1247982d5518a54fd6c9c31f64b2546e8ad68875dcd1b694a9d12a1bc9b40e35

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00798b19aef9f5a2f289f4639371bb2c_JaffaCakes118.html
Size

3KB
MD5

00798b19aef9f5a2f289f4639371bb2c
SHA1

81cc00ff095e91bca0357b28270cbd2f457ff9e5
SHA256

1247982d5518a54fd6c9c31f64b2546e8ad68875dcd1b694a9d12a1bc9b40e35
SHA512

589c26dba8bf73c81068dbf92a2bb84b35ab21e4b0bd0b7b368072a642a6392df07a99d4f60fd81a68ff67b04403eb5fbad9c1ea7c03414e14406f792bb159b7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0153d61bc97da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000401aff4d2bcecb834c0f357e0234de79d2d9f0b67b2f019a170c9d782a3235a6000000000e8000000002000020000000de29dd7989ee6c676f60360e909b8f1d3a0c50ef2744fc69644ac40cf74c036820000000f7747c46f8be398a783a86da6bcd8dacb0b2ef821e648299ad0e257174a294ae400000004fb887aa431a16d1089428bf1d327fc413822fc2611442af94f54a9508c583173fbeb9c9b49e3515fad7e8a884c8c147b52f0d86911615876a714b2555231f13	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420285644"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D020FF1-03AF-11EF-93E2-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000033ee401d05147fce5384731c8a2f755950dc160a735b0bdfe77c5ee9eccb1314000000000e8000000002000020000000798824d89e1242bd181708a6161405d990516f4e35870bd0afeb8a56535e7bf590000000819c5d06de22627a8c5d3b0a71e21c4489143fc6540f7d303703150011c142275f2f8199aafbcbd44eea2d93a716dfeac00221274ee81c3ca2f7de5e541f73e209a4b527b2da6369a0f6190bf41d318f6f340f41f70cf04ddcc9d9597761bb96453a731c78529b4bbd7e5c7150062fa70ca5bd6ffc13f92ece0da235a5680dbe41907a791cc08adbd3987633a14e47a24000000025c1890798a6d25d78c6dabc17356cd84c721f08c4b741c918e86acba047332990db30d2af0e251f33318f0031394b15841a2bf038f1a291f0cd587328911809	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2440	2664	iexplore.exe	28
PID 2664 wrote to memory of 2440	2664	iexplore.exe	28
PID 2664 wrote to memory of 2440	2664	iexplore.exe	28
PID 2664 wrote to memory of 2440	2664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00798b19aef9f5a2f289f4639371bb2c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70c2150bf94a4b002662e1e9aa460be4

SHA1
37c604cdfff820e73c6c3e99bb6b7c1882af959d

SHA256
ed3575f9380235367313b0f2d74745be18f0d9878d1432416642f0f285ec0c19

SHA512
0b12412e422334fa3c5a6aadeb695b2b41fe0571a044feeaa681d7f3f9a86f58050c3387f2ac47e41c1e19cf6e45aa1d3d957485913f57edefb78571d5e5bdfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b38dc819c40e6ddd552a0a7b9d0ab1c

SHA1
b51b2ef351023655600f8544dc32cc0f45d21c3e

SHA256
20862a0aaa216ab6c4665ad73a6da82fcb851e255cac56c3007e8e65ad5ca597

SHA512
be434c82a9241386310ace303689540154fcfd77fd23a3acbb24446a186eb704c33b63084d7db82dfa6bc833e4c11de3967594f7e30db7ce6b460fe22a59ce82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43fd34293ae27c22f75f2b3f99f3f835

SHA1
6db22d3b8a8126c31e535e6b7c468fc8e8967d73

SHA256
13efb7e5e438d2302af13b5779497e5c76b1e14a1038ca582b9b31fb13632531

SHA512
d4c22ff9f8deb669e9cde6305f6ae3122bb3c7a7eba026b12471d5a1729e2b1705f6fc705d2dfa25756a11038e68e27b3531bb3e5583ef91f42a793ed650bb65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57a49065a04d3243a2f47a45ba2fed9c

SHA1
290031503235577e958fb2574b800561c310c6f4

SHA256
c32c66905fb9029b8f3ccd1c7109b3f9b580fb53bce5354b536e5275d1a8a1e6

SHA512
8219d95a3b8ce878bef1f9d97af9abf964a87f7790488d8c9b02537e1e4f12c36bc4cb3ec6165c389b353a7e57917d27b4508c13e7a4bd3290b26568138026eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7737de06e546e41da86174a52cbc887c

SHA1
6c8b5f25a0dacde1a7fec56f7a6d7624c1d24344

SHA256
a414035b2dd5b0652f219bd10b61d174a277b5ac037de38995350f2fb854d252

SHA512
e78f040c0d1eb4a113c25a0ebf609eabf17b9ba807032821f8e1c1815f961b812f25c4c0c06e61978c8606f3ef6a6ee49b1b62c998860a3ec66d94026a7b679d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdead2ec2311ffb0a85cb225b0237cd8

SHA1
7b47708dfd93cc9f2ba4a43c757c17976f416cbb

SHA256
cf8e324de555644c48bab89d30fdff5621751ca063ecc032102ca70917a1d90d

SHA512
88d9a4d286cc52a1f744c02013527aac1da1194199ca3f1fb2fd9e3d8c63557d27ad1557b557c1a9dd2e05fd9b6fc4ad1212701b3bad3752c6a15fceeef48f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e10db42ae988026f9f6f7a67391abd1f

SHA1
7cefe19129514c0a79df75e0dd6d6b02b4bb4912

SHA256
a6c9938f36aa2ab18daa272b3aea11301480aa1b9e88c559b6cf3272b9b97589

SHA512
a3d62802636e05d36f1802d22a1dd1a0b0925d739554060cfac928d2de2dc4a2186011467506d8a7f829c1cb8dba45a4fa9ecee66bd927afa147713a8714a873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dab56e754984c3dc1afdbfd286b78b18

SHA1
e69f1d2c510148918615fbfe8d1f00b0e81c3f4b

SHA256
8a66784f960affe0d15d63e064d76ecdeac88aa63de051015619c66bfdfb67f5

SHA512
522be09312450e5880fe7d7ddbb03946626d8199272c1c4284ce5c6e7929fd0fde5a3583298abb311767491c8cd0c39e64af200e03d93d9c0190c7069dc65114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f0972813cdb160a016f7d3dd2dd242f

SHA1
64e81cc7e3d0657e7d0b32d0142b995d4646554b

SHA256
7a2301e6ded50b53de10f5f8da40a0d7774bda29562b5aba0bd541f3bcfb5cac

SHA512
2abca2a16ed104fba4e23ea73028aaaf7709016dab0cff53acbaaaebcde201c452cb1571a6b98ae894f49d52911f84cb4c2b3ed6f0c308de82f20fd15cd8d362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8761c880c01a9d6049550da962835f6d

SHA1
d423cab01866daa8f04c99130cfe51dedc839123

SHA256
d02555262a153291626d573ff304781d2dea12556369258d3c0a137933d3a482

SHA512
5e796b9149344639ae356b27860e596b1871a3e5b69dc118d8fb87f389cfd93bcef5602e931a2637841b89d07d2f06b66bbbdc615e7b958b0403db68d105a5f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
826b812100e0888e91d45066f9e6ef3f

SHA1
2e09fe565f09a29e0ac6a363b46352ddb012bb76

SHA256
3f0f992780237e9f1a660f19f3ec5100899c379316426c1dde3cdffcc070fbae

SHA512
8053d38a1968ed4e29d58c11161f7e9506d4d6a2ef646c42fa701d05c7957967dac7d1c41e49c87a2c36a291eb218a8fc37faa678a551585dfa6a5c7d82fdb43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f65895543697d68deb4c6473758b428b

SHA1
987b401fe91318fe10733edb88cfd99c743bc4b6

SHA256
590ec65fab9b196da0e3337cac7c6b1f9a78c07630cecca5b4adfdd66b7bdc24

SHA512
500ba1faa406a5a7462196bb36a298c19b53514c644047335a368c01989f578edd930d2b3949e5a3370d8e485dc1ef46004b3b8d580473a1c02d1bce220646ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF15.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB004.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB017.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit