98b865a01ee7c2411b454c28e21069e16fe5e2ee757683f1c1576fd83759b205

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 06:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

003783c9f56077e1bccd993a5919d5fd_JaffaCakes118.html
Size

3KB
MD5

003783c9f56077e1bccd993a5919d5fd
SHA1

ee685dfb5345fcdb0cad7a04c4b333e00ac9fcb9
SHA256

98b865a01ee7c2411b454c28e21069e16fe5e2ee757683f1c1576fd83759b205
SHA512

18b7d484c085db8c897609f3c8638d1b6b15c15c7196e6871c455a0ac44c8dd4da00635e27d0021a822d19d91ea57cc3ca80b3973d994a2a504662cac9992922

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009ea18430a6bc27226c9f58d12543cf28d026140d45b0a59c3dd9f1f0013ae73e000000000e8000000002000020000000974806981ed101bf6c6f0aa1dea5e8de59b0dde8fa33ecdf7dd750e4ade242ee9000000046e5c8f05741d7b314654ef3d144bd509e0e71e9d341e070ba72b8582481783284e9861ae687ac2b8f24b99f89fd9d3d33b878ef28acd402639f5ec4b4ebe8ecf7102a50a7cbecb9459cb9052033d7d162e7f06b23e57745fa6dcf2766340fce19abfe78e75120ee3861c025a6500ec1f3919b27819d4148fbc6217362dd2630e76050a459d1f66ef354b4b23e58c00840000000871e8bc74a4012f1a0c9531b4e5ce09364f1283f61805fb1d36e3ab477c1b0fe423300cae02febd798c90de6d501763da6402c2e5296332ca0aa4c998d26ea82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cdc7aaa597da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420275903"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0B371A1-0398-11EF-8E7B-D20227E6D795} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009134e6ebe6aed6ea4c62b3b34412ef7b58477202e5a15e6d59950d5b1aea3d91000000000e80000000020000200000006107875389ae2093cd33369b20753ba0259dfe91f3f9055b57dd440a739e28f7200000009456b73ad79fe70da216bd469b8264633efa5f490d53e89031a5c64eacf70f9c400000004bb3ea37d3eb404c63ac81e387d4b6388028d964bd5e297aa85cfedc49f33d94443b0262cba8ef19c2edc50363db8645642279acfc708552fffefc065e684ede	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28
PID 2228 wrote to memory of 1156	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\003783c9f56077e1bccd993a5919d5fd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2459c783592e63098e6698dfcceba399

SHA1
55bbdf0f0f6190d065f7a2899c2d7024549674bf

SHA256
24bcfc02cd2bbcbfa99f21bc573d550f4ced22b983d5a9dccd5f6751dbea0471

SHA512
08fd9d9b5603d35eac13da9d324b22a59bd385e07858a80bae4ef23f264a84f81845f78968a4c19da7d5e9b5af6b4192b67db2f4f82308bdb36041145ef07927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83cffebbeee819a36a7af70ed3d85cfb

SHA1
9514fa10fb81557331f158dcd1ce1a7f49719fc9

SHA256
380e9fe1c8ddb8c7526c3099803d892cddc7a05db40241e6da41baddc5ae0a1e

SHA512
5766f53c83ffb2de5d8f68ea0a2771a79ba2ece7efe591901ac466086891a8ab6b0980b950c9c325c21c967f53bffb19bad51413bbe605ac0cc6bb5a2382d1c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1cd7db358ae63ad6e736f21030ba46f

SHA1
0d6fcced49efd7f7290b7779ce2dd03be19a7ea8

SHA256
3ee1ffe8591b45b0a6ce165ca985d9315259941e7aaf9328ed2930064a939117

SHA512
bc68af6a6371ca6923b490ae5627a4233158b1a3df284f80de9f27f2a64bd507754e67e9a6b55d14f119b49811c02f9f4b3a2ee57b1200c056ff237ec055ced3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb879261086401adb0e1ffc5b3708c6f

SHA1
a7b56575ef15f0e379c2db29e7a4ba377a5dc4e4

SHA256
3d494aa502248e8b622cea1e5ff65394ea2291dafea3dcafce2a8baad191fb96

SHA512
55c4c5ad77606ba4a367525f07124e91fa67b04d1a83aae6ff92e10ef7d231218868af7ca1b492b2bfd06a0112fc8e39c35c02cf0af0a43edaeb073404ca2b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
266d20af106882b297b457622ae55cb0

SHA1
03834136c6d49e85b6688f2be86b80d0e4b6f994

SHA256
274b95ca0eb2291498cb852d724a29b49005eec0b2079e0ef21ca7cb015e3604

SHA512
07e30b3645e8d7b18440ed916043fc93fba9deacc008baf72f26de544f20a7f5de75180e9a9fbd5a82619ad897cd2e560a77e1b18312bafb44f61e9165e3e7eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53dbcb40c3882391cebf6abc4962ba7c

SHA1
085a8b185ffc8c030332e20aa58f0e1b99fe1e30

SHA256
626b7fd18483592be522cd1c74b60e3b735d0b63c93c9c796c4c050a3fc2cde6

SHA512
fca6e3f7f06aab50a3818e541f4a84431099c4d515ffcd01d9601a174bd3b8a0b39b3ba17e867e578000e52c0d5d75c4f242630c5ec0e548b59a8d2d59b2d536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf3d9c63b3e0d60476dfcd4492149bc1

SHA1
d7643e46c0861a21cdce56a1f97138859b59f2b2

SHA256
c5e480f18f94ab33129bd2aac91fa2a4f6a8959885dd1f10b84da2463add1ca2

SHA512
9a4963f4013e6c6640a43984d66194fb51f2b36e9d1074c6a2303aa362da5e2a52456d514b5a3d4108ff9bb959260f64d3849489948f99d23bc04d9c7d64bb2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1340ee802c7fa69e0c405f652904abfd

SHA1
423995d77bc7d93a15905361d97d10c9e98b9182

SHA256
dc9c7ac1c1542a574cf8085189ed04b98d0ceacf5f08d3de3c1822b0a82538f3

SHA512
ddfa8aa371c7fa014f6585ed23ef5fe207014013aec2ed8a97ed8ecf180a8dbd00c1af2c52b0920e7c5f0a3181f6edb4c53f2daec1dc8db01de046bc85dacb9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c95b1b134bfd122e6c6a7d82ae3c5c5e

SHA1
8ad314370c97b60bc00512444670f3f62bfa31ed

SHA256
027c86531f6010253c6ae2d59e2b97040cb8cdfdfa636e96bbad5782d1b37a7f

SHA512
2e44920a92904bf70ee21936dbb9907cf2c7bc9d726fb8aa7708fb482c0f5b0eb14e7e952723c1bfc12e1cfc4096c307237e8c8b85af9e624f23e50dd1a0f3f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4140fc9bd515d0471240635c1ce4fb9d

SHA1
3880af38d46f769a3c853729c0a2347cf22dfd0c

SHA256
66f2edd56c67eb060ce3ccbda3cc8f5bc2e69a169474f9b9a5feb47777c67cbb

SHA512
2c2d9f5cedb975cb940d2ea6b138b2ba1b4155f83fec8995495c8d63b99880dd6205d133ff7825b0042d71af7a90066f9ca16982dcd6d03e9fdd3f30c1a7d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5100.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D73.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D76.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit