f6253b9045749b50faf312dea36eb89f07e514c23bc6b7e38bba87d39ea9b6b23e8161766074cde1d4d5771a40187fcec161285c633ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
253903d25f8f847b3e77babb86957c7d

SHA1
bc08c7e9a839c6ebb9fe1ce690e52e5aa64fbf88

SHA256
c7251efda82228447dfeb70c17c0560a64359320a96af82dea795b18bcede73d

SHA512
b1955b07408a8cc1c89b1865f671cbdf507f71400102123a0f0497adab83086f233a573036a727fc026829056027045000d1c0e91df96ed6d1456606ace3bf74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41ccba88c4b974c65bc152bc5dd4475a

SHA1
fe7d0722028476c9669764da12ed7f875949947b

SHA256
da48977663dd41625406fa9be1dfb9d4491496543b9d024d1e699412cdd039fc

SHA512
fa726c72d15c873b2053110757d5e2e625f4b0f5a165327c5a17925c0d7d219d2408c7ad062f58d326083be797520ea199546d33cde8b567c8c3117b5b239ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89907d72659aef1d9f664f54892d0567

SHA1
5089f89ba055744f8c22148fdb95f8374b16630a

SHA256
46ba934b603b7bdf853708614b77f5cc9b60d77453fb05d60fb3bfcb3808ae25

SHA512
571d4403d1b6337f4b4c2e503db2a8d2e03d6df757a7cadc93160268a1322ca0e8fe175d4682e8b06ea2b4a56e64307d2aa84c3e2a3b3d9b1d0fd1aaafc12fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A0F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A80.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit