4a08f42e51f43679757a7fab8d67c3b0728f2dcb8e7324093ba845cba8b2d5b0

Analysis

max time kernel
70s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fb0939140fd4e7f5df9abc5b4856152_JaffaCakes118.html
Size

101B
MD5

5fb0939140fd4e7f5df9abc5b4856152
SHA1

8e8f8d3fe125120d0574f89a0f50aee9c4531de4
SHA256

4a08f42e51f43679757a7fab8d67c3b0728f2dcb8e7324093ba845cba8b2d5b0
SHA512

324608b8d9caaea91e25ff88cc16f31bfa29c8160ee9e438999bea2714d2165480045c57a141bc92fc641885791549e05697aee1ec8284a39eb78b400366d9fe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000cc378542246e241afce4f0c5cc1e76e13ede9a3f74f7cbcd3fa267d69a3f339b000000000e80000000020000200000006c4f369ccc1d84580d4ee19980a240ec64de77801c695b94fc3971ea0b57158c900000001234461c9296a723af1f68b88e2852d007f340a4d961f147c70e48f0e77f5cd5947dd84a6f685d8210cebea6060a69388f328f7157c8ea143dc93fef4c816158e1faba006fea608ae5e8642769cb71a3d618a7a5906270e35a7d8563c477b1d3a187ee1860a6ab198009c51de1036c06053071a382c204ac193bb68d3eeb90798c82beb6a94966188e5f6109c33cf1af400000000d87feb604f51dec7bc96576811be1886306826bfeed53ecb83f6f4f230a54679494de60f18e68479752ae8ee3bec9273187fbb38361bee9ad4767ff3c6079dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b8eb207cdada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C154801-466F-11EF-8FA3-EA829B7A1C2A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000004b358497126b1da31dfb357f6be8771e4f40e32771c1d7cac1ca10abda574a04000000000e800000000200002000000030ae5fe01dcdb5235309061f4b34915084dbd90d99e92e97a84b37f48c85f19620000000b110b74a872d579bbb60d1b7c1b1e771156c0adf5d6bfa57d887f39066e79dcd400000002d95e3c6e14b34b379ae959eaf92ffdee58fc151095aa6ccf5b5064c1b23596b9219df1e5c7a1ac5a2dd036ebcf052322ca896b4b27e8f8f4cca6b0206fbe783	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427624801"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2180	2276	iexplore.exe	30
PID 2276 wrote to memory of 2180	2276	iexplore.exe	30
PID 2276 wrote to memory of 2180	2276	iexplore.exe	30
PID 2276 wrote to memory of 2180	2276	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5fb0939140fd4e7f5df9abc5b4856152_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fc3c84fe1410d91af8bb4f9d1446955

SHA1
55c9ecdf0b7344e39f69d171a49b8e6c0be95995

SHA256
0160d046846bec2a36cdc7f15b7ff1542f260ffc375e987d46b6cf7f0fc86cf4

SHA512
16972d576050731e7abed23ecd56b8464d0bc0d34a48ce8f26abf9e269f2b58f1135c5562c38319f7bc2aa9bbb51ea639b4f67ff82209765fefaee01aef7a1e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11c9554852d7fd024972095370390e3a

SHA1
d1dc9a2f1ba191b201ee3d578019545d1d5208a3

SHA256
ae8ba8a954eff31f3d677a7aa3cb31800b9debeb3a44b430639d11376e004719

SHA512
c2a3484e353c9af81a5f3ebeb9b5e85ce8efc79613cbd3f10ef9865d2b59c42527d113af1f98bc89d642b64e0e6ae27342fdf4a4aa69d60eccfbdcdffc376291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3141744709ffe812fdf07a8c41a9c30

SHA1
75bb9959c2174599386bc4b4a3bcc984444df35b

SHA256
00a9b7bd62aa9b4746ce2548c3ab0ea5a0e8d21382d7d022b770f9affbb69b3b

SHA512
98426ee7d7cf55218a40e44b389547334c4307810f989d81e87c98a3d2b7e85ad88b09b11cad873ade6c8bd68e44ec46c0240f2b250c03ffdc548e0c77aaefc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e24154bac573fdb1bfc047a44f3ef72

SHA1
f5567aa6d3be57b2d509b77d4add6602d662c08e

SHA256
30179e7551b481225a106590cc1ed34c36c40772fa87ee61da677a06aa106606

SHA512
135bd959beace1abcba9c618d25c5fba2df5642fbac425422a82cf435f9b65949f91fa7d2103af34b901154d3745b78df42e38a5e355a5599b6e07f2e1fce3fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23a76cdc2b1f9a45e96e272b2c7de1b6

SHA1
382f07c54e1e4faacb11eaffbd526ad3a3a53f7f

SHA256
28b6079d7dc50618b33a8de2b0a0c1260d39d5603b80c1673cc46b98eb41b038

SHA512
f78458e16510c62e7722c4902414423c15e3b8d674659e58c10b375ff9098ab07a7e19aec15c467ca75f81295e03318f64c3272c6b29375ce5678369e8873f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d85b73673d416efa946e8f436adb1bc9

SHA1
f842fe50b608e6c2d2d1f3982fed4ac78a3dbc47

SHA256
e0805e160975e67b39a5547f88a681d6fb76f1851073834e9019d753bf2832f0

SHA512
b93c3ed8668d61f22b77b135d89169dff905f541359305c934cf715ba5074662104b61bbd6b4d1a159b1e40499bc09d7cece274aec411cf18b6136d79cb0c3c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af2b08f7750edbced719143084f4daf3

SHA1
a1ea13746dbc9f91a1df6daccf59131c7741fe58

SHA256
1af4c7ff65fe4fcdf79f204b4245269aea3ee08f7b1332c0c073490f2f1e93ff

SHA512
284bf0f392a88725b1ef160e44241891b6a2cdd574169e9916c376d3c0d9186f66137267c11658279f95f9ec1044d70bf5ce09996319611870587ad04d4505e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ccf8d9125e9d5c8e9828fe71c4bd9d3

SHA1
4ad1f19ce45e83e107b3adae0d1417b36ffd297a

SHA256
468a1a8168d2c2979c026a0a319bd16d8f73e5f4320041a78dcc29dfb0ffd062

SHA512
8c37fa5739f07c83ec8bbd9cbd9761bb95972ac27dc2362b2c2e32b8786bf636411fc7a41013d5ca0d21a9b87ad8c7b1a7181b004280fd25f4b422f880f497c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f84ee752dcc6a09d31fd2b1f90af4dc

SHA1
a47fb3d28da9c9be108963ee25bfd770a3ec1dba

SHA256
d0cfc3f92190b68dbc49e9abeca1ed63378d1f1f8ff24389bf886d243330cf2e

SHA512
77eed16fc8f6964bdc86265b490e402ed43582ab275e734c00342f09d4ad71900cfde813a7d1a9db8283cdbe5937eccda3ea7178c05ae6b6b5138c482d01f00c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d04e12f5fcb950ec63d433d2a6c566b

SHA1
61623a6c2cc46b6d4dedbdff0ff83b2a56a2cdba

SHA256
88210019c3285a375066605f99960f3948418f49d4de3213502ce0ddb5e6adea

SHA512
e862ec1df1cfdd497ed0eecd49405d24c9e318fb1b38b8a26316a4e2087a8405d61cbb85771ad55b98c7bf68804ce4d3b5528995456d205a8c6689e154d773ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e49e82e997753aae772da2dcc64bb5d

SHA1
1418e5380288a6e0d77322f675ed11293e74ced3

SHA256
a004196ca42dd75a29bfa31b77fc60b6e2e5efbbc4d4ad9a5fbab57e7725821b

SHA512
6aebf4e543bf378196a08f1ecdbb8b57a140b80957c1540b24ebf98037609483a9f9e7f3cb6f31f9325cbefb85703814cea6f3a774e7c201a9bcd379a65a2de5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b5b7c9a6438d45ba303ef302733b32f

SHA1
9b393c0cfda2ec9315f9c30283dfdde44bd5bf4f

SHA256
35b0b8bb43a82dc3124b46a330505539e5236bc03b8a1d3b5ef8e7d1bc11cc52

SHA512
ae62873d09fe8d6f41b349cd26bd01f19a3f8184edd38d368f3cd652dbf14bf4f62500805d2a623491eabed98198761ae73ab6089fdea6dc786771cacc5e3ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e8e8d6a68497e482131a85d63e6b6c3

SHA1
09a74cc38de215438c213fc0b38029765c996423

SHA256
a90112d2be937ed7e5327992de6c3ea5c532ff2dfb71712462422427999fd3af

SHA512
acd465f1935be040b31ae3c2e0c846ed5a6cad7c0bce80098fac6cb1d58a89980e5ed69d2365d49ea28d7b778d75b51b370aeebdf71d4f7dae41235c8404af80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9521d0136fd66a1f600281585c0b6223

SHA1
4d9e8bd57784bc3bf5a66bbe830247784122da6d

SHA256
4cf3c4967a258e62866244a419a52a130834b1ed67b32f27dfafe16a7c606d81

SHA512
a23baea505fe41c745bc37ed584d189802b1a04d89b034b51f477daae829cf72360cec216c9f79cf1c5abf935d7c46cf1ea381ed3786564f5d44a2d2107f1957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f17b88133b552f72de1ea8e626553c41

SHA1
fbebe9e5d9df445b5e69e5a7c1cae96a53b7cf73

SHA256
5c97dc3e59588b2105828b5627b7529e4429a08999bc5ae5e07e17de09e23529

SHA512
8c9c297be41b63177cb91aab10cc9593d2937049d3d0997f233583f5c68c6ddbbc431831c8772de41008edb5fc279f1c740f5ab991cf94fc3d5ac3471f3163b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5028b935f4c57eab317db2dfb0e19e79

SHA1
416bca99f1bb7d0e5a1eaa48de7e22922b41b98d

SHA256
7cc722cba5ff841d9d06fd03ef21636599f58f94c292e14292fa256f513bb6aa

SHA512
c9b2a585be3f2b51abeb8b23347c144cda16a5079630aa8d4ea66ca503353177bb46b3e8674862030ebc7f1ee26de37d7bad3a71788ac2d84c1c256997d1ceb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF604.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF704.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit