92be920cfd9aa12f4002c35285c67b6152a966975616175edf64d1b5e8842f41

Analysis

max time kernel
138s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

357ac23e3736c7f65a246a9f57739357_JaffaCakes118.html
Size

1KB
MD5

357ac23e3736c7f65a246a9f57739357
SHA1

9917ec83b5fedca8504da595784abc2addab10a2
SHA256

92be920cfd9aa12f4002c35285c67b6152a966975616175edf64d1b5e8842f41
SHA512

3faaf441300020e8e775528cb793d6fdac0ecfae99e9bb5b76f0940a44abc4cf6cd3ffe39bc5d38eccc439328abed4bc81a2500d7a16dd3d92f0709c97479221

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6709BC21-3ED8-11EF-AAD0-E29800E22076} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000005e6fd2d4c07cb78717cc9350f5a9990ea8aaa87a0fedbdd8f9fe2e2f5cac7532000000000e8000000002000020000000736edde9eaa0292c62a9237a7456dec521f4b7d0582f98fb7696b0bb84156bff90000000e0b17c5ef1c95b6056d9e37f963d34bfab3124849c462a741816acbb65f9e34d442aa84bc1e4d657660d3d1842af100d5a26f28822fc0c69d9d05320f61b044bf605f56a644faa5af8fedd533086dc549cf90fdaacd1c2fb42b39f24987445ac2981c328109101f888709695250a8ab9c5bc93a0d9f2d3260b5d38fce48dbd973d969ef573af112db3d89998055a664040000000bbf4a05dfa3a2ffefdcf3762f2ebcd3e801a49b3a9cb579b39bb6f9b1be93817fa37d775dc8955c8e2031934f3208d4db8b1a66a141e93aa6e7e8406ba2b251c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000024b7ce9ac8b44d6b63cb74891dc9ccfb89579013d8ad0f3e0cd6202b7104b890000000000e800000000200002000000097974c7734bf969636c6da50ff45c4005a5fb630eb8fab88a07b26b892273d232000000017852ffdadfaa0b78907c1b880f90b472b2ee070577b68f2c9276a66c50a7c5640000000e48678a6d127501bf02eddd3fe083b2c78d0486373f32c1bfa55a6eab70edc57e5102b4acce3a3ed3fbb64989ef4d973993cd0865ae3bb238ca9b8cc7831032e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305c073ce5d2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426790331"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2668	iexplore.exe
2668	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2692	2668	iexplore.exe	30
PID 2668 wrote to memory of 2692	2668	iexplore.exe	30
PID 2668 wrote to memory of 2692	2668	iexplore.exe	30
PID 2668 wrote to memory of 2692	2668	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\357ac23e3736c7f65a246a9f57739357_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
964f7fd223d3513a46cb9e994ce7ed19

SHA1
d6235b365205fb394ebdd8dae3bb59db0071f6f4

SHA256
a1130ac59cedc4c569fc64df6f9190222dfd3ce7d93082efa9fd28a9ad77c5cf

SHA512
a33c412d149bd9e68bdf9a71e94b5ef1373013da0bcf334a17183d06f27f8b811dd44238f667679866b5300cedffe742ad105d56ceb87de3a882e011aceb2406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e809af1b51e809d10c73a73ca741a25

SHA1
6274d86e0a1ae5700309550bf1fec084b226a39d

SHA256
1e4041205bffd87a7b9713c9785458666f255eb1b757663b0a682b1d0b692b29

SHA512
230d43a342e9ad26e661d6dd5f973f1577a246e7ff994f504010c967c6801dcf1cbde9e51d3696e95a01197d827276dd5f4153e445380503f2942581fdc1769f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fef17836e35ce268b15aeaeb5f88ffa

SHA1
59244a0dff5eed8828fb1ff7bb4320b861e9db1d

SHA256
6e93a7d85c946a3f0a6a15c8137da3b74098f80a3bae5f42adfeb498f0e9d03b

SHA512
e2c0d889aa7e6fce2075386670630ccdd6bcf8777226e2ce9d1bf97afd5462af3cc73e3ed0f7ffb4ebbf1f3095bf6d137dd1ab945e3a3a33dec0bc2a35cda816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52d0c54aee0babc7266af7ad3f852de4

SHA1
e3d4b026d9e7d44dc06c594ac6824e9b12afbc81

SHA256
a955e75cf2802d90cbaf7973ffd94f426957b935492afc2e38d7374531f5eb6c

SHA512
42cd30f7184fff04b3e98d091b4a7265d52ad2c580ab1523ec65a7cc59f0d6c58da7e77db4621b803accde856cb88436d4ee676812bce030fa00f85d766aaca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f236adb04cf2a4e5440fa318d3bf90

SHA1
b5dd51cf8c003c4b1fe8dfddad10af548f77eb68

SHA256
9a911869ea5df3c97a6199adc0706687d7d54484d332a0c6fd26725f8baef356

SHA512
79f15f29ee0f1684e96160f3d15e209a53259ccc5b4233fd2804424efa9228ce4826a4a78675ccb66595965e425337dde7572f7da7fc83a344bbaafea61d4f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
724cbdca5d76f1a16b1c4c125b41d6c8

SHA1
4a88498a6d1119f794f93ccef388ecaeaeb9e13d

SHA256
d803cb6ac8d760c3391572d2f55f94481dc558a34dec3d0ffbaaac48ac23b9e0

SHA512
f2f921d28dce66801946af0623c04389a7b88bc059bbba4c6990acf1d53cd106b47727dbfb9b8ab5b7470b84a012019e50d1e4c45b68f1bb1754092f0ae4a294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7acd6daab5c78a7c7761ae5d3f6b229b

SHA1
753ca96c5eae89298370aed2875d03ee738f7bbf

SHA256
483112072047006cdc6b5b962f5bc4a240d916f49325c031cb88ca139350c465

SHA512
93dd36623b4aa8ebc1c77be6a3372742831ac0d60219cc62c7e9830d5469b2d9a4782bb1f7d1d67f1015373b5101b2ac80a9a1f09325a98c3cf78db0aa8fcd69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
445ad9d5daa2e10bbd51fb0b53c52f25

SHA1
60acb59a6b22cc57d685874dc8deb5eccf5123c3

SHA256
aeaade4dc45ec35493e17158a0bef3eaa264dbc4d1393bdbefa1d09ac147d38f

SHA512
9c548d511d321fa8b2551f6431f219bfd4a76f0ea1a72b4a706a5704e6c0d21b04b2149a320ec6d740dfc31b224599e2581d9c1364abfae1add8905e1ac933e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61633eb6f5f06227129ea548d6beaf3d

SHA1
8dfc1ecf66d52f455e99d849f1b3b3e83f91e780

SHA256
ea6b605e70b986b7a3b40fffef899a036acec2bb3445a5162fe5ed5a8ad82d09

SHA512
a0b3850f43ca39f065fd5cd52055bc82a9f8452399c26101307ade6537d7b661771b5ac78dcf329f54d0b78f9d2e172fba37104d7676ca37a05bf77743682d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dfcf1b129064992f089c5258b354103

SHA1
d255185ecc6b6c47420e69ae573ff6bc2d3afb1e

SHA256
70c56d208698aba56d0c9ccf83051a77af6ac69804ddcf0593f4b5dae66c8a24

SHA512
a4ccdaf429ace84244970e5ebc4f8d3752096a1e03366270413da9285a3dff22d02d9335dee275e3c24bd1a099a4d983f37e09b8ae1dd41f1bae700730eb243d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eec146315e9c33e2cfdd3f251d982640

SHA1
c960b80c2d19ad280fe20787193658c46fe927bc

SHA256
4535d07f77e373559a0c79636a3cac749da700aa0f14b7bf01540d7f105776a3

SHA512
b7794c26b15076e41c0da329ee23babb90a0bf78591e66e229ec4fa37a19fed0edcaf5744072654a33980d1f10684eb882bab9b89e912291b9d90e29fa354cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ed33837330a39d0ce7fe574abdac26b

SHA1
c10d5f6601fa53eeff3a2fcf80cf742b4b836849

SHA256
bfbbe58dd6ea058b678cb296e033300f3bd47d37eca6e97379e69eb25feec661

SHA512
9edfc611315862b6d24f48292c13295333dc4b1a614a6b282556f89d165934b76a811c6bb99d2de404115bddc64b80a9e2aa53680dc4b2cf0f1ca92e85e64c0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9160e0b69cc264beca69ca7e51591b43

SHA1
4457d9dc9613f033c8c84a6f0560601934e93600

SHA256
f66a84d64b8790f62ba7948434f7c862798177638558c433992c6a658209a17b

SHA512
c97b4f22ac192d058a4e8b8ee6f87ffdc76653a33419cb8f49f87251d649b7a985273aa450dfad1a31cccd7451f0b1663fec12d872d9e8c483223c046903e8bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cac24fe245845ac34b71038fbb2e8ce

SHA1
452dc52bc73a495460b1646aaa3a28e64ef304c9

SHA256
1cf849341ca707a2b0507aba9e1b7bd057b178c994a99628560c0023ce5ca9dd

SHA512
e0fe9ecdf565f37cd8ef0e5320bc3c52409f7a88e4447607475926a811f9b2146eb9009f47d809b11dc251b26d06737c80f8c1f9c4d761d66bfc5d2d044e3be8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76c4109bae9d5eb2b7417d9ad1b962e7

SHA1
87e24eae4bd04beeefc9569ddc8aab16dd841d70

SHA256
0ef4629344d00e87b775b8d30ff2f53550faa0b4fce91d9aac13c69356e10c5e

SHA512
d94455fb1d702956049b94db099bbd56ea58e0f2e58e09ce330fd767c4174a20a1b5a809700e2272ead3228d74bc33f779552d0c5d0275df2d2d5024971a1eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8caaaf4369f103e5b2f1835609bd3252

SHA1
1b1ce008ac4c23e65c487a5bebc4e244dc7804a8

SHA256
49e5cc3cc5674e42ca00a0b5dbb7a6f0318911da72e0195b5a09f94d9bfdf171

SHA512
5d9e7cdf8a8c4d30b7a3bd19f62fa52178418e5061fdc8d6e2605110204e70baecf1d97cd299cba594d6c8b66df8d86aaf7dbc797d9c1e3e37e7adbbc69bda44

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD1E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDCC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit