6047215ee0c9394e8d696a6c94e53dd55c5ebf5e46bb2f1ed547cb56b5ec0f47

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fb6b396318d6d56ffbed1d593c64e08_JaffaCakes118.html
Size

3KB
MD5

5fb6b396318d6d56ffbed1d593c64e08
SHA1

83a7853c50f9ca8142e89850ce905b3cbd31feb5
SHA256

6047215ee0c9394e8d696a6c94e53dd55c5ebf5e46bb2f1ed547cb56b5ec0f47
SHA512

69a7d298a1ab08f37001e92a3c5945003d3039d6f6b004b1d612f6e5c0297dabcb5e9d8aaf658297c67589e69f13c03c963cad561e01aa48e68bcad40c1b7b9c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000f2af4924cdb0f6389420f279c7d0eac28057e00e62a3664d100493694be6d848000000000e8000000002000020000000447a1f7aa40dcf1d58dfed879feb67b5d02ed164eb1c057cbcb81175f6a2f32820000000a24980252bd1ba1d95cd5df8fa051f9bf6c58f6207f3c7efb9d7977d3f1c1aab40000000bdbc1494a3994298357f57f1df39dcf76ca1ca53a0600591ce277fef85e618d6e196574ef4e913af0dfb2af99c2a67bb9d3d63b1b703ad38fc68a6a384ad2d84	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000604c27b47721f2e942890ce5d36a3e8d0dc794e46a81b9c4dc767cd779a8e9bd000000000e8000000002000020000000d0d4ab07e06324315786f6cb8e8911df82d84a34ded67a76d1589c1314cae3a990000000f2e1b7f363b1488667e242be36b948044fdd6132740db58b48acee11aae26fab22524b73876955d798b751738db6700562a8b45b10993dcab39ee9df4ed740c318bc13a0b830752d738496af1d991a85e96e4e4beddc3a283a8158b4183320eec9826d5cb13bfc260b6c885e56e2d99e91665440ec64207a8079d8eacd6444a3518c405ce670e05c72a11f809d9c276b40000000ff6b614e3529f855f75e2a64ba1e24483256f4e9f7f74a9a2975f127729532fa3581bd47a90aaf2d8823edd0e57303f3b6be469efa21ec39a739c4ddcc4e7275	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427625225"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49F6DF61-4670-11EF-A432-EE88FE214989} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407bdd377ddada01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1768	iexplore.exe
1768	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2172	1768	iexplore.exe	29
PID 1768 wrote to memory of 2172	1768	iexplore.exe	29
PID 1768 wrote to memory of 2172	1768	iexplore.exe	29
PID 1768 wrote to memory of 2172	1768	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5fb6b396318d6d56ffbed1d593c64e08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c9464edadc543c3f25ef56ad9c59f4f

SHA1
951379669d31734b6c7ed632fa38be3d2db146c4

SHA256
64e7ed92810485be74d1a26d95c8448c31a8ea5e371450356fde34c9261ad94d

SHA512
dd3dafda757575ab9b3ca13e987f57d5c05dc1e562bae3a9dc9ef6fd12b9080a9643b7a9794e28fffecfa9328e632ddb4916480382121c4f61bc18aebc93ca33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43230046e4b042e2ac3edeb57fdc53b8

SHA1
21e3795f1cede8efc32bb3d3f101dbf2784bde7a

SHA256
424962f412c4c4ea8639c7af20f02e64dd64ab5f813ef5ddc00098a7bdb8b853

SHA512
a94ea8d174e46706c14d2453b2999e0b426a7b8bf86599446910bb14b29d76176a9d40d261f3632bbe435433f499c40c90907b310a3cf3f625bd191dfa1bf497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
610d75c142838807b010c442f85e2c82

SHA1
90c4770e0763842fbac1651901a2d73d1e74e9d8

SHA256
ed202fc05bd72c33fe1aa2425708022ec0f585a1555c101c0ec0560db99b2fdd

SHA512
a78b2e23eefb99a8bf0cf2f0b86129cf4175d14fa1b3e53669acc6831bc4af5836b069a5ca24d5e49510e531ec32ef2784df90332561f2c227c265adf8c815b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6ee5ef600ccb052062159213f801fd9

SHA1
fc2a1ec60d6a1ecc8d73a25f0f18f2b65404beca

SHA256
8b8129a3e09ba94e7b8f9ff622c3852ff5e0574cccb064f6113eb2df6044499c

SHA512
99352eaf19e58b33c7cc31f0d8188a90de71421cfabf3d9c5ad6137544b4cf90b85060d4ff072802448d9bbb4846be601124604b1d04a9a29ad0622845d5900d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b520c3fbbde01fd771fd8bef0dbd7e9

SHA1
ce5033f2f6577e08d6575b4a179722a81554c926

SHA256
1e79b2f11736c79cd035683292d22980cd7334e4dd97143b9fcb844a239235af

SHA512
dc164ee31726342bfe99e51b8bbc8ae4dd1eb1d1bef533f7f29ac165d06a2be645a790601d98be7ef74140ffa7ff7c29f58df2700ee336797c93efcd44c2a6b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19baae1c1328aedf7581989b7450c4be

SHA1
8bfaf14f4bab7f5c4f32704637b6379e4a954716

SHA256
ac544016d0a46ec21b533c804ad645428378fc64ae3f8d9d30b402576a8cb54a

SHA512
8c2558405f55264ce0a4298598f6e6cafc1bc3df00dde9f0b96b4da83450d2262028db3b7904b0aa1f14ecd48b9624e5c0a906a33cc778948837811311b76903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c8e615b444894d9990ac38022d6750c

SHA1
ee6dd4330c35b94d28fda01169d61e14e61e4bc7

SHA256
e0dfc1870ad47a2f2d70bf5074925d049d1eaf09942d9cafde15fd7e0405c695

SHA512
16344a345463c80ada2b362f9bd579bb3776ba34e1a40e19519f2128d9c11023613920d64a3ab586838233cfe4d4d4feeedb49d62322f4f8ca9780bf11b41946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db466164371f6fc506f8c52fc309070f

SHA1
0f1b19d898aa7a3581aa2d584ac0044e79bba65b

SHA256
6911693fd3ed4802cec6dc0a661548d88dd69408c2c74e87d254f198bed477ab

SHA512
e189e5ede06b80d6166fbd7556ebe48fdc97fae97916ffbdbd4b9d7378cace770d6c9725fac474cf0e03b8b1b2257c20b3bec3fb377d879502e661c078038cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe91c3f5387905002e3955f3637286f4

SHA1
d05d39a91b98c1c90f1440c4bafc255eaf593b52

SHA256
c62989640a040d7e0053acc731aaf142c3f7709455fe77b0cfc3149a86b448e3

SHA512
96e40f86d8ff1591e29a53db0cf14517ccae7dccf351a7def36585ff9f45616d679af9a650cf2192cbc5cd13c4fe459849ea0871a02897673d22847b22d5d84a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac6bf2f314aa6d936764a74afec57bb9

SHA1
acc072aea65347e779cb09f0e9610c3cb6705d60

SHA256
6651db486f33d4045e70ed536c4434434e3e1c22ba1386f8e2714503a601227e

SHA512
e471911cb2419b0f2796a69ada72d7fdba0e93ea94956df4261eb3280ef06467744f25fc611f525aec9489be09239b99d11d636d99e21ad7661f59f9fd4b1133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4f43722d4cf6f9ab45179d056f861dd

SHA1
814d78b89f24c8452016eda1332cc44dc88e7233

SHA256
b157fb242cba1e8e216c209cdc6b91472e8d480d463d71561e8fefe01324d90b

SHA512
36b4558c86a36943611896a674f7fce13b6024536072c66f6449f166d4c6b0a939fc97614add8203bc75d609823bcc9c89e90cd2cb71733b6704ffb986a99990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
496013aabd43ddcff025555e9b987ebb

SHA1
ce235fd50e5866bbe351a5c9440fd6089e86d9b5

SHA256
682d63c7f00d3acdfc75d7813a6032e8634cca93e042452344fb9d3a51801e08

SHA512
05f790a834d6c5e6c88e6064a1562724a596ac9776630f1ae0baf53b438d4cf3a220817b7bbe7aa2571af98b2340e894fb706688476fa6fedb759aea37a833de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85632646e178ce615224b82361d38165

SHA1
ab89d3eca1ebda28b903d322b337cbc81390f7ca

SHA256
3f1dd77343486fa54174d9072c82a6ad7bf54c84e3abf85fb76fcb084333f772

SHA512
0a369e3045c742f2a35df5608a4cc6240e47b307b0a9da33828f86183efc06bc31efe106291c7f83452966b916991fb5d10fa3da2b37bbffc7e10c1d759aec63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71fd7bbcc9a61db0688f51a6716b4beb

SHA1
a1c5622f53dcbc26e549d7319811b69650f080dc

SHA256
b789d063f4e501c06943635158febd0fb33755ed925cc94f180986cec9a442f4

SHA512
8c0b0d70d349fee6049ee71b203544ef8aa791d940d9dc5329a393238f8e7e3fa6d59c66f8a2397380579abb3c8886468de1bf1bb54df5fd404ba8922ac63d99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58e999d2316081335abf19e2f595c890

SHA1
763ebf602613cd385e2125656e412028cc05b1b9

SHA256
61306722d7fb20144531560540097df36fe25c323073a517063eec7c048481d3

SHA512
b0f471cafc84ce25d5ca1b24aae3cfc1d4cab79762d84c89b295692b8384c4eda4e1cb00cc49d013961099bc54b41d45fb94ff8e73635220c54c4582853dd717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3658f9b9505ea2853e3e4d3ba7a1691b

SHA1
48c0039e15f965bbef44338d428d570622f9d614

SHA256
46a17d48bb26dec1c88e38955b872ede75d114af688339777316a3a587cf0f05

SHA512
10b210149abaf81114209fa86e1491d7c297f8607afdc73d12bbf6be5306c625321e54ebf5a37676db5968912a7b3b798af47827c4b918c2444c87326000adf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c80d7aeccd9196b1d997d7f764c362d3

SHA1
76bcc756d6f47ae9c1b063eb5316402b220de5fa

SHA256
1474f432e4aa13605afeab6d707f895ccda4da43461e46ce229ed00bd797fe7b

SHA512
3877cdfb7cdd847e24bd04f4d57be3e5b071bce16f7f47eade1c80773ebec96a5d7f7cdc6d5664c3f745476b15bdae176e50c50e0d91aba9cf68cebfa7705da2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit