36f2f07c6e1902b2aab712f09af1b44044e5cdda0db35251e9fcc4d2e5a8b983

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

116f30fab5a51731712fc5c101ac502b_JaffaCakes118.html
Size

3KB
MD5

116f30fab5a51731712fc5c101ac502b
SHA1

983870d778859c4b155650890935a832a2eb6b1c
SHA256

36f2f07c6e1902b2aab712f09af1b44044e5cdda0db35251e9fcc4d2e5a8b983
SHA512

a0279add3361b5451c084a7d50f9b6c680588b0be79b6fa4fea1e78954a2fa4146fa4bdc58475da2acfe665708317a21cb469f9b936bebf741c46a1dd97aeb7b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b2ca318b720bf6207c1c085861ab4c31a4f52877831f5774bb172a4aa2f09e32000000000e8000000002000020000000c10a6d00a75cdd2a6e28693af1c197dc911389a82fb26ee6e294f9f8a7d2384520000000cff81cfe2db2b6b038ac03477f46463f84c85aca6cbeddb047ca1e9d336b6255400000001584cd9d2e0be280279644809a4bc4389aa750497f9153c7783b6e40302eb337ecf69e69bad1f42b3de287bdc6151946a4e745b5892bc893682f96cc9adbb869	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000002d614176b61680601ed43ffb772d6c542252eee8b275502d4a0394155e9585a4000000000e800000000200002000000056a6e83a95914008e218f50ac816961f313d2f9484f346d34f71640020ec326590000000b3849923cb579cca2de41dc81793df825aa95c35da3c5fbef94a0af6d165d03b06ea5e5e571522a4b30e5b0ec6ef0142d6d338415f5fa0120f2a273b1e43dbd51a26bff2e6308ed1fe1f663724d1d46c3a6c9bd833b415d6719c2e598aaa29408e40b7c139d9d358be5d15387c679282c921fe157d432e57777729ee764fbf9aee79e9d5e024e9b489477e5702d1097540000000df060cd59a7e02f35a30eb7109856998c8b6833e58a26af6875b841a616644cbc014febbb293a2152ad9df83a86ff7a6c1c7471243acbf321f9c98596a8080a0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420957264"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80355f11d89dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CABCD71-09CB-11EF-AD30-660F20EB2E2E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\116f30fab5a51731712fc5c101ac502b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2605d155e9ad9909ab735ed07eeb1eb

SHA1
d4ed0861c6c4c0fd1751ad1b597cc36179548edc

SHA256
d4802f7b553864a483a12930177038cd24969a27cdbce7d909564ed19a5a99b3

SHA512
df2e7b48c79cac1318fbc94a3d27afdbd7f47e4c9fffb079c22140188d9e7eea6d8201d0a475a44b7cb5de26e129019669686b6aa3f103944f81a544fb2f7e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
692983a11000fef1caf09f64e6f947e4

SHA1
dddc310c3128fb8b919ee399834a45d3113e45cb

SHA256
c764acf59d5635347d47866d42a8840b6f7803f75faa2d26ab0d4509b3d7368d

SHA512
3d576cabddde22723e6540fc6c53bf876f147a7a294ad2dc66a324940c634b905e2ac08f35d1a615385878c47222659f8eeee453dcdb860b37c9d0be39a2bca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59fcc831f864a906187116a4e0a579eb

SHA1
5e92668deed736d4c273384c781db4928260616c

SHA256
94720cef107bd0bb6b4ff76b148fe00861ecb82570b9852a07f9a5ce3ca5a04c

SHA512
773e20aa83af12454a793321490b71c6ee0330e75295a04933c24665638c3363e9ad350ea4cc99d58f635dd62b8c1ff63db9b26fe1c08f583a3bdc4018882567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa1bef3447354271dfd03923a902f908

SHA1
4a6d2ff89f018d80a73744a03231506f3164023d

SHA256
0c14b9d1090acde2cdfbbbd3912a284d730788ecc9934b8f656ce08df5a65625

SHA512
2f198017ee14fcc52096c05c1bd2e343d7753fa92da8a24bdee9020942e8da2b5e2ef198395a5d370ae2ca892a5156ef463aa9d44a7021822b1b960f59d812b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fd2f842d110f75dbdf78f78d355aa7c

SHA1
f4924d2662962dd7e50d52b86b8c24450460b125

SHA256
9c34a7f9c669f2a459f586366cbde092abaf2527d0762561bf6aa9214a7b5131

SHA512
1b65883ba12729fe30bec29a1eb15cc13931518d0d5229447131c501b9291c303aeb539ac98a691ffc0ac57013a8f7ed407dc94ba32fd4364ca268e676f265ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be28822d70a423fe4de1c335acc02a09

SHA1
2acdac414371bd14592050ada1f2c022bd7aba45

SHA256
c6cccb44c5880581581449a97338eab61e808646d80159209adfe50c5db978b7

SHA512
2804169740fc944bbf107fce9fb8c93bb9081f60254ab3ba118bfeaaac93c538ffa8eea8f346ecd98a20f58158391e5a6f897b8f0535d0566d7c3796621d30be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb287d604daae12277e7cea1d35438f

SHA1
c6aa9d23b2f7acb9f28482b9cc75ce08a041ddef

SHA256
37d823d7ebebcc1ae722086e0ebbe89165c09f56bf5c823f312176cbdc6da6c0

SHA512
28dc02e2f2aa5b13c3482d71fcd43df55610413a93a08858fb1a58f8eccb671ccc475e33826ec75af72a0419dbfbba64d9ef325b4a944589f450142230e660ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fc44510387dd897e7fa5c4d84ff8796

SHA1
63dbeb3f387fd71b204c29f2e093c1e47f02d259

SHA256
bb5105c7343e2be18229e7d61fb46e7c8ab19810e40daffbc18f85619cd9386c

SHA512
afc80af50b7c6ead395376353fb73a92dff30ffefce479d8506182367b606cc1d48b460bcf3e3960d22ab3deb807296f9cecd77067f5f88fd6f44309ff4255cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ce8171c9a95a0bff4772bb910382a6a

SHA1
da621cd0824db04aab25236ce16fbc36aeb5a6a9

SHA256
740ea35965ee64174998e3657bbae5b26a6819d2e3d0a0df490fb33db9e187fa

SHA512
622ec1552164378b4e10ab9435603ae5490f22eaafae65ed79e25bca3408d11c994fffa7b5f156ed9e313f88c910d34d6f5ef2329edb1b36aa0035eabd815d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9e54f83b4ce7cda14566104be86482b

SHA1
6918059ade28560f8b3f6b3e8f34909b6dcee310

SHA256
a9c333a7c44400e67153ca915b37bb53add7b1109ef6e3b5fbf03eb35f7ebbf9

SHA512
90c251f95bfb0c078fa8eda8b754878011ae3475ff2dd4dc39d4eb50c33a7fcd355aaeb40697965902d634dddac8f7656ef15e853995f490e385340be425b032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6a55190343b7198ad6a3cdd7f132fd6

SHA1
6e15cc86fc62fba53f8cdf85c3522cf6ac7b369f

SHA256
9ba75fd9a08599abf87ab551bff12b45182bc86266b7b4e4d2b793e4bc475b41

SHA512
f1f59a73240a61357e9374f5f3a1390e841df230c8dfb7e14a30c5f1b813d1ca7408f50a5a52e1682732ac75add87f9409223e7d853d0c835ca4c115460cecd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0659db93154b3caf87f20ce32c96c829

SHA1
7e164b7104d44d1b9de5c09ddd2daa5fe4aa2c5f

SHA256
cab1a4320060561c674d50da5d196036f4cbb92d5a7146612c78527faf43941d

SHA512
a01524c530dbc53c05363100a9890177ca12abd10257505ceedc092f7b1246d51a713e298e62268da1228a54e356a6817ec9ba1d4a9d7cd1d161e33cc94c9153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a21aa8c1a57edb1cb3f83d4a7febb19c

SHA1
ee9e697c9642d7ee6bbbcd9d4c3767487f7870b0

SHA256
4969024ad261ba2139dbf2217cdaae6e781f5d60038a28b3bd99e80e92651185

SHA512
698161188bc948be4407e63aaf5f512b498ae0beca51fbac2b1aea791cee7edbc8816016057e303991a7a106326e08d86f4b27912b0a6d25edaf371f67d47031

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E52.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F26.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit