0136502fed5e1024914bb307cd8c7e842354c8e2da32a49c79eac87beda9f653

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ed685fca96808248029962a6c6baefe_JaffaCakes118.html
Size

1KB
MD5

5ed685fca96808248029962a6c6baefe
SHA1

abe24aef6422c4e92408db950d61fb2cabd185fe
SHA256

0136502fed5e1024914bb307cd8c7e842354c8e2da32a49c79eac87beda9f653
SHA512

c48c41613997834ec7776a4cf0e290ea93732cf3a235c6721b4475e0d02797df24422105f803c7122db95ebb2be492a7d3d00bce098b8a2aacc479d7037d54cf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427607542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000073f5cab0b40462309e95b6dce417b7f06732394c04fb89f713eb52a6d7f62724000000000e8000000002000020000000f3b485f57c384bdc548f2313ff5bb80cc74cc38afa6c246f159b631a020e6b7a200000007ba507686fe510be2d8436601057e7156449de99b49e6eabfd2069e78d04a8864000000001788a0201866aa69d6deb4521aa1c22339ba75ce15ffb99e6e5c7fb551262937abb827792c197f591bda3d425809b1ec59df0a051ab1bc0b4480d684cb4abe3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a7930254dada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000b1f9606aeac2b8d8e290490f3dca40964c4a6fc180f4ac4451404ce2c440ffec000000000e8000000002000020000000fa0c9e75db4d763495fe3f1e52eccb8680ae536d201097cb59ff17e73d8e9f539000000065bfa91d3c106346a309c607a1fc3702c30124e658db769bcbdcea1adb2ff00cf9a4d07e123ce06ad49c2d619d3fb7660a5becc6f956c1b287e030cd038a33aae80266b31585d829feef83e5e0da94e87d81473b092ea84e996dd8d01cf7c3c8e7f5189b5f4b2bdd9625ab94912176bca75be4ef736738a5f10e5d8e913c078f59b777c908d2ed8c68b7037acb65bd8e400000003ca0a9f8c1cc549d71b619c3678586771cc80d1989807b353968195360efb4ff308d4fb86316e497b3b362f3c989c6f775f36bce897fa8c57b5d8dd212c7d34b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EAAE001-4647-11EF-8E00-526249468C57} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
328	iexplore.exe
328	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 2392	328	iexplore.exe	30
PID 328 wrote to memory of 2392	328	iexplore.exe	30
PID 328 wrote to memory of 2392	328	iexplore.exe	30
PID 328 wrote to memory of 2392	328	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ed685fca96808248029962a6c6baefe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2112f8e3f8ca1a79ff7dc4135606ea11

SHA1
f71a6ef2749e34ff1e4d2e9127c979942e2eefca

SHA256
c09179c4baaae04e3d3f1df641a8ba8982adc0d61b85e1bb0634b31213abca7d

SHA512
a206dbc69db4f071ef8454f3b94700fd08704c7bd7a9d3be1fe00db9a13712cfe691ea19b0eb970214cba9c9bdff5ae36a1e940ae89efc4d01419c5ca1977ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8c6a7c49b9e91cbd855c04c2a7c2ab7c

SHA1
d39ee7a5666e510fd9e1c89bc3c61a7e6eb66db6

SHA256
0786a68bfb69aef4e6ac79405f1d54113d8b7e93e9575d2071cab1b3a3f5fcda

SHA512
d21ff1e4bb9aae1df9130b2426fb404d6d9a462023f23d40c1fec7e344a4491caae3b2f93be5a6d317e46db719b50cb9ec7373b906800dea00aee67f977addca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7e66ed662635b5cbb1d97da31d4aaf95

SHA1
52a2a80bc5621670c79cbdd8302de535cd6888a8

SHA256
29c78853f82bc70675a55f889d0890ac7d2fca36bd3bd8494d0073fa6bcaa976

SHA512
5b9f674f0b74de1a84e611e43fad71ee1c70707280f42923499820292966abc7fda91336b636b2a78007f456afd3f3164ccd672d59c858ce6f6ffd8bd70ac36f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9ca2b8a6d676bf3357a7c6709a15d675

SHA1
b90b52c5c0294bf7507e070b4e6ad030c6d4f769

SHA256
6b8ac850c828fcc43dc9db77ddac27751038dac62450efdabecf1b9fd6f796e7

SHA512
5dff615d4445eab7c6f96e655f201653c42a86e7f5b882d9563f603291f74be24e246352421195fb44afc3d701bcc7347a851f87ea73821abd19532e74fefca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6762896d64de1c45883414cf7b2da82a

SHA1
898067378d1b06542c9218225a75e65cbfcf82c4

SHA256
e04a5d199229d72415358c271f7beb4b8b39a17ab2b9991938f2ab6bd56a7d5b

SHA512
8be42780e45558429b74c59c8d3e09be7fb06df5b1fd806362d3aa6091ebd9c15c2cf7e9ab16710b0156eda037b06b62497e4331447d60919f4636e0100741be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0a8cf9db952adeb35a265e1fb397421c

SHA1
3c3b8f933333d93a88540e6defac79ccb48b8f56

SHA256
5dece4236191e404069e5e6c5d72195c9fe2a82d70323ebda0085ea7421e8121

SHA512
b2b7491a5bfc01bc870a299382ebaf17d913f6e3f3c25e6ddbf0e2a7c02a47ea6a8ac5b59e5c195a11d20187023d7438afe4212fa985bc531253ebfdc98db988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c274f1c91175977bfcdb2358a69f9db3

SHA1
8788a6de134dc6bfd22d525f376090c002c07647

SHA256
adf3dfabfae26a3c9cb173145c3466ed51e5658ff61936ef667abdcc3185b019

SHA512
545d464159d945e63e4cfa7e5a2d7f8a38eef18fa3ab87a355076c76f8003c7d4fb81d6ddf4f4c721695201258b3d36bb4ecd8742a3184245d8eb3459ff918e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6c2782c00a8cea64eb52654919766ab8

SHA1
9001aff6791726d4f37602e392dfa478da6f2b4e

SHA256
32aa483dc7e798fb8d26075869cfca4bb2b61a49dd111c1a0cf0b064d2a9410f

SHA512
e0bb1afe292a753a1878d35c962468e43fa772f9a62b5f4031f801104262992836a5780ecc58e6fdf64a6a6d17af11733357b369e5b70a6a3b60dfc4cfdec97d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a331a1c6620f2bab775c9a6debbaaa49

SHA1
838f93e78acfd357ab163514a33450751056d36c

SHA256
9bbcfb51672f12f35fe7cadfc898c8cf7b42beaa047d3ae0ae20248389c45f0c

SHA512
d21209d3a02e782d4a9917712a87bb058fc40e0c15859f8f29be3645439d4ecb15841da774302cc1ad463b099a1affefd66b07a32254a9872f6fadf3be8d5de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0da20b4d7ef444d42c5f144f591309e6

SHA1
7835dd4d3e05f3d3364cf9047abe85e5eb8105b6

SHA256
aa4727be65798a56a680d14b238fc985a34b1039c895553f43d069ce86de2eb0

SHA512
94348492b3e1b016766b438a09749410cdf9bb8d668f0b31973f77878b055f0955b2ed0338c9e441aa1e2993b306a7b96073f6f970e8a49f4b731ec46ee6ea27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
42168b6c1985513ac0ba89ad605a44df

SHA1
5c5c8e574d52d28ec9331fb4600afba54069a4a5

SHA256
021e848480a6bd5f1e1d41e010490f0edc184da3d662bdff944dfe137eaa8efd

SHA512
6c0c930c6553a549f7d4478a728f2d138be17869d57fef89523669e220b47a8da11c1416ce1923dd4b86f3b71fe5d20fa86d22e33528622db14c680883e06d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
62c8fd9370f769d178092b14e0a978dd

SHA1
a0aeba44e40e51d2bf03e081dcd92bb932c8c229

SHA256
5b6215de19367f6d41c7faf1a2663b70d62483c4bf268e0091c31f6a72d0fa13

SHA512
8157fd2c08c0c007b6de551808311f4007149ad542287edb36f247a891f9dc92a060fcd70ef8ee4b1c075feac5a6d3eb195ba4480c8d0efa97267dd3d584db7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
42063cc2f660005e7a0fee8664b09b9d

SHA1
eb6fe0da123cb653d481f003f7cf40d6cfd9dadd

SHA256
b415d812d0fbef80a1fdcf3698ad3bd2bfac3156f9e410a62ae958ec17d63578

SHA512
f2ec7a977ba39b79cce12bcdaff31e93d2be56f726278936f11bd880a211f1bcfae54da9078b866a64d1a1a328004937b8a8a1f9f571703b17a018b45430e5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f3b769f531101b8fde0fbf605365bfd1

SHA1
2d1225a28748d6111cb711b55e9f29611d26b0c8

SHA256
7bbe20bc94d2957d75b7fa78ecc2bcd298b0da90f1ad647968952766bba9cb1e

SHA512
3ab4172dedf076d89bb582c74f19f9960e132bc96824b8827571f98901bb1cc5ddda4f349b65863168e7191912e3156704cff7bf6d068191e3d569b26597f1a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
23e0edc6b3b026c34de3568c9636df77

SHA1
d602bd5d757dab5f7c282ef95528f49cb7b8d19a

SHA256
52b2fdb0840205575a4aca3d5c8543e9e1ff57ea0bc933242c64bfa8f5c76395

SHA512
a28463a0630995410e9487722090203b7ecad191cd66d87ba37d376f0f1f848043c1d867da134b9d19d945ceb6ea299a782ee7b4a5c154714cb037fc801a6860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2fca9bf9f3efb7dfe95c272cce019433

SHA1
02c4882a81a9c2118383872a7b62dc4202e25466

SHA256
6199781469f3a27433557ab5fdab25da29ec3932f334e0ed013fea44b97a7c74

SHA512
909635927fe4e798cd2706986bc06ecf381873f8923d0a5d32903e09ff87fab79d5e97aeea0a448948a94436746f935087226f43f746c39dc86bcf905a2c4d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f18a29aaa9d550f966f3234f7fef8e74

SHA1
777a4b7f38e3c0afb02e31923bfa9636c17f0707

SHA256
51ab02132d5c0f4c97a0431c967f9a5e1d5b659d55f55bfa7cdd58db1d442c9d

SHA512
f944a173eb218c428854dbb7a890a2daa8ad7d063db73154a2ad57dad327c566d7ac95f3d0bbdff3d58b49a68e7b36f4991328462722919104b913ca6d4c831b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3269.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar327C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit