fc5effe21110c443b101f538b06bc55f48f26a601fa7e56f69f7533f8b584f0a

Analysis

max time kernel
69s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c950d4333d1355ed855a23cb41a9405_JaffaCakes118.html
Size

1KB
MD5

5c950d4333d1355ed855a23cb41a9405
SHA1

91feabbc206782e1c63a16378d063283e97e2563
SHA256

fc5effe21110c443b101f538b06bc55f48f26a601fa7e56f69f7533f8b584f0a
SHA512

6929d07c3b3e31e19430cc8bb65a4a3ad711c47cfccc0a3c513df736fdfc7984614e0da914beddcac09e51c5b184a5c663663157c5874513d7646a2fc0fc5e4b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427565697"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0528C91-45E5-11EF-B29C-DA2B18D38280} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c9255867acf376462cdeac35c22cdfdb38e46be3e4edfbeffd7250ad631177b1000000000e8000000002000020000000f73aefab4f49badf4d66118e46b3617dbd07f903adc7ab8ac606a4fa1e24903320000000b7dd5627b34befcaacc3f7116ef80bd676ab1aa23bfaa8ca95b0655cf0890c33400000001da39688e7b5460449211cd11026bb93aba0a91440ecf1efe0d620a00964c0f09f79cab38d49975db85ac42ad88c4afa9f5103024a4c2fc63cc7601d16189031	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80968a92f2d9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008f2e6378074c8c75f2a9d8cf06d0a8e16b95d9a963d7b6b351d2b2829a5f828f000000000e8000000002000020000000498e87fc023f0de3f27ace371e3c5e2f1855098019185f994836530e77c1853f900000003801efe86f3667681b3a20c0d5c3754cbe2affcca4f4cf6d0fe9f4d1308c07450b7610309e3e9e5069b81dbac84c51133cb2452d206df7872e0e24d961feffdf8247f88e253271a6a59054b25f4be914cb2aacdc5e7e1b73c079291cbef1204949419632674adfdbb94f79f2c530d294c14c1c5704b6f1d741a20225da0f57ff3d3282d178e40c09f5990817acb9fafd400000004c29bb8d45fe8b0a50a3ebe371b7de58d1b689b065971212ed1e21a7676bab484a3af9ca1e830f1ab783bd4e94d302e915e9e4c1e869c60802e7cc31c262c54b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2472	1656	iexplore.exe	29
PID 1656 wrote to memory of 2472	1656	iexplore.exe	29
PID 1656 wrote to memory of 2472	1656	iexplore.exe	29
PID 1656 wrote to memory of 2472	1656	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c950d4333d1355ed855a23cb41a9405_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1faca95c7bfe1bbea0afe5c9ae8174b8

SHA1
4662fe77a2c18b693ad9f3d4d17a20a480ec4a17

SHA256
a975223af1799c1f485a62841103c4915d7ebb7934180d32bd1ec26619259adb

SHA512
ce1e93a96b5aceb902f8459089a8e45f7e83db9bd589d61b1e16c957209be931344e3e7c961ffdd743b347060092d5c071f7f24bcae2bda047c9c67a1389ff84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8fb3ecee3059e4e4658e659923cf4d3

SHA1
37aeb3db965f97d9961e9fd7384edcbd47d9c121

SHA256
476b071ae184101dded8b7d371ff160531aeb343e4e8e7ee30a85c96b04bd0ef

SHA512
ddb05f78aad7f8d8e7d242f631e983a999f5019416704c5c8670c3dfd286a0ec2477b355e89888354fd7c722ec7aa4cdfa597a438fbf810ca16c04bdabc9fd63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c8a79dac8c4627d35b539ae4feb9a2b

SHA1
24b088c0085c82b8365c3af1d0ab6947ae2b04e1

SHA256
d5a327db769b1b1999a06def9bf4b78ce3c2cd61eca1d5f70259a281b53c97c8

SHA512
ba1d65c4b1f51a2c937ba4829425bfba469b581a2e5b4f9ebb60ba4e2b7e15b04be4388e589b5173178cc37cd262adb103318fc18dced31da310af4afcbc872a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a06912a3b82da634c96ba20b4fecd89

SHA1
432e6cc126645c61bc00963bcd79c79375d445aa

SHA256
ec2f9ca35a5ae44d695723f703cbab812d160f92a1ec6953a929f9386c7fcefe

SHA512
c2339754dbff8880479edf7e6f4520178fcba18855fb582ec72823782357c9e4e4310fb732fadb57080231a669b0cf92778f5e3ac2898007edf3665bc01c54b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b17cf479647c5abf1a8b255c853ceb8

SHA1
83e1d40ac85618b10af960871cb3c851516f82b7

SHA256
50e30f6aee00d1869fbe512666cee82d7ed357e771841635f5a6c287f695c6c6

SHA512
b8fdf697416c777cad3eaa85c950d8524d69ec0e719193407a5122d91c37eb0d6afd4872e3a48e342247889864d3b385f805de1ec64a8f8a3e7314a7237c1516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ccaabba4d9e7dd8ce2e610f1adcc982

SHA1
2dc3089dfa23030fb1a3cde8167f6028dfbe9d90

SHA256
c5a72d92eb87a768de48581e134e78b29d14ef2b5b46899ea8604f3d9c1b0b05

SHA512
aec19f002e92b3430e260e23839253911024c4f0ed0730e726a994820b2d498e965103f35f4c78784afa57a1af00022bf360eb23f9e6280fad8917b7c974434e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b689aaab64d130fbb6c2b134faa9884

SHA1
f0938ccfadb635229b323ee1a31981a0e5c8e61b

SHA256
6ae23bef424e454ffd87d28a7baa36abcfa7d88554636213d48b64b1deac2f9e

SHA512
78c08a55093187f9cd7bce9045c8b57e50eaf0712c14eddc9a0c1acf45d8b763f97def4bd60bd872ad999b994a5dfcbe1953912b8fe7380fa37c978d17d25e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b139bae5937cc5b580bc94a0c38df2c9

SHA1
ff591a6f024e7a80ebbcc8ee1216dfa944c9ace4

SHA256
070a8ca07c774b3f800322160c557d290f3dccc363b2e77aa6b444efae3eb5f6

SHA512
2268850d67a99273386e4b78bfefb0c30cddfc9cf0ba8320a9515616da77cb8fa617172b8f84a2d8c24d3d520652360842587f2dce2c071b35f5323c17a007a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e40a94defc8c3d0c21f015385b2a020

SHA1
4874c9dada2deecc92c12bbe1f2a434e70f03650

SHA256
ad43f587fae46db4db6da98dd3f1adc87144e8f268bf889f8867877fdbdda303

SHA512
a59b843f0e1ff56b0e68b121608b7e3997cd913245728d3e3eba804bd17d0a919196a33dfc75471ae2c453ecb12dc0b5d3f9aed64fd321c529717ccbc52d74e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a1ba22701f10006a11374e43e03d2ba

SHA1
e74cf40130da03aedd16391528fb7eb327f46e5a

SHA256
4cd0a912a538b8cdf7d5817874466c10348f06d96a7b28c03dc44816f392cc37

SHA512
cb4fba107801f87c220b4dccab5e26875661cf1474bf9245d227c57876cc47fdaa5b4d9bcdb7f76f0665f158a6f5d5782f0e36828396bbb8ba5b0517f1e6807c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cd1a780d5ca44725dff113b9e7151fb

SHA1
53916fadb82fcdb36de8b126fa40f4fd9b5b0145

SHA256
f002c160478a15328f2af012cb8c382007c9bef829052a8904a5fcc4aac9da5d

SHA512
dfd5c2489503ad49dfe739ed412940f042a493adb9a175f476e32d48d6d0dcdfd84fd1e9819eb5deb86109fc1dc2c34bd5e0871430fe167c5e01da2c4f5b5b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ee234a4a6508c56cdb190286d644169

SHA1
fba2c6f34fba8a738032e69ddc728e106ac6fc48

SHA256
77b9eb2475221209f2fa8639bce7b33478f8c4166e6702c948849116518355e8

SHA512
9fcb653471f833b84237af44ad5f3c05ca27fb5aae7aba553bcb3766313637dfd9779894c1521dd345e6bd57bb7f856c373d58b9679fd9706ccf955c14ff5642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41ca28765b66f3dede5993c1270c0785

SHA1
ef8b05fbac17b8ad7d6610d8c130d79ec0c83aa9

SHA256
a11c8cdaeea1265bfd404638312a371b7a57290ad0b11904766e83d03d10bfe1

SHA512
98baed526b0b16ff52aa43d9fd1b785823dde686f14c597a553dd7a9d17a5fcd1f7dc03d2cc33926dd09f208dac103e3271000eecb25570738f54abb88cdaab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bbe97f7daa14c039ea929c5455495b9

SHA1
21d4db3a746ad8ee9f7ecfd51d279a9af498e442

SHA256
a3b10433a62d7322bd5131227a61d6dba459035fdb2c4ab8bd77ec62887227d5

SHA512
859b90a494960408c57609c84652b9f45a6edec77187788ea23545f396484598d75d1ffb287983259d879c4108325eaeb9e0019dc044725c924afd40260fec44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4f91117896dbe29b63ef9bac1b6aa85

SHA1
2c4f68a1b6901f3d6627b508fdced234ad4d0455

SHA256
bc33969475b105d055a1adbfc2017cd3ce5e7f8a03286dc916a3111bd71ea050

SHA512
d8e8c7708b992eb0e2c44f083f902037e5c526f8af62554ef08977d048f990f5e53de7b2d7c477ccf0c56c93fc5880ee561230a4ef38fda6cf30a33c6a347bd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe696ab2dd516981fe9e5257d55abb84

SHA1
da00f30077e7a0ba516ab02004d98fa1f72ef7d2

SHA256
8d1927351719327ba724572a2631a21204031a27774b279833f6cfdb3fc0f7a6

SHA512
4d1743758b1053bf79ac47fc958179db6a42ad7dd240aa0b693b8b89d382bfb1de1bf1f68abaadba3af64a6ec4abb03f23e5613f357737b92c14e9e02e855de9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8C0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9BD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit