a91b721b2225a57627cc62bed2c3e846d629187bf59da510a9825e5d9a4dc167

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

003f15a7c067698a4325d07ee9a28ad4_JaffaCakes118.html
Size

3KB
MD5

003f15a7c067698a4325d07ee9a28ad4
SHA1

e59d5b9137e5eb12ad7a72c687394759d14df982
SHA256

a91b721b2225a57627cc62bed2c3e846d629187bf59da510a9825e5d9a4dc167
SHA512

c82f3f18c4fd89da7587b4cb7c73ae7921ed7e864a3952d175ca0a582575bca51255a54dec841f767c576a3999ddfa589b2d3d22f795af6f2d11670630de7bdb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f2ba8da897da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B894ABE1-039B-11EF-A339-D22A4FF6EED8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000009f40d10bd17447fcaa5af8cbdafdc09a69bf2d64f2715846532e8e182aec7099000000000e80000000020000200000008cb72d1be4ddc7fb3c0a2b8955a748661c92499cb3feb2d373c776ec8cd286e120000000fd166698f5cd7acde774ed9a3e8b5c2f7e07b73027c10d9f21495726dbfc421a4000000059bef34c023269630f6c5ab66c6de2917604de587d0cadfefe44a74ba60cb881c8e1bc23a33e2744f2b7c17628c9662a20835ac237024ab1eb860ee64c2379ee	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000e23d96a5df71386a9862a36fad1315df87ce2b67ddd10119977d164302676da8000000000e80000000020000200000001a2f0865b2a563fcbbc7191a476e96a06c477e12ed9410a230198497e22b2445900000001cd859ab5cb1299be54c55ad6473d20aad04eadf204f6b8c45f00e85b76943277f4c467dfbf01def89690487f86f221f5b4fd6d252217470fdc7c4da9a4379145b900fd330baa0acc4c3a86439f8f08e6693e3acf5894564b642fd2461c9300499ab47b046dc57c0d5608146aa4ca02f4f6c45117f98aacdc675b5c35afce57b591b08dd911f55cd5a1e2a4e2134a6194000000081efe34e7010ca1935acdbe83d3c9e57f4b6578aa55dfa598c103ede00dadd67ad16f78a44c56599c6d683db085b7a788252dcffe965c16535c943762fa44744	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420277177"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3000	2488	iexplore.exe	28
PID 2488 wrote to memory of 3000	2488	iexplore.exe	28
PID 2488 wrote to memory of 3000	2488	iexplore.exe	28
PID 2488 wrote to memory of 3000	2488	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\003f15a7c067698a4325d07ee9a28ad4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5ca44b5fb5a81b9938e9d3817de01d1

SHA1
0dfee18e9395f46d4b7b1da5faa8274f260fa89c

SHA256
b4dda0179a94996ee3e6c9f627e46b1d4e1ae7e1197d6bab805dc015bd2b5786

SHA512
53da8f220079c85ef0ef9a03f422988a6b3e13d6755ca5a7a36ce2904707a179c7f226b2b8d8d96b32f8d7cd2d6848d87bc555325e5a31fade84211ad7aab4c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba2d52ed004f3f8f626307edeeb7c165

SHA1
4f671d2b7c954111026facf4292d144eaf2944fb

SHA256
58171a08433acce968a2cf62fb79e846704f897ce709d6683f6129fddebd8f5d

SHA512
4df80c55a7f7964b1f0dc3c64b9bf6fa94b9f771d2ad88d65d7e02bfe222e61683ed4915db7530a0ac3cdb3a327e33f054f35fb6d5244c27fa63774a3b5dbbf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd4affbf5e5287122eeebd3d391e5a7c

SHA1
61b5bf17efa1e59be112828363d4e3ab61e676e1

SHA256
f287ada4357a1a889cdae7cdd7642012449a9aefe02ced79dce9ed4037a5eafd

SHA512
57a43edb2c2bb3256db01bfbcb1c8fd95abd55c5d5c423313e844b7a406d10012c37e3529b4547440ce3b5fa231fe06b1a7168d0af888e5d18c5a7c40b5e9c77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c254e4c1e03c0a6d2db02feaba645095

SHA1
45873bcb89926047add86659127c00b1442d9f62

SHA256
60ab95be8fbc60e2a93aff73c28397438d01b26a474f940f2e28686f7b962407

SHA512
d70eb8abe8a0050d1f6c9d336be5f4651c091d6dfa106007deb96ca2d96e433c4b56aa0831dcdf55269902dbf8dfabee5ec36c509a324f227dfca85625c374bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d26142225672884974216a1a18e916df

SHA1
068464d8427063220e0d8137b8de1af7f6f7cb78

SHA256
9306dc28a978ff95370b1f4ea5d83f8e824b236bd4d662208989ec2f1fcddf73

SHA512
eb28b4824625cca2d7d2122ee958f00517b4730b385cbaba954a4b7af2ab2e3eca76fcfe4a7c09a811487dc68bbd6d5602822bbd99ef64eba2a8020218dbc10b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f658bb702c2b35cf695991f888b03d97

SHA1
f856b9711c85947b6bb5c75b0afdbb5283d5355e

SHA256
d684010c0006dc6ea9d61d762683d0f6365f27826503b2417b71a2ca4825d785

SHA512
d2105f18525e44a8734361f0689ebb9e13805f7d2e19e11c9752b222b7b99041e80f7e4a9a78e7748e155e8943b153f071e71a7949562ab0159a1a7f389d7e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac8ae051b71698ed4e088c80b5710fad

SHA1
e966ca0c8809ee7c0cbab1136cb73832b56022d7

SHA256
09d637e7ef01796eb13c0ac4829fc8a8b8aa9f3b2cdfaab2491d54269473a2bc

SHA512
391953c6ee401e4533466f1cc9c329ad0bc6bddc909c4670cc07e3a6010a81fb317907131b6ebe3cc4b8c3a0adcab687f8bbc40f5c223c58ce1e3c1be7a77cc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3f31a204c0f1f90632e874135ac6efa

SHA1
a2a76b24313ece9ef80daf440574937ef800d8e9

SHA256
a8926b119d073b6296537e06fb4d8c37966830e797764e9573f2236f3958b1f4

SHA512
79a0f6b68f750d46657d3f9ce29f80898d54b52146e64d9bd6f538b5015afece35e1dcaec2278f63914a55eb60db2d1b385ea156c103a58f307e4a394baeac6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83bf1200e3c5ea6cf377ed831621570f

SHA1
9bbfc7fc14a8c6ca66f50b2beb6c6614034048c4

SHA256
d6d4aa81e312299c4ff8a5abdd6ac337edba424b02bdec3e13db589b06dd0355

SHA512
5b4e021bd29ded0ca441a8b39594c7c0955952574600883b6f7adc78a794fc0a8187cdeec53f79f64de33415a9bed544a6443253690bdf3948ff404f205a1c96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f4f196e72afb2eeef96399c680c0dfc

SHA1
a6ec43efa43ecd861dc887663f0037633cd2ae57

SHA256
8583768a1107c548e8a2cb471fe8b1ea53888f944109f23e6c20f434b48f8a05

SHA512
da7d760fb2245ee29b362aa48b197abe2383d14af044895f3f9dfa58b4e94eae863c8b6a29eb5852cbf534bac3997a97cf7b65c6cf07fbc8ffcae7f7967a05f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C2E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit