df5d300cafb407e87262801ab73470e6f374dbd0a7da289ecefc74b3ecaf91fd

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1225e5a6007cc8d7f127d98def146f79_JaffaCakes118.html
Size

3KB
MD5

1225e5a6007cc8d7f127d98def146f79
SHA1

355177df9ea53320b6d422f52aa5a24802302c8e
SHA256

df5d300cafb407e87262801ab73470e6f374dbd0a7da289ecefc74b3ecaf91fd
SHA512

bbfddfa99c420eca4fdf0d4942bf8383fa0621d1514036df5935f01f93abf4308e0dd2faeaf08e25c9bfcae7eaf6e6258c3dde73e45bff83444a99b171334f2a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420977581"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000d54998455caf65f3ba855b630855a986f2ea2b7fd0847a7f6491b3479cadf5d1000000000e8000000002000020000000eb56cd7709fbdc4ed1d5e9c113e11eefb713f1fab8d6cf568751685c387fbdae200000007f8685ff1e149274ee6e492875bb82a34a20dfa74c0b36ec45c68c1deaa1861140000000965b8646bbbec871bfabf56dcf43919281a45329e2182cdf3556369386f26366b9d9c4f396604fdd7bcf3823741fc643cf9cd2a2a71a363702001dfca3937c99	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00c1c5d079eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88398641-09FA-11EF-B85E-52C7B7C5B073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000553d59a7bcfa9f88ebd1f8b0e8fd72dc9e7466d8c6dfc7ec06831850329f812a000000000e800000000200002000000076ffd20f6775e3f1283e45fd5dd58821997567f9476b1bcee70cdf742292904d900000000351dfd3de9f22965ddb56f63219fff0e584e227725e26f40a566e60c5e0b4b2497472f68d79a09de1e6037c22cd2534f98ea76ae1a9a9b69c23ce785bf6104cdcefde3d4b9e8e034edae654d50e9ed56d680e717a636a2ce16510012e8d330267d7f2429401c2577c675629749d1e7716a6437f71a611b4dd4f78e846a7a653d4867309c8b6c8e940a51f07168b18b640000000ae21c6dc81b4ae253af894c323f057283b424563e019cc904d7982cf02733f8af67380b511a876f2d8fa0ad0a13a7d8a5a300673113b9839f1dedd283b4f23ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3008	2012	iexplore.exe	28
PID 2012 wrote to memory of 3008	2012	iexplore.exe	28
PID 2012 wrote to memory of 3008	2012	iexplore.exe	28
PID 2012 wrote to memory of 3008	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1225e5a6007cc8d7f127d98def146f79_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac6804ebd21ac5944b99dcc3b02b1b1a

SHA1
515b53f1d2985150e2c25c86bc4b2632595eafcb

SHA256
e59297cd4a31bd01d8e95a26e6d095bee1720a31219ddec83ec3587546a7a095

SHA512
c28e18e3a1eaaf784188928d867eb706dfff4c63bb54fe4b0c5f3ef0ac686e568ffcbee17a73976c75c5b54227e48362c0b4c08094bb6598d84e4140b5aebc50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bfbb7a8f5a2eec250dda40de8be7521

SHA1
f6f2f6ba309175d9c0d3c85ffe42a952c1713745

SHA256
52d26dfac184cb3d2a0b9719233b4daec1d67f2db61669d76202c9d3f9da2d7a

SHA512
3c823b26eb5347238fba171b027a1a857704410cb16be9ded83c4ac25ed2cd14e3a190105d7a3366fb6ea6d3f5dd9fcc05fb3514eeeaa461c407658cd4dad1cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89be7e9d7e9513d154190fdb5dc956de

SHA1
1a1b02b308aee367789bdfa449979b6622d5e400

SHA256
879a37d5b2cf221a0ac4fa64ef23e5ec49591417d59b848b40b2cb3398abc3f9

SHA512
79a2a507dec2371b3561c87887bdd6c7179490225f9406c57aa105686be4c31a28e09a2f575aa75f90b37c4b6ed16063671a0126fb8a9e3a2a7ae96d81d06ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0416c71edca66591b4d15101b569bf6e

SHA1
171ccdb99088a252cf82949aae97d760bccf37cd

SHA256
1ab6016ee42930074b5da6262c1b7be7dad45d1d29f195f36ed5049e74c0f954

SHA512
85d7d3bbfe84fbf18cad5bd810babbfee0e58c5e4c0aaa163726e36b9a7d5ffe4a7ad5c5ec9a0363d84bb077e478e46f7f4b723a5256b65f918a163e28d4d5bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0d14e4cb6737ee93758eaecb4848f4c

SHA1
0f3bfda0c1373e655e343133e9945952f4aac111

SHA256
bfc4ece66feaa098bd9e60522b8c885443b662dddf20d33ddda4139c7f447b7c

SHA512
eaa8970de549e8ef1916d31bed87175123c54a456b0a06e13636642952074c3560f700954cdccf1a2c010d4da38e8b1fcd676403b4ea677c94b26e34d9713fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11e7a1e575ccf3a3cd063019d287c6a9

SHA1
84f9065a24213142ffb0e5474090fa9940372cb0

SHA256
410a6f0731f2d4d2e9485cd83eb37649150a5b0321dcac28519903a6a53c7587

SHA512
d13c6f955d20c884293c9259db86567c125cb5bdd09c36e695871ad3fb9f5020f3e1274e9154c418a0b03cfd1d3097763cbf70275b7aa4509d87ae0c8e4671f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
148d0e80239e738968212a389c5381d0

SHA1
c28d3eeb14db01705118dee0071ada124fdf909c

SHA256
80a508bc656c239489822b6b2b6857b8b67fa962b72abdfdd47a0ee0b957d96b

SHA512
395d92fd8a753df8f568cdaa12b9da176f79fa1b1f5fb55f450ba1c22cd54fd033beae5604fac68dc33dcb9bf3fbc04f1d18033022065f0e3680a853924c8d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e1458b0dd60d8a91fea977deeb79058

SHA1
5882b3b0a939918e98253beddf17b3210be66b20

SHA256
ea2c4793fd7ebc1d60ea7a2fda52397631b08f44bb99397b9eebff53f903d58e

SHA512
537ba379390217bdf2bd10cee39beb04a6c76e2aea1cb8b97ec7ae73f70a5f0defdee24c69c92fef7f68e0febb95410c09fcd543911a71a1f0d3dedb56058aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f080fd364325eaa317f88e87605d706e

SHA1
8e70912f6c26d07abe91061aeea1858b49c2f3fb

SHA256
78d31d99c611882c50a0a69688517d7bd9b3cef07e35341cc06030d3e483e848

SHA512
676a4dd222ed8ad2dcabe430ad80025e8bf7c4e0e48349cb0498e9a1f04ca0912893f73ecf7ce09f68425afed57d5757e5bfa404051133c5624a2968b5f48ddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B6E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C40.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit