d645fb3231bc04d121d2ac3c24ec0a3da5328cb69e65e6fe43238cbd934a8c18

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c710f15884c19c123ff69e60a21deff_JaffaCakes118.html
Size

1KB
MD5

5c710f15884c19c123ff69e60a21deff
SHA1

a4cb26074c3c84f11b02f5d3edbddfb108d6a2af
SHA256

d645fb3231bc04d121d2ac3c24ec0a3da5328cb69e65e6fe43238cbd934a8c18
SHA512

5740510766ba8e1c8fd7f8f16ebcab6d0eab00b65ff48fa776d36052289349ca94cc22fa46801feef7bb1a92e4bc638da6f3371aa563ae4564535895c01170d5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC530C11-45DF-11EF-B001-72D3501DAA0F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000b1e630a065d7c24be30983e15fdbbf1977f87c0703df495560716da4038847d5000000000e800000000200002000000061032505571ae7d978d8cba2d57a6b6f3586c506ded9b05bffa970ba4dfef2352000000040d8488ed40380dbc5d3598f61f08180449e7aaba38a730c817c4361e787cdfa400000001ee0707622bace6bb0c83765e1a19ce7e325a050021fa5a9bddc2961c037c3f391b956196c64d591ed4d9facb3794473cecbafc6b25903bab010f52c4d97d476	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000053f96c23046b60c48c0a74ad179c95773bb50befb51039a755bd53c00b9255d1000000000e800000000200002000000093adf674980c59f21fb9b17ec271e422537d9ecd7f3a658e52c3f8034c77d96190000000fd5c9edbb3c26530dbf21d25c85b65c14dbb0071db6e20d5afc83d73079ae6b3b6be7d98d0921070301e47009ee8b5e9306841d497bf37f7a4b5ba16b970090e1b89c59b869aee199570a98689b829d6b8ed1e5b4c8f70ba09772f64cc417c993524d7f9c30a3fbb7465d8e3cb4a6eefeb582b96ffa83990deeb9f346d9cbdbf3265f3931260763f4b7c5ae928cdc0b7400000001faa5f432d2d640b9f9df1d9151110c9112275a885601bda7e4593e66a297cd9c34c7e227bc48dec607bd5fcca7602d5a017f086eb094602e958b346294c977e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ee3685ecd9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427563112"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2288	2952	iexplore.exe	30
PID 2952 wrote to memory of 2288	2952	iexplore.exe	30
PID 2952 wrote to memory of 2288	2952	iexplore.exe	30
PID 2952 wrote to memory of 2288	2952	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c710f15884c19c123ff69e60a21deff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53132388fa1619c752773f39b56cdb8b

SHA1
023557ad0b60fee7b5d3a35e5b3db36c97e859af

SHA256
624eb7fbfb682fed901000154ac9d900cc3dd2989a44786383c01cb3406a5237

SHA512
350e7ce6d408808feea05c3d96f41cf27b578b55ef27548dad0c2d8719791e054d0199d38545245b9522c3a7aaeb9514fd199142890a4b77e6444dd9fd8bd7c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a4b6c2c0c2745cede0de22712d9558d

SHA1
225c8abfac26021c3531bc6f9bef5b74d9012434

SHA256
6a3ddaf66285fac41ccc2a8af9c8ee9a51e3f2395d34152ca97c747bf15a3b11

SHA512
19d292fd16dba833f32877b2b88c523bc899b28fa9044702a252ddcff69532f45ec2281e76e2c4eb03cd6d15716f2021259b81fef299bf9be4bc4a013021f726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
564b5176e292c179908b1d665b47f0f8

SHA1
e9574e95a6298d4251530d2a276dd5a16c446b44

SHA256
e47e4a3bce87dba565a0eabc2693b74e5a52af5d0cff2d231c71513612901b03

SHA512
02b3b86c376ff6211890476807c07d8718a6062eb34d220217553bb337bde947c4c240f7d211518196841bec14e6cdd529fde14586ce301a337414dd0fd27a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
493295e570e377a0a1c5370563bbfd15

SHA1
854cecf759ee6d99694cb620b8fd223bfedd4da2

SHA256
fcbb2e832dfe52b397ed640a355bb5cfbddc95a6967579440be9e613ab622594

SHA512
a4618048521ccddf3d6087274267f82e55e075992d3ddf52c0752a1b50bb2602b59b88fd50b71f0d3ed1221d5d4fde6c0c247eca965b0de7aaf5a97c2634fe8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1076be9d8f460843a21a55d427c6178b

SHA1
6d69edfd6b1c335488ff75f7083223d73056ceeb

SHA256
65cd4dac16ec881d2c3fe43246955341d5fc187fb9e0fba670f1a83bcaa6010a

SHA512
ce580b8d04df024593e0c18fbfe84eabd964ac6da3ebf4814bf3b7591894fa4eeead383f6be7fd96186105818c3e8166a90affe97dd44c1d4e19d71ec3e76f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f46aedfe7f8c8dfbd578f10fb2e0acb

SHA1
41deaf871f757ffb799fdbf36d71bd87b0f65b0f

SHA256
22729acd019756a42238983af34279965c0d6d8f66c793fc74390b75267d1405

SHA512
46db01d071ade4ea219c4d0d28305037c05353b6990160f0d116ad8b47f12e788ef5c628135ae647c51742c0d34861a0330d9d052aad59cad31c01cc6c8aee4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
307dd6db1abc56eeb92439c0b67121ba

SHA1
6904457916ce94306351621ff7365c096b47281a

SHA256
d4ded5b878527cbb7c53308a2cff562d01d00d5468cdb860504233e01ff2789e

SHA512
296c85194c3ae313ba4643b55bbf9a63239ba7b24cad9df474d2d62a5ce61d296a39f616a8cc21d152bbf05f43d3f79899ca585ea58644f513dfc274d7d456ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ccec60cadde9606e9ab2c272cf5436a

SHA1
f3107a3a9102c67330ce4c333d9837cf8f97e07b

SHA256
899e0b644975caf699bb633198c2a2fd07602492dcb460034a8fcd5741671e47

SHA512
0e7ce22dc768c69e8bddea8a9156709b33a2607393ab0640a51641f6a9212b14156d75d72004a0a40b526f0a33ee1f215ccf5f2499dc27fe76126813789df02f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cd1fd0b5561b23b03856b82677b7d2f

SHA1
8cb0de5e9da53f7acf9ef3fcf490340714687100

SHA256
7abcf518695faf1e1ad87c07676e5dbf64286e08a43881f6b4edbee746a3e3c5

SHA512
6f7c3b543e2bf148294d96205fd09f7c1d9f41b7a0e1ba09f6dff1823c3720e18f7cb17363c641e657b37c79effa89a6cd47d04edfe6da1e5359834c9e2bd286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c9dd1e55ffb01adb18be398f04972ae

SHA1
b05d2f9e42f27723a944e2fda94f1aa07b7a4f40

SHA256
dd020eaff9392da3e799de49a59b3412da25d0a7e2cae7943a65c6143274df22

SHA512
b391b3949faaa0ae795429533521f385035419de9af52cb1489bff3b22dc12c93a4faad48ecee151ee1a2708ea8a386b383dfed8b5aabe7555933b1d43df8cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43b19b83434928eb43642d7d71026724

SHA1
5e2c2e75d4912a4bb5356a75a5b69134a6cf5a88

SHA256
da18881abf40500d0a14fadab97a8b07f8aa93123fa6c79927b20e77662d214c

SHA512
5c764bb643e522c562a6bd7d179a0621ca05b6f3010b51a184b54b15e8fe66cd996b74c16341d2b281af297a5295c828d418618db6a92dae29ec08e75ede3231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e728be92f101f5918ebf52ceb67f286

SHA1
344115b03d0ca3ca8eb8ecb3a07c5a8d02def485

SHA256
5c73eb64aa07622d82b723c55b260df8985e399c0d013ef31b6c44b46a827847

SHA512
decf34cf8dcc9371f2266106d9d67c4ae70b1a8d6d647fdf10d9287f6740c2293a85396a6bdc4ec0dfa553eca3a2190824b29074e115bd2d69f271a3c52ee45c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8be0ddbe3acc74e7a9ab2dc8ac12396a

SHA1
f5493e342e204e8adb05d16827af9ae9dcd43f18

SHA256
ff92a17984837549fa8afa34b1d50fadba28df203e9f00e7139c3f3baa8e12fe

SHA512
4b850534ebfdd7b435fcbac6459ee8be69a8f77024bfb7f4b8d381cb9f313f43947b2fe4ef71a384b1a474780645a6547c62823c7d979f223fbb98e8aa648fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01db08b668835a5de7e559feebff8e2c

SHA1
f3a319af1bbec3a2db9b8b9ece86894fccc39e0e

SHA256
0c27b509b9556c4b26d4210fe81511c2d3af5efc1c2c6c217c68bf16e21a2334

SHA512
8c0d761934c7d58ff52b3365000b4e91c76314612ac13cc79ab913581717543eadc60c9c755f972429fa2822f93d5e8481d95881f2757dae7d5e73f2756e53ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FDA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar305A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit