629ad9db978584868894902842aee0e36f38827719043cb54cbb1367eb4ab76d

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9ce7c0e6fd7b83ff979cf4e9fc8c773_JaffaCakes118.html
Size

1KB
MD5

f9ce7c0e6fd7b83ff979cf4e9fc8c773
SHA1

c07b3e0b44eddf779315d41625b24d7cb2958dc6
SHA256

629ad9db978584868894902842aee0e36f38827719043cb54cbb1367eb4ab76d
SHA512

a09b90f20a82ba1a306e67192b922c1c11f913f1d2c1700959bfd0541a3f22e384d4e87b2b95ca3f7982cd68e35f3e03edb119f9e6d92a58a2e5d70af08da1cb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50aa0e532b92da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000007b29fdafaa5792bacf405cd8e1e97a283b3ef3d5ad079b974bff47a419bf5848000000000e8000000002000020000000a9fd50da1bb765107bd08308d414bf9c75b641bbe1f1901ab5f6da80e334acf720000000ecd56f53359b161ab52ad3af601215089933d2d02dd3106acad68991e0930ffa40000000ab5646627b55bc3262b0f4b157904cabe8f4668445e37a5ad7c46260fa92ec4ddbb2d7f42e23c43a1f37c6b60c6b34a9e4d3181fa609ce92f3ede67b6ce14e37	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000000f900c5600a5ae2f9cf49127fad00bd34e2a16888d79f1e4199b7cadcad22623000000000e80000000020000200000003cc614f8d60a8dced26dfcfbb9658a8feb306a00fcd3be2b1a1acb65d8263d9c9000000068a6b1039db62f336afe985b0586c1a5a7bfaab7899042d711371af622016c4b57bd31123c59225b59dc05bdd96a2cade337d2c7c5cda519359d6f1224e99009b51ce737a8ef076fb9f5caa8963604cfa077266827f647d9bb973f43efe151cd4657956118b17fd77a0b7d11872678429f5f531fc00e2a23d0462ad598ee11ae201d24080722bf651ea7c619a836417c40000000cda5252128dee57685e9135a910671ed4e5c03bd3ffee80a0d012c753a39dc95f40b0761f3ec86c0ccfa989f46f8ed744a11e79ed580590d2a6c0cedf69b1c9e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419673609"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D6F5BA1-FE1E-11EE-B23F-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2520	2088	iexplore.exe	28
PID 2088 wrote to memory of 2520	2088	iexplore.exe	28
PID 2088 wrote to memory of 2520	2088	iexplore.exe	28
PID 2088 wrote to memory of 2520	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9ce7c0e6fd7b83ff979cf4e9fc8c773_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67e61d941ee4eed04c26e116f8dcf588

SHA1
621490791372fda1668118d7fb0fbea89e23beba

SHA256
1ef745cf2122c30e6507760eb35d1792ebcc1781420c3079247be629422b48f3

SHA512
f1ae4707db4af685ba18b81b0a992bcb8e6e7c69a151af047ddb577c7620fa31d8f53ce1ba7559d95a5408009fcc661e157daa8db1bf2967950646bb5006e440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
692f62a66146435bf8cc8a92acbca1b4

SHA1
3cab1ce333b01be004f707491bc3453912f183e8

SHA256
788558da49699d89fed9158926cbb2d57b5db44bf6f187c1d26e50f75dd61df2

SHA512
efbfcc2e99180f5371b8363abe8d9c22e465062ac0a13d194c69a01742785de5731c4621d408fc7ba101bbb3874e0a7238adc7657114c8c636db5ad61c878185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
966d58c56382b30e82193aced11a3641

SHA1
6ad6ba3305fa98848c93969120927c22dbcab218

SHA256
a567e900dcb780f5b457de1942b02d060148a1cdc24672a4f36e26c919177b3a

SHA512
ebee2a6bd91d5513403c08cf41fa39b2a4099eba8bef69a14a153ac893c5950998dc555f124dd41f1ea7ccb00b2d172e1cef37f05737a6fc82f3877a62f92bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a954a70eaf9121678cb6bdfd00dbdd1

SHA1
60f9fb10b82a85ddbc255ebea9026f88b56735a6

SHA256
08b8577b94266b791fa3315cf5487fbfdb69156d8f9a89805d8f1eafbe01d80f

SHA512
e3287d138ff5ce82bc7e24bc6a4f77e1dec700fa8fe7008a8d8419e303fe0910b05b9f61eabf262798abfa62ba31ec8cdbfc179e0df2f246fe6ff0c9c9cd3791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd36dd22e644c64681def8e2bd4f73ff

SHA1
1c0816818c102bea5693f409b7d460e112cae9c0

SHA256
728f0b0fef57e52d70f921c42eff8ce52cb2287316582d10f8836116fe4edf02

SHA512
6bfd3d53da5af85bc4def8d35f0839e478d8563d11dfeee17a8e5c565397ad8751f3921e87ba9005a020c874651198e6dc3aa9dfef9d4985e7534002563ce1db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cfecefde76e30f23dd3cf5328d9fc1b

SHA1
ec5f22116f51edc66474dea05990e9e17857a7af

SHA256
66c7cecae5cd5903b410f29b98f3639713c77862f41a8a249a26f0dd04e49e4f

SHA512
e1d11fb0ae72c94b74004c508736d29c785ac4994bdb853791820d124b20f156d47fe13ade9e18021bc323ec5298a453bef25aa164c199bfe14fdc9add3f1212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b55919230f9ba0d05967ecbd2938247

SHA1
da2e1d3345815a6d0ff953fdd9f980045adcaa13

SHA256
a147503009507d6a3f59d3d091d07f434ae90fb39b4b0d51c86294546cf2d977

SHA512
b3cbf639882e0b1686ee6669365111c6d3c31c3b419a64574e61bfcbc76e485ad84f897feb274a659e3ae6eb6edd5431989622137ef4be64a051a1dbc5d36e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73128bb14e11fcb4c7e9590012696178

SHA1
78abe610eb8ebb40126ba41c6b347cc20b29d7b6

SHA256
18f21a71457489115f6bfba5982ac7f87d83b528336873de35dd6591c8046c6e

SHA512
74401be187b5419b3431dcd4ade814a09f645ecc461267d614251c51251288e32d8a7329b96cb004a2ca6e6bf6296f5d02bf3a210e6a29e64611aa7718bc4f01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
271bb251c3ce6f155dcde8492499f37e

SHA1
99b91e606514e50e5cb361ef37bdaf79e25ade8a

SHA256
c2691428a02e61e04e156534ee9c16b46794e7ebaed460f5da3702cf0c55a8ac

SHA512
b821f4c8846cf40dcc12423655993393cc0be37189f5c8eef41535a7c00dc6e7ab78496a57e1051c528009688d1a18bd2030ff02028be44ff0a9313baa89c902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30ce4986113a6a12e4394dc65d657e21

SHA1
fafcf9b3de87566f5807ac59fa82d59b92df085a

SHA256
8e2f7f30155623ecbdd5a66e38de44f734a68e8fa38e123c81942c9e9bfcf5bd

SHA512
d81e54f611e57cb0a2bfddf6f0fad336914857611fffb4f1903d964b683a4b4598908e9e8461581aa20bf5c52a89e2f4ac7a825b39bc3713aa4e4c5a18412967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46802a9ddd0eaa3afd0442b7a64e49e8

SHA1
494627eb71a560d19d8bc8b3481cc3bccaa6d1c5

SHA256
36b686cf251c8776a5aa0c10ecfb379df5058d2479dd0b3369cddc6607750a48

SHA512
ffccb313fc8799d7ab08a193d6057b73d00cad21eb86f860e466fd8873c45a2011b677987c5a6c590bf0bf425dca6bb808dcb7c66bbc85d70d5308027d81a45d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5693a7ea87127e882d701e91be7b312b

SHA1
2a331c37fcbec3837d268c6ddc20a82514c87668

SHA256
405ce06b829aaf12502bec98b08217b6f05d7241c852c6ac794c26732a930c2e

SHA512
6753f1e54063175ff7574552036bd4d74fc7b773e521708606a9269b7e081f035aa8279acdff859aacbf6ef505a712455c32b9203a73fc1f5183fc89a62f807e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf4436c18f71950c846ebe81e22e0450

SHA1
e367c5c30b892ec8ca6f2e91043ca625a33b38dd

SHA256
8f6b324e2a9904382a5e62cbec126fd2ecd5e02a6605d11ab57b2b11d2bce444

SHA512
0943c143aab9385c2b39c2fdabfa4a29e9773612f3daf1c52271ecf7477b667ed88f65c063fad0884c3bb938043c0993c3b2f6b84256981d44e24caab41f21b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a375a69cb9ff828fee8db4a8c3b36e9

SHA1
4e52ca83e4d97412e5da21b12f84132a2a23e66b

SHA256
d607fd00c15267905ad9363fbfe13c999a12c99227ca98a222d74f858ea26c9e

SHA512
ed05e2d172d35721b226ce57e3ea2a56de9c1a4b5acde09cbcbf6e6ac6b8f22a045b6ce3e4f2fe84f5e8a243d8b4739d99d02209feea9c1c012a5d4121f10272

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59B7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AA8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit