a157f67cf27417aa988cc2357b81b1f5d94839725988595a053631233605f044

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb4f331cfc279eef88e73058a288dfca_JaffaCakes118.html
Size

1KB
MD5

fb4f331cfc279eef88e73058a288dfca
SHA1

a1f7174226d9e59619c7cdc40e1aa0e3a389b3c9
SHA256

a157f67cf27417aa988cc2357b81b1f5d94839725988595a053631233605f044
SHA512

35dc2eb3c366381cba3398108966a22d7e2940e839afa300957b7e86e2bcc26bb314818ae9717674172bcfab25dfffb6713d7187c47e9e69fcea69ad963276eb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000318e81924dfadf19b48e8f9eabfa51d0e36847c5f1ca8c2268f4094885ed875e000000000e8000000002000020000000ad53d3ee9447ffb34dd0bdf9b735f0c40866c9b2c5c47515ed591db79617972d20000000f4d1dc5fe3103bbc11da511bbe655d7eb7bb3beb9ae65395715b6084cb70e7e34000000041f883c0c828ca41dc16969f0c17b4ecb804d9211bcb744527ec320506170c8e0db9b6948a43ffed4fdaac768d5e1aa383b6f3a42c871da941c4f63ee0c79313	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0140071a992da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82831CC1-FE9C-11EE-9340-6EAD7206CC74} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419727738"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002ec748d0621ca33e22f900489b664f0ab26478ce3c1b232aaa206f27e8c4f163000000000e8000000002000020000000cd89a0d524df85bc45869f62aa3ddd024e7d0368f6c1cbc7530d309b54f2a7f490000000fb8a0dcb523a6ed0c98f2931f603dd007f5b99fb73a407abff3f41e6d96c86de83ef846e791369147f1d1535f2e6b628d1b7589d4740e2cf0a9ffee2585f5360f6087e9d2302c2f7adbf26f8582f4797b4b027dc6fa8eacc77beb269910031edf061d5c04d2b0e05a0d7aac6bee3d4987db713ac6321920a15bb73a227adde26dd92976bf49511b348f81ed287d6707d400000007924eaac8d2289cca9ab0ebfd992c4cb64525162cadb00fcf2f7c937b6ca5f89b035b3183047198f50b1328753be8888403f74c657ea177960e54eb89b139678	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2508	2924	iexplore.exe	28
PID 2924 wrote to memory of 2508	2924	iexplore.exe	28
PID 2924 wrote to memory of 2508	2924	iexplore.exe	28
PID 2924 wrote to memory of 2508	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb4f331cfc279eef88e73058a288dfca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88a23d8add53ed851f2adfc2ed146df3

SHA1
e0dd2856c2b7a925a56dcfee534378ef2bc41553

SHA256
7c88279b333482ec6db11d73087e9257394d0079dfe99067c5b10fbc249d8bfd

SHA512
d65a1d5a81456c82e1ef5278cd10e89cfb555f39c567cb3d45d45eab96ef1b6a6d1848eece6964aa6c88ca7625151ec1a3cf517c2dc669da32a5e6534b603099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
701dc271f06adeb8574847d09c1a2c8c

SHA1
33606398eca5ce0db2b90c5a40afb5519787c1e2

SHA256
605ea9c975ea105008e3aba41e4616e73f4c15674422045c6ec97a9645891a12

SHA512
dc143a04d5b145e3f62a8295f1104a41355c20e1184d32290a02d9d3776d7e690f2b9e86736a66317dc1200b17668e3058b049b90963a51d3676ed6d75a23b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c5b9ae11da44fc071996b04a64c89ef

SHA1
bf2219a2306539d4b2241be21646997cc2908838

SHA256
f010900fbfb2dfb718ae50c92d304b10d9ba025dcc32bf407d2f4d0357e09a13

SHA512
3b5cfe15f5eb01ca1d8cd7397dc7a1d1d3789617c496e0848fee092712518c918b020035d7c2386697fc1400be24edee4e9db41c1f03c67bc5dcdc083c5572aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3752b4d7bfecbff6ac731b28a5090497

SHA1
4d75414af81a3bce60ac9f36056a6f61d8994648

SHA256
3be68abbd5cd60ab48bee86be80f9bc140c52eaee21346b9a35b5052ef064850

SHA512
3806f23f17f4d64282438b94fcaa15a16eee9abd54407a5162aeb85f7856d1b3d2215005948ec6ed8e2916ad14d6184726f3398a090db3ac5fd951d8612d4d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc9ac730942c572acbc819a7709eb01c

SHA1
bbba852aa7492b206f88c15aba622d65bc2038a0

SHA256
80d0dacd93da0bee46d1c916003fd1b6f171bc67a1027b53e8632c6a14d488be

SHA512
b4c7cc2867139d50c7f0cd630dd32620b96273fae13afd9c8e5f28cfa56acc098b15ff3aeedb1849656e88bce0f3dbfa1b6998a5e9673af61c29484bb01c9557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ba0a7c86a2524323d13c49055ac0067

SHA1
de42b926ee592dfd25048f044b3addf6382214ce

SHA256
fee346ffd9dee26e8d53d7dfe8c0e46962b01a6b6500bf78b2cb5d5dff7019a8

SHA512
939f33b4a207c7c570d7525cc853ec59d9418af56e907c0e8de1a044080b10ca37cb0177d263759b02a2a234384103aa2f0caa51bf9d3a51400eec4ac1dd4d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eafc56bf16e24d14d52d5a8b70697926

SHA1
48d3359d2f7b076b77f12d843b09070f0dee03f1

SHA256
31a0c42e6984cb8ce2c25b23ceda7b254bdc7fe4921432b8e0852e932cce7ed6

SHA512
602454f820b05e061d07cd85dd7c2d3ba00ddb849016a032a91bbfcfae7f91f6ed95494d15813d6ad33c320642ffbb4146e090105038c832bea038bd07ea7683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f8e4dbc01f2d5f05ddc757f0e034457

SHA1
6d080627ae0a0e8d11b1d7c74d6944944d4f0d02

SHA256
f356537b8ec95653640c13f9038338bbc702859cf4d0300fcd337a1f34ac26ca

SHA512
07d9fdebd36f0ce0b823431721dae161bd4a31cec5daf00d3f85f74a8dee45d1d888a698f916ce123bf14c9e7e4d14ebf49dfffaa6f8dd2acb214ac8afd2e6d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e94d80dedc8041f01ce3bfd8aa9811e3

SHA1
d93293c88e0e7a1dc56e5b3c020cb3eb2816b3fb

SHA256
c1002709b6e49a55a325165bf2ec3fd781b453421a5a19181f6c8ace699f9e61

SHA512
c5914d2fc3a1f0afd773f8c5ab749f1b2b4fe3a9be8cb78c8690448e1b64e7b650c9c0e7193a734a2fcec4bcfef5c712a351c92218ed970884098094db8ef6f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb48056f3998b8fc079afe9017258bad

SHA1
514d2dff95b7fb4dff64080bb4a95279f9e0498b

SHA256
2863bc586657a9759762c3b7f1ccfd90e7fc694cf2be86e0bef25843084c37a8

SHA512
7b3dd589544547c735caf4b0813b2eae0ca26e803d16611a1c0ec92d0095862aabb16dab67457ce8fa01e28067698b0290a45b92414be592f404567a0700db78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff2fe9dd3bc068c2d5f311f6aef71b9

SHA1
c3dd164c8ee63c7a49313a87d5b4b93b8b59caab

SHA256
6a0c3c0c38019816562f43c8ad0b19aa95df24f3c1e6e824bc347fefc4289acf

SHA512
821a6f954add80cc7a8a9312d1e686911d2c74fcbc46693059496eb82e90fc3055641d7d5a8f7bfa81b387de42393902f23e8aa472feb2b012844b9a0faa3a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af60537f78bf118fc94c8b7a002d09b

SHA1
5801286f7babaa54b16084296a571ea467058020

SHA256
3396209a3ba7f67df5e1846b5b76581743acec53b4dbd0a185a8db194771a0d0

SHA512
99bdb828eece8a3e28cac15c70408cfeb3f7ea04a2563b11b9a7c7a2b98cb10436b879ebd4922b640e38ef97413d33175f2c2ff8ab3c4279a19da55d46647ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d41204ceafd6df0c8e795747bf6cc5ed

SHA1
953826f0c5be432e5574cce50f682ac5f9533d3c

SHA256
6a9708b286db758865676bca4a6900db86adf60096281aaf549756e6b84e388e

SHA512
99d69f1e2fabc3a462718faf292f78d5e80058b7bea75f9ae719d367d4c40232df4caabdad8d69760bc1ae3b448f17721f3965eef58cd58b9824157f68182f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afa39bd0134ff87769453ada0660ccc4

SHA1
68c97843ba1d254e07538ab0bbb3ccb56660593a

SHA256
6eca48cc73e27fbb00341ccc452cf82fddcd43ad7867c911b24555e4d2ce6e9a

SHA512
73aa3f6d3d9796fa976363e5772234aee7397ae9171ee6e8fbe9168b6aa677333a9ec9ba91637248f2e06b5057e1ba157f5baa19d7dd418c29057da8b984bbc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
272370d42c7ffe692a1ceddd62943d8f

SHA1
3d66b265a72642ebc2a7bb41596494002135c2f7

SHA256
74898233a6d8a5809aa1db51317244d0c0f8932e042c8b56c319b52c2266052b

SHA512
b7656272b871ad437ce05d59cabe408a898efeeb4fcf351b941e3ef495cfc5ed6a74546c03b9e71223de4e74b62c224b9ef9403294d856dc36886a2608e85d2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
361f905846deb80c5da47433bae61c8f

SHA1
1907153437eac30047f007e529d6f29f0937d99c

SHA256
07add8af2007bd4431df6a056a8ea1ef6d3063c73bda7814e1094c8bd2b05761

SHA512
f24c8ff9131e7abd1ace024c7669d8f654c4fa9e40c8c67f3f2de60fd388c1909225bf0b76769214ad0fa6c93a2beac7dd07b3151871abc6a6f9c9356095277e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD25E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD37F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit