bd014f1b499402654366249e83df0ab2920966b7a475f078a3c03a5b5b44fbaa

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00138e9c83786cf7e940faf24a1d7cf3_JaffaCakes118.html
Size

2KB
MD5

00138e9c83786cf7e940faf24a1d7cf3
SHA1

e93deb25574783851c7e9178ab3c3f6878f05f9a
SHA256

bd014f1b499402654366249e83df0ab2920966b7a475f078a3c03a5b5b44fbaa
SHA512

7d9c82e35d1f264faa043782dc46d0067130ca6477695db71c8801dc8d6117e2f1b040ce5d192172db4147ba046e8767298e23458d659415d68ee5f44a26295b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1F1B7E1-0347-11EF-9DE9-520ACD40185F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d612758f5d2536fb839c563cfa8bad85f32858ebb5ebc650fd0b0d97b871894a000000000e8000000002000020000000c4d69d2f86e48efee1daf0d0204d77e8598a7f425a5f538dbbc4cd671444623b900000006b701209abecf5d2bf4892af4edeadf347ea8e00d74541064e925b25050c9853984a87054e160d28374d77265a354d07cfba1d18ac47bd6448065dc6899b09e6f48d7e3a608d4fd96e4798b6c3bfa8ca111cee4fc5a6367ea4eafa5278240ffba568ca5ffded441c65cd02b85b90d0aa89d037564b0a74ce6f27510a492c889d09f8c723643fd2c60edd5402f728f5af40000000d271a28dde1adc52d5fac3aa4f9b8665963e8025fae59a4403e3be0cc331db9f7a0a0f7cd1bf0b0acb930d2225681ef69a02c68212072b76371482d7d8ce40e3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420241088"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000009b2190e020617fc3e33f7770e92008940fd66587069added1e23470ab2594ea1000000000e8000000002000020000000fbdd098cb207e6bf04e7f3c662ea1db903ee8e95d35886bd2b54f00a02f5b17d20000000a63a9dec71ab401dffea7ed12c96be0691b7b47db49b98b493e540424a2f45a64000000010443b453a726bc7f6c90df027fa245e60e4df4ac97b66923a98fb4fb823ec7d7a90be7331022558c7f3cdcc1325254aee89ffb6d183fc177cccac9b4aeb9872	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002b80965497da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2760	2956	iexplore.exe	28
PID 2956 wrote to memory of 2760	2956	iexplore.exe	28
PID 2956 wrote to memory of 2760	2956	iexplore.exe	28
PID 2956 wrote to memory of 2760	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00138e9c83786cf7e940faf24a1d7cf3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd0dad801f57d824086243f01ed6dd0

SHA1
dc5e48afe1b61b3ca0b74356c277b22816d896d8

SHA256
8c542ebe2b2ad99c80335f48191882d23b87471943f928ee77c2fabcec8b1243

SHA512
936af8e6a473c0b15941e471879d41d90f4d5b799a5a91b7c03f6ca4989262745f2528c3f2c34d7824d5b3245c6b0b9442cb046c73303775131e1e21d7e4aa39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba91a1d1b3d935265a678d49e95a964e

SHA1
c225ef99f52cb5ee34e10f87f53d073afd8ff7f1

SHA256
90d6f202679d1ea1b7c32a0b156f09434d73df4fc8321109a1aa7b3615e4d372

SHA512
432175b1c46a14716ee6d627c237eeaa08d7c502a33ddae159498aa35fd35b4e25d5c4e01abfd0d89201fd239d50e412058207c02113f8f9a42ebc59a9317b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e4a7c054e44fb6ed080d3df2db0525

SHA1
799e13bf47f80bc0d00e66d68d31b118b982c6bd

SHA256
d8e6084284002c0c3886dadb008c798c6772cc11a604ec8deb91d9dfcaae1d60

SHA512
a832aa3a9dd31695a1620ef75b785c52411abc4263d76388b07088e9c0ab268da6336e14c7da2c49b9168048c8af8838bdd146a169060e621bc1735035abcaf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdea4ea6fc1e07d00b0fa726759274b6

SHA1
334cc4d4f7cd3e6363e9f0394eb06077d0fb6e86

SHA256
ac869e7d82923de8b2acc4c19bc59d3f5d6f30489c92eb0ff4525cc24b813676

SHA512
92f13a9ffb0c4cb17ba5b1b64f388f8b5703ee065189426f4e0a31ce80fb181ae248ed4ae6cd6303d581e4cec2a111c10236231ea60120b94ea64d5e31da410d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e8da9399d41a93b90401cbc305d9e14

SHA1
18293c766d80d8990270532f32dc8fb1a0950ffa

SHA256
de75dbdbda256c8a542c91fcd36a18d5cfa0e00c90efde25e7e228649d8abfd5

SHA512
9e8049b87e7d3751c841f75065fd59a5f01393fe9cde8500c02f2f7c63996f4656ecb055ce88523dba6b2102adddd2234d6b268817c065fcb7bad4efcd476938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a63b380096fc98257f98fcc80403601

SHA1
b735f987a6159c671c6aa0ff80a0fec23b46c42c

SHA256
18c78442a9a75721cc681a7d097fad0629e76b11fe0216f6708170330212c73b

SHA512
dd510f4abd071f02151e6fbab891af6279961e597980b760296a03ee1dcc7c020fc2e13c190ff7e2dee9792dbeaba4898c5aafd716aef919c0fd37a292572162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a73bcdb66d3ca929aa40bbc851c71ab

SHA1
5c96b5eef158ea770701d3b4b8ebbc195f4b0fc5

SHA256
067236c3a0fd6dc24b79936133397f72296c797c21595426858870c49f2d3ba1

SHA512
d5808c332d565ec0f95da1faecf787e84c68bfbcc97e1e4ff77cc39f341075b84a7e1c574510c1e9f8383f9eb5a722670bec60b1560d666fea2c08aa39088910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5200553f31443310bb93edf0893a8f79

SHA1
9f4124ab4651c305f8f07bae4139d59b02df0a81

SHA256
28461ead5fcedd4ec3af4a6bc5709febd09d9f9fcaa8684334e562fea673f6c2

SHA512
ff2068af4e75a0a8f7f042f2dbe028818f66e986e1cefcfb933f3b407170f0bea6fecfa63f93cefb94914ec2b7fceb22dd475b5db4d727cce9eabe728c9c5309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44a5c49ebf986df3e9101585ec10f20d

SHA1
7f390332f3b0cfaca5f64655bd4beffea66bb5fe

SHA256
0a6a502a0ccddfffed24bc5ff2043ecb298167d29c90d34c42498625188298ba

SHA512
8a0921a3da0262071dd723c08a41e7d38dbfeabb47911f29000547cab3c08827eb39a01a3aec5fb1ade7a3305b3b0feef5a2c7f0e0e50043bbf4c50f968fd74c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
332f550a816d0cfbc53aef5f58afa22b

SHA1
bf954be278c877df78cdbc583291b1956934dddd

SHA256
018df1be88abe7c55c7349db658f12f03280fc9ca349d782fcf94ef52c74a168

SHA512
17098625fb3fd98525ce121b45683a4a56961df8c6d7d78f85657354c821b812229872c07e5037663964db4393bf547dda68a86b2286393ff85b18d9eaabc4cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c11feefe28046623565737fc36af12

SHA1
1e37daf6d04c9678d4dbdb31040102cefa318a72

SHA256
83db2874b76a9a6ae77f628968a0b80a8438df223080e0013e0a4795fa225cb5

SHA512
872563839def8f9982fceb1c370c33a343b2e338be62fbdd534cf74e02d7c2eef15d44b8518b13772ef5794b97345750e59fc726402bf9cee041b867e9926a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2704.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27A7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit