88eb71950d15eedfaa00519f8e344914421bd050a3f59c10ce9ac95598d4e5d2

Analysis

max time kernel
68s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

647220076a2af4c19e27db921be824c1_JaffaCakes118.html
Size

76B
MD5

647220076a2af4c19e27db921be824c1
SHA1

efbcfe1a936a483cb339c047fe56701e605c0bee
SHA256

88eb71950d15eedfaa00519f8e344914421bd050a3f59c10ce9ac95598d4e5d2
SHA512

df4dcd37a0d5f2c38c7a7a15411efdfc4647fb9df27c72ab7a9eed3439189aecfc582737cd9eb8cc8179649e3f9b960ffff5aaf3a7cf78d1f40532296c7c857e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000038e1c479b90d4015c06810d396760ad81224a5bf9c2fc64f6d4ccfee9b565e7d000000000e80000000020000200000006fb7b00c5453cb74fc670fdb6b6dc58c78da7f50565b7b825f41843e9a375214200000006af0dcad3ce6665f46f813bc234c4c0aece2bacc1aaec781cee10b9893c100dd40000000138563822b3f88cdfc9ea3e545e8edeb9e6f3cda776253b3f8cfc6003c31b5fd578d78c66829e80a7b15d69fb8d96097155457e429b0daa252c5b923368e36c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427838983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006dd583a96eddffa640460fc5fe8a31f87bc78edb6df9e14e8eee64f2c920504a000000000e8000000002000020000000986942067a3e18ee219cbaf0714d1c7c627519f0f44ff2e48b633332243283e290000000a0a9be62b86085277d8cc895993ad3681a6b205bce4f60a8ccd19717d602382d60c870763612dd36f35fb5155d44a4fea03253941ea8375746a6f6a1bddd8fd77c6febd8b36b4b817d4dfea2a0077bb160d96e583ee9010aafc3070d36ac80ad7c18155dcf5c8d9e8f1cc4104cb130ae1c57a9c05ea1337a7d48732afc19b6ff19404cf84ebdbe39a8b59eb312bd417b400000002f85979ead92668849411323756834ea88250537e2b450613fc271575f18e516c04cd046ef0d045b9a9eb759033d218912bc5503b1dff6ca7ad7360ecbba1eb7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207c7fd06edcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBA65401-4861-11EF-920C-D692ACB8436A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\647220076a2af4c19e27db921be824c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20638e682bc22a300a0c89618bf13af9

SHA1
c791c93a5332de3fd2d6a6aed9120d4c5e58a85f

SHA256
b896cb6c6a46bb92d830b46a8dd55905183db9747cef6dca3eb931d9c59a386a

SHA512
01d7205ec5b4ba9469997e9b90a547e38c09499019ec9da3adb7a4797f85339adff9919554398e71ddc33027e870104b25c68abf2fb2012deed4c13567b5bf66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c5c1facf8911660b48c72765f7ab9a6

SHA1
3c266b7a7c25ac6c8bbe4b0c91ac05c20ef54a3a

SHA256
554ba7e4ac4e717fa6048418e7346e295147ae3a4e1a0990ef657dc0b770a286

SHA512
ac614a741f15bfa28cd932c80e86454617bbc825e607fe92d06ff8365518feb6d61f40df7e46e190d0e79fbce4d745796806ca0d7f92192241b726ac76360437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a99994845e22be25d72de3f88fe93afa

SHA1
7ab59f034a1cd593b4358e9f18d6a87a5313b9c6

SHA256
c8cc60ab5f3b6fff27db0bf82a217ea4d981772bfca1d78b8ed2050b839d0498

SHA512
610bef4c75c594e87e8e13959cbb9d254e850865b68392bd3415920989dfb232f7310885b8f50931b4abf7c3d90ebfe61d2b1b87d70f09adea5a41a471b665ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa326be2d0645fb03eb23898de349e43

SHA1
9f0530b50cba2dc7ccfbee127cff2d6b71f2d46f

SHA256
bc9bb3d7bafa77a6ef1ef53ec6f6d9d158cc281005166f6c0d62042ce6a3cc18

SHA512
266777ee074dd0d9d85b494ab266ee8f74a477c2d68114f545cffed2897536c0a8f4ae50d5bb51174e0961435efd246fa1c63ff6be90e2a4ea06e8d57a5290bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b86922284cd537a77b7a17c7ae1d98e9

SHA1
cf8cb5b3ec209d1134f24e2318863fc9b64cde3f

SHA256
59e9346105728ecb382b386216cecc7a345a7326763059639327e9fa40b4cb4a

SHA512
7c45178c73df41a1d55a67119308a1667bce3daa0d9850c5460f00515cd70e10199968bf87eb6e7cd6c478b256bf13169afadcb6daebe1544bc2b9dc809d6b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b8da6dca434b40b8fb070a529335e41

SHA1
d29fbd1e843fd48d9a509c37a14d1162f39fd132

SHA256
5ac38b2ee3c3eee531e3e7a3791af07413a2fe3560f96ca55bca9b04eb5a5327

SHA512
39a60420d6c8304ff38ded1490cba01e23fa686e03bb1d3e7926d900fb41efacb3d912400b3cb9f53de78ce2737024b38f9f9219e90d7862b2908c12a5b78bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddf25bf39998c102265d2e3eff3c39a3

SHA1
ad363ba389b8961849670955d3cbfdc96174b119

SHA256
66606d56d8379a05c2d51419267780d1947157ae679c3e7eef7083dd72183615

SHA512
2d0940364d74eda8357e0f1b13c829d656a95ab3d8ef715d72d07a1792306e924d1071db835a7d39d72f22e347665913f27280b5300b6faee0822eece310d0d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
572fcbc7c159284cf6596ee1779cc3fc

SHA1
6b4e2b277da6ff26b8117fd2e4bf2240d72184bd

SHA256
7a3b17cd30f19d4282df96dd3d7daa26a50b4ee5656228e7da7b3405a2bf63a1

SHA512
b5f04269cd46963727e6c76221d2466139ffb60d972601e7ad3e6aadfdceb7dd94b7cad42d737b185e3317c85d2320f022dea45257408e1976456f1a482b0476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e285d28b221df52ebf97c0d0252775fc

SHA1
3b45c8095075523a7be6a402659d1bd356e1b20d

SHA256
ea6fb330d2827e1a91f89e3cbba4a9aaf8385de5354d0eb2e11a29811082b412

SHA512
3083df52c84227338f578165038d04dd5f581c5a3588bb65e982f26a432b037fa06bd535299891089d1dd2fba3ecc2c7d6eebcb1bdc5dddf27f3e530f0f4ecd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a06f14ab37dc01982107844e838c3b47

SHA1
fae9bccefc7857e4b20913882ee68b3c951744e5

SHA256
90191a58e0b3891368fa606a217ecb031bcc292bcf6753bd17c472a776d307f8

SHA512
b02c54a8d7bbe5649a61f9faab8a37d7155fa84f33b4a1c896f5484d0ceed2ca51717d39f5429b22e298e2d650c84a9f8262bab40dd10d48b607a41950979871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71a745100b804d84a21d4d46461fdd3d

SHA1
7ed53060620ec3d50c16da2bc920c7341004eb51

SHA256
18c0989c8c86e377f8ba4c00ffb7a06ce6913b71b0893ff820b5524a02bf022d

SHA512
a28af80212d198f26d7b79e257cc8e76d6ca26163f6d95eadfb5942c808ebd87c1e8e78a009d758e013f76088f5848a3ebf2b6f53e502a99c355147ab9f793a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff93c57aa504e4431069fe0fec92f623

SHA1
91f5c1277e23922d3b04a5b528febea0743ebd90

SHA256
f9f09cfd9fc6ebc707a41026064ba2e4bc560bdb7fbc446dd1510b637ad46191

SHA512
39722b336c8d0cd49e4b8f2e72853d983b539b60f29fe7f2dad7a07509bfa713f66eab9ace6d9695858806b49fe7ed5c66de814fbeb8832c9412dc4ed8940c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31b75f3726f17a190b56707b2d1fe3a9

SHA1
adecb47e728e2ff23b3b79172f36698817138b86

SHA256
19ad245d06c7a35841409c97c2949b029029efc3d19184d83d7da56444184612

SHA512
ad5d0cf49fe63f3c447e7ae1da3fdd3e9f436f86d00c0cd73fba964f363027dbe686d858429c42f8b0b100ecc826309be8cf13c3184fffa9d2523d2d8974630e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ac0a5f88dcf51c41f650abaae14ef0c

SHA1
f5554b975aaac869c4ccd0bc8ef8b8a65e6b39ce

SHA256
8c342fd7e45a7f4f9ecaed8f1f7f9b69c81bf0209fcff4869eeb40b728f454a1

SHA512
3ab4d2e06d6f0cdec3e7c317c70d5ccef651cc65e7a7e449c3460beee5293490407bcf91bdc54c70651a4ac89b351f8deab65ca1c39abc49b808d491fdec37b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16ad0d5217751a5c013c95a96fe22479

SHA1
cb599073bbaf2910779ed2bf2d80f42651d9ae2e

SHA256
c10d3789c44e998bbb63f3a41d2a8e3eb48ba51d5edd29fb80ce66cce17b0aaa

SHA512
3cd1bb6f72bdd3976a181695bf97ef78f4fef478f78fb21ae8c673894d22a3d6bb44c04bb6813805fdb031340290cb8e84bfbc707ff91bfa1f9ad0fdb2582d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aded4cbfc3276689d8d2173a51a8be96

SHA1
211e7762da7200a6c08bbc96f35d24bf0ef700e2

SHA256
2bfafe508c26d7fb41eeb9a31f2415e6c2d6946418fc23d7c1c7859b18397ab1

SHA512
54fc3b16b379f5076fc41559ae342e9fd4841fb7372aeca22e7bbbb83a7abf9b68ab7b6c722116f93eb80c487ac912fdd3e6e9aef9b4365ab703964398d542be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cfa00796c08e52392d18be223c6548e

SHA1
baa163fb995274aed4f2707b952b2fbeacc516da

SHA256
81048e8898bba0964876c8f9869b7426c8dac3c46488be5fdb97d9d13ac9f17b

SHA512
eb89881d0300fe24999686e7f1467d781ed240be2917fa6a198f5b917eecb0ef51d71e4026ecf3d17639d52dfa094148847b46d5898f1fb72acb0b3068d6dc09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2741.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27F1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit