7c506706e4f81fc8eb715f6a48f2a536c10b3038e421559100d2ddf567262233

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63de0593b2fdd0f85b30a6bcb4fffce1_JaffaCakes118.html
Size

3KB
MD5

63de0593b2fdd0f85b30a6bcb4fffce1
SHA1

f647cd7d1b01ce47233bffe31e093bda9731a1c9
SHA256

7c506706e4f81fc8eb715f6a48f2a536c10b3038e421559100d2ddf567262233
SHA512

4be2d76bc749787f81ad809955d0f856f3dcdfe3a2a7723553659a2b2d73f1fdadc2e11ee16e91190a127b233f031a2ccd038e10090b257fdf0dce0c68d8633a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427826695"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F043021-4845-11EF-A69A-C2666C5B6023} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000aabb3536d1b53f5180a21b204b7be118cae57e5b203da59ff121f5fd2a3a92dc000000000e8000000002000020000000ac718db9921dd37d73d1c938c2f915c5bec0360f569bcc9a09377b39e0afd9d4200000000b61d8e4bda0047f0e82260265cea6bf70de05a02cf10a163fc897356b2d9d4940000000d8c5e37947ed3c71a47aa860eb231b84170c1f2e90fc0d6748554564f459ab2138427d244c8b9177ca5b7870869fcb79265d12f131ad50b0d3d8fe92cf459b56	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e083023452dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a9c14e54563d5cec39b1bb555e838a481c0614e7c1ecf29ab9499d9e7dfba2ef000000000e8000000002000020000000b15f618ecdb6ccf9d46f57f0a50faab83198299be0b0830cd4f14fc060f9a84490000000a3b8f0772818d43cdd596b7fdfabd03c64a11e6c7fd15371533e672305cfef89c98a91d5f6efdd45b2a97e42d80fd9c7205ed652db18554e022fa029e2003ade300303f40eabe54e90969a77a7bbd058cd80f4dd6e3ef0d28f699d50fccff80011f22ce0bd1554b85c35c1d65715922ba310c624f7d545ab7cb5265fbbc2c348668388d92b09d8d5b877474512a17c0240000000333bf8193aae827704864f537ee25aadd3e54d15c294dac2a43b7c3b868a01942c2b32e1e32c465a7195a8ea4852740dca46a91b0f40b929878c9cbab39b3b02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2144	2080	iexplore.exe	30
PID 2080 wrote to memory of 2144	2080	iexplore.exe	30
PID 2080 wrote to memory of 2144	2080	iexplore.exe	30
PID 2080 wrote to memory of 2144	2080	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63de0593b2fdd0f85b30a6bcb4fffce1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af5ab154430a995992a641d5dae3babe

SHA1
6a334111e1a8025c15d38d24dc7a348f7c85b027

SHA256
fb4433ae5ad4d2ba9b7dffa6f1981aaf8ceccbb970d2332a0173d4165115fee5

SHA512
3b306166b373562e0a4e5a47f45dd91dd02a132b651a30ebdd50b751bc6ebafc326ad94c3d8f333b7c754b1c0ab94ea1666ad1a2c10997bbfd4e4f6db32f53a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63c2f73f310a98668c3af2d509830a08

SHA1
1d52f1a73cc265b4d51f5383f5f40d5536bae334

SHA256
0b85fb180a8af4e8a47d00a2e8931547ccbf2ec2f5358dc0cf828ae12777ae25

SHA512
c970fabcfc3817d49555d95fe2dd1772d89998b012bf014599796a04848d93c1b9ab7c6bcffca9a937ba2f9fa535e373411a625d34e3abf3770ca7f63e3eedc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9e23532667601b24834f6778cd82b38

SHA1
8c55f86dfc0e7e7974f8e954ebfd50a1b599f7f8

SHA256
90ee2b1e3c5181cd06c032ae7ec26714179f2646e58194d6119c3199f87081d6

SHA512
f3b71b1022365bc74b41886485ec2a96246c0bfc34215080de0211481fe5bd02914f86860fa9679bf2ee02d95a66b48488390da3f2a1099ad00ad8749bf1f685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
820e5d72b92b748def4fae819b53a405

SHA1
6f6876b1e625137ec00361a6244b4d8bfdd75413

SHA256
df62fbfcb41f051c00428b70584b552c7cdb6c29064f0d67e95b8af636d3c9e1

SHA512
719d796b63de3193478d1b8a2cee3f8e24527e6f5f3f440fc678c5b156a8df1145a3e43382b0db1367594ffee56e8219d3df9f69ac0cb58ef854d7fbd45c5863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35e1e61fd4c4b6528dfe3766bc6ca928

SHA1
d11f8ad0711bb9cc50027c4951543aa38f45d6ff

SHA256
afa8501a083e26f103a1db60d9e7ac32bd2f02db3f55a38c8aa93a1a0e9d5c6a

SHA512
be579fb418f58d9c6a1e2bcde02663eafd1d22a434ba33ab529921930e5b4647f49f9b5653878b15c2e2c84d38d9fc67566f9a6088bca0205661cda908179eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab824d832683423d23726db3c1b7989b

SHA1
1570935b6d34e10244cc70f40f998a3df7a4fc13

SHA256
aacbfde1d0f9de16586651d10d45efb6220a530fc241e52d61d1ad350eb2822b

SHA512
e9187a0972c06fc0a1e1ab6968a271ae5490303254d2d36bcb16481ace89ca72acde3d87f05dbb6250b0068ea64d0083e1edff0ae6c773e2b9dadff73c842d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df1bcebed35c57fea07dcba7bac82496

SHA1
dcefc5c2656a0ddad6f93874b423d340cb9f147a

SHA256
69bd6f50188d0a2033b85b00a65b00d1129b0001eee3b9f7e56a41683ff256e4

SHA512
b9fc61e59d6b47f417be4c483cebceaa4797ab5c3117d3d461cf97c416d4890daf255ec27344d88e961c688c2efcf0ad1a54415e9273626d0a4989cd48bc3fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fc726a015bf9b2916a4d1d24fc0fefc

SHA1
8fc4fae55c16f90043a191251a6c75a54a408bb9

SHA256
55f8fb2d8283fb2f6c62c3c71ff2b92c717ea639a385cff4975cb44472f127f3

SHA512
5e2bd7c80461ef615adab772f6d7845515d93761ce982fb2b84c3500e66c748e2538a3acb5289cf6cff30d4089d37881fba495e7b6786960890760e13d6d7918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9cea6e8587efaa7eef14bd366aaef32

SHA1
929640c9a7aaaf1cf8d57329d93ebcfce37e6d99

SHA256
95ba416e4f9df235801810d18cb38790db9357c5632bb80c748e862e3f370622

SHA512
db0caa9610c052dcdb859f0aef88a970ee839de915f55cefa6df0aa70691c4e04a268a57c5b7f75f92b52d389fea77bdd8a1f341c25e781a5f1a35b9994a6e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a18b8797e24e69c6159055b60f740bf

SHA1
271658af41895dcf6d6d1a8db55c713ad5c5983e

SHA256
72b4811452f600b1c1b83b603e748b158445bd565fcd999fb8e2b29df78a3ba9

SHA512
232af059880a0835e1d46e298222f43cb55d39e3d1fa2075859f67749eda9e1807f1f82035326dfcb0a6dbfc2404ba4c70573b2e3e1ab692c84807d46c23aaec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
169587217aa410b1d373860af18b92c9

SHA1
b677987e2f76d751aba8b3938e7b50b1209565d9

SHA256
aab454613d91d102e1803477a503315f83c4747f69c011217f03300de73056d0

SHA512
f15a5666699b7fdeda234fcad97cc5f450591f80867867eea685255875979e5ef9ea6f8349130853595557ab22b00f59623016fa89cdd78008c3a10a095bc823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fa9c049ea0ae32369411e4ce17f50fc

SHA1
0d41f9d6b0f19a161ee56f9fcbe453e7f7cbcee3

SHA256
298ef152601073884882e0e249922fc992aa15c70ca60fbe16850f8ae75dc6d3

SHA512
4a3260a6a92d503128090b6f23f256c484847b09f7a6dc2fb578b04f91a5f6d4570e07d69dac6b58b9c0e22c46a5de1c093ce1dd47b05a3de941fdb5b6003650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eb76c4d62041cdee7ff14629264099f

SHA1
4d16fe4de75b5c2822166d36b0900203d8a60d54

SHA256
0363e1ebf02b69b8e0394597fe932d4f8e8c2c9855c5fd9218a65a0278a3bc1d

SHA512
a7d378853c5646cc58cabdfb28240da8f8e411c6c2b62406c9950caf5ff9f3fb21443a6b7ddc7adf68d16e15f2d176669c1d546aee97f66995e23c0a61691633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
359a0275c32bcb22ef04378bbdda681c

SHA1
7d05e6273590593a1aacec43e659649876fca693

SHA256
e695397b9459e1d26e6110508790ac38704a396e2173d79619fc92c1bf9ad899

SHA512
867a3e9884715e9f41f599e6e4e971ba46570e2b5118dc332643c090bd644f2a5329e7cd06db9c31cf8582dad9fb7bc20908568712ac76da32ad882e37b0ee67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9b2134d01b2429ed8dcad6792a1fcdb

SHA1
1cda943ed2f5420e7d945cd80e2a6f9273e34ed2

SHA256
5ef1364ea7976cd99bf887eab99ea015b8b768d84118b29fd241bb93184df4fb

SHA512
19f57c4f1dc526d07a46b041b3887a7e560c833ed1395a1879c9df65ebb90768a7a256a85f231a5cd53e44a5ecb581e846b5b01d2625b86600a35df1dbd49b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86e56b5a05ba524c83ce4a34cdae526c

SHA1
4a914cf7aa7921826ddca7c9bdf2d4a0f568e025

SHA256
3e417b0e5a73098d5aa258cc262a3ae6f4f704bcd59618b47eea6ea569d30aed

SHA512
c365e300f03c2a8173b2dce7cbe855022a59e714795b7fd4ae687642a156d69f47e034bed834e90632940b5c869fc4bd5eb6198f7ae9f65a1aed729ef9aa13db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2265260ef90cea75901514b93b396ede

SHA1
62d703aff9a1f32b06fe1eea983d6e0d8c5fa7cc

SHA256
69b80be402c13e1e2f0955f4f370e53ce3682022c8e6f6749689db5924237131

SHA512
961f7bc044241c6e3666d9c583a16146ca24c5b8da62758a49b459bddb2f4ced4d891103021a56089e51ef126fd16a35e47f1c07e5aef1e637d3669e5d8372e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C12.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9CC2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit