fc79c9a7b427b549b6246a29fb659cb3277af549e951ed2d23aa9f367b299632

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ab81ba74b0b0b97284d1ae449aab9ab_JaffaCakes118.html
Size

946B
MD5

4ab81ba74b0b0b97284d1ae449aab9ab
SHA1

74526a8fc6131bbc9c2fb769a533114ae0990616
SHA256

fc79c9a7b427b549b6246a29fb659cb3277af549e951ed2d23aa9f367b299632
SHA512

d11a0db28b4e7f97ef14ffdebf53550a737b37f09db7517cadf0e217f3cba74ed88adb4ef6944f08cd67e7fe266186a5c30f81bfa1e36fb73e32daff693e29f6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000c13b25dd99ec2537476e5790a15ba2470e4cce5bd70f22058452a71761d91e46000000000e80000000020000200000005405c74b68f456671e858ff38dfb054cc47115ce308cf13800307194f02e27362000000095f5054287bd79e15e553fe4851ad1e0a30730189247a4955e09f727baab029a4000000037b9a59d21b1c6473dd573a981f48544a63352762302aa029684d45e17f87407481f3a1c437a7e4dc9386a2baa5d36d886f417a39ab6a59272a979be1e6c02af	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000016db6a0984fdcbbf249ad74b2e2dc0fb6e23ec6cf2063d099e4f10944387987e000000000e800000000200002000000023014a0e83b6ce7025b36ab2b360f41d57e840d03df6c971c9b2aa9d9e4eb6559000000066a40a77961e9463c932a67fbf1aa1d92d39d356f70d8a46e03823dab5868a83ea372d02dd6c98a16d93f363abd52c96e2beed53a885ecd61aa22bb038f140cbac73706ea50a43ef0f8e5b8106e9029905254357359109f97f1b6d88720d4e1fef04af4749d258c122c00f43ecf6a8f8c086d0f5f10c9a81263466c3350886241a6bd9522ec3e8a5199f7e97cd95b00e40000000102c9eb50cb9bfb7d22da271cd4f658bdd2d63de6382ad012404d5d8276cf1b3b906cbee8b6f3ff8192771ca3fc708fd967efef95a34307bee9dd258ceeda57d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4880AFF1-42D1-11EF-B707-6AA0EDE5A32F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20678421ded6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427227077"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2436	2340	iexplore.exe	31
PID 2340 wrote to memory of 2436	2340	iexplore.exe	31
PID 2340 wrote to memory of 2436	2340	iexplore.exe	31
PID 2340 wrote to memory of 2436	2340	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ab81ba74b0b0b97284d1ae449aab9ab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6367a70be6482228ec14caaa5388a7c

SHA1
f23aad07b2f0a4a8b54332b10e85ec43af1e387a

SHA256
d00fca6af50b696dfa8614fb84cd3e4507008defaab8319952040202f83e4cd7

SHA512
fbca20d43378e5d640d08582aeb7498020abccd035aa9bf03e7c1eb1fc2e305cf938ea6fe8ae0128aae69d53b426082e43d87a61af98ea66935a3cb7ad1ff3cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55af6afb9db5220859f62e8ae4128c42

SHA1
d7e00e83447d032c002c4d91b04cda89b94d9119

SHA256
1198f973e57369d3e10b92b096acbb26a03b5a091cd4a12a2939165277852ca3

SHA512
e151dbe7422a0bab1455440fac71ad382c86b9b9898e2f796ba5e34624d414ecfdfce950828d5432a9b66d0446b4f0e205f397553ea7f9c1ff4a2477f7440daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c58f9ab72745a83b98b490d720ca718

SHA1
e60da7786fa5756c2b85aa1d4827b99308fc3f75

SHA256
24bcf43fd9036b5eda1c0eb8d8ca2e497a387e9d365737a4e274b15731fc215e

SHA512
80c1a61a77097fbeba5a82062524f1afee6e8b0804d6920b9a4e39e825acf1d9fcbf3f35ce0f85cb632c2511aca07fda313396564ffd0c7b6084f371c2f5954e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eba02cd6d864bd40ae7c5c9872803214

SHA1
9475a2b86f130bad4bf29b24ba0614c3a58e1a5a

SHA256
05b66855447c7c9b71192b58a8a5df51675939a8f3a98cbf3d6762d0e64a69aa

SHA512
44010e49bf78ea7559439a953e57a7f2057ab43829e36a486078cf20c2d7ab0bb764c6b8b7c7df00fd3eae0d46038a2f74f04d3d0c9846778fc317d197fe5e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82d922f3a5d4995e1f15bb8d352ee839

SHA1
4d6b9f815a5c84ecfe60af829317958ff81e9de2

SHA256
213b118ab0457e32906be5d4b615dd846396e85a49b6d1544358c803391febdf

SHA512
30d04b741bfb6d38b185a720105d60780c9214165f5ff87da57a88aae6b509753da0a14f808ca8ebebdd3e1527214192507ff7e02d76581bd877aa80d9f3de39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8a0b0cfdaeb1147393621d6d490fe7e

SHA1
111d0d7b69b2dcdd6d2b743ae22113f39032496e

SHA256
92b87d7d70c685df01264f7a13edaea13c4dc705784d42d48a8d311910396c35

SHA512
b82cc23e9c5374095e3460dda59c3d28ed27c4d3a9de652c045aec07ca93ef3fdf5a91d64ab4ca59aa8c2ca9c921bb11008aeb8c7d508eb820f1c2d8ae02a1dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5e76cb83a2f7441f00bc072a1cb562a

SHA1
dd59f1ffb5c01499f5e19a83139ee346f35ae114

SHA256
a733b0bb9945d0276d076b1c06cd5441d29139008d8f2296f45f6bb38c07bcf2

SHA512
8c958417b0e8d22a088570f41f48c9d80980baa91d922719da4557ffe7097bd6b2f81ff7e9415aa22fde4fc20dbe0f09833e46e648137625ab27fc6d911b2b89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc81cab98ff7731a90edca8a823eb20f

SHA1
5c3a9da6cc4a4d5cd3bd724ca4ca6795b39351fc

SHA256
1b37112f18f6df34124b76ac40ef62314e229ea1625fb25dd3545f0beefe45fc

SHA512
4a78e27bcfda9ad6e67c9442b2a415f78eb811f383230e94972bc2855c68b72b8faa27b468086dba62d96c4238c3848c9f2c451839e27f4aa311ad1779b9eb19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fd3eb670962400a752718f93657fd9b

SHA1
a9297273a7cc08ea24d36009ef07f666d21eec04

SHA256
4c9d5737f44eead0fa3dfa35a0dd3009c0e657968c16c9cd059b0e40c64bebf6

SHA512
514250ddf749f07a437cb0f07a680ffc4d33a7afb35308a257789246b7408dcb9bbcd23fec33d090d38d2ad52ab9870391b3249f9cab586add42d99adaf68e6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9adedcdf414f094fb5d97c4c54bc9f9

SHA1
9d811350643ab7c1eca40a48888ad7f8e3fa5e6d

SHA256
1cf0207ea198e11aad76f9788e5cc05ff1e94be3fab6e8d8a297e95ab3dbec34

SHA512
a995517a7ff5afc64cba2d8f5872427016aacb56854c85131ed6935d8e594906a80defafd7b799a0e45ea2fe4ca85c628067ba976d0753bf99226e48e426b38a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd4ef2201aa65d0e561f08f71d4a8820

SHA1
e5ee238af37ed4101d17fd2b7e6d36f0e6069183

SHA256
99a8e86b39f693203f7b2db938b507269f1603817a28d02d1c2551d2bfa4800c

SHA512
e8c9a8ef16533f6cac08f9b792f749005cdb2f19d4d1d7f5aa75be502c439e1e77da50671a7baa6ed48177fd1f4a4d6680678b8a5fb292dbaa373111f8328d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdf907bfdca35f41c7fd31e30ebda5b4

SHA1
b49210e5798819e1529cf6bbcc1c72bae2779a8d

SHA256
4532e8ddb5ca59ce8bab52b518820abd3937e607e235899895f478975f0327b1

SHA512
c9b2659b5a5a68b885a7e332cbc6a318e39a4aa05f5042be656793b8915a4b5bf9e66e4f8bc963ffe36507b77bb346c9c6d8aa10d8d2adca871fcaba34eb4926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba0d273bb7b05490148b6566c93fcbf1

SHA1
79ac26c203badaa14c8f599818aa2cb8e43471a9

SHA256
2cacbbd81e51e18685b2a4979d1d899abebd16718ad7bc3c359bd0820f2f89c3

SHA512
acf4072edbaf8c663d3a8087d9f7b0d4bdd4299a35fc72c1fb138bdba9251af8881bb1c0004adb4c39e6291add2e639bb47930d6db34cc80ac78da2359687c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
675a8d8e16740bff52df2cee470bb074

SHA1
7bf0e80070ad664217b0d2ecee152cc148911242

SHA256
911170e7e6e4cc161f427c627c311f37f257518b4b2c776ebe4947d9190ec286

SHA512
d619de379a796cc874be333fa2c0a0f1153cfa3b317ded657486ddaedef7e87d503f699807289f8068fe5f9065d2de989410eeb24e32afcbfabb726c33bf7afa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c7826656bdfa9eb4b403cd0199a9b3e

SHA1
057de5bf89191c19c4bdd24eb31040d2fe6b931e

SHA256
df68c34d6e1008803720c07dd398097b0d64c514d6c7ee538a9ca4034c338d9a

SHA512
23b0d86a0d7ebf09426689ae196c47bbb6c0f9f706ab0e3a4b738903dfe2fedb66700c18d1ab9f538187e9fa1678f68f8fbc1e408533ac51413fe6f4a3b737ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8b0c547abe69f04c83d8a15df7f9bd9

SHA1
4b7264706e841bb04ac5b563536bedda62b65f8c

SHA256
424b110470c7bf1a319ea03a0002a1466ca7555c90764dbf1dbc5ae440ac3487

SHA512
4ecc4e86c98a536003baae922e431b3b7c1755dd72411b21c69f502fd8c89a6feda2322e434d0fd5b6934dc83dd673462548cb19042ca6f501d1b589993c60e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
746db312b1954f563a52feb4b0aa8855

SHA1
bb9f2e5ec2062cf446b7941462642d341dc084d5

SHA256
e9b8b4021db93b446ec5d8da3dbbf4326bdc455b35577a487442ab8f14b37ca7

SHA512
71631b4e3a1236ace9c0681c3fceae23f7d28902d79a24e98c7e9f977e297df2de78c98656638d2537d10dfc5b93b5cec85c09e8bdb735c4fb1cd8df51599f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar728.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit