3dcbc4792cfe12ca80740793dea27c3543c5dbee27e58f94ec9a313116f4553f

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16d75bdc7de5f8331b738d5df3322861_JaffaCakes118.html
Size

1KB
MD5

16d75bdc7de5f8331b738d5df3322861
SHA1

2e55ec169a59837a4fd7c47cc11e4c1d44b2fa8d
SHA256

3dcbc4792cfe12ca80740793dea27c3543c5dbee27e58f94ec9a313116f4553f
SHA512

c0fd288ccadd4af25de534b106b69fbdee061afc9a64278af95fcd17886f00e3a6bfa5ee0883c5e0db40a765942393ae10aa967b63e45bfdf77290194a19d538

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D5A3C91-0ABA-11EF-A1A5-568B85A61596} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30955f02c79eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f50f418f3115261f812f0dc961611455250c1d69f66759f4f625fca38fc45744000000000e8000000002000020000000a4a40943472b9119c7b1fb607c9d9de1146b9bc16aeb06c401fe45c7b0ccd2542000000060b3bd41aeae536570804e7423cccd1a2720a2d7ae6fa49d2a6522224e3f3291400000004c4d4954a40aade3b4e758191d9c87f808d535a91cca616d57ecb34f80230a671d1bdf203aa7b6384bc97083da5fafb6581b01429bb035e09a29dd64d6254a00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421059895"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000a16f22437536c6befcbfeaa594bc9134b6414b31c418ab6aa97693d21b1541b5000000000e8000000002000020000000614a71dfb0df46ae07670b27f6aeaca59b926c5888e36438c2b466c74afdfd9e9000000073fbd603be0c2c00131e6e0605045c9cc0688395804fea6ca7ef61d1d6d7e23b7f6482dd92284883badc09730568e3a3e9eb73bf85ca275fc3f6dbe8d947acaa0604d292bb7486b7d6f334cdb9a28128b1a246ac8109d507e0e863fdffd2eba2543f964c59b8b8ef3aa9ba54c40908f803a51444f2570b0f2c4a3790c64f652d5d5f64990e19ed73930c62835c9af639400000002a35d07a15e5af37b38d49058f748082d7e32f8e07fb77170461a3bd1be5269af16eb40d0f46042999f4624522ec4f5d65812d0b62e2d177cf55ce6fa4b16eeb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2108	2356	iexplore.exe	28
PID 2356 wrote to memory of 2108	2356	iexplore.exe	28
PID 2356 wrote to memory of 2108	2356	iexplore.exe	28
PID 2356 wrote to memory of 2108	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16d75bdc7de5f8331b738d5df3322861_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3be0dcfcda037f42fae07d66c86d831

SHA1
3b9151d0d054b79b874dfd6374af8d555570772a

SHA256
b207c4f2f8970212ddb543873b97514c4ae78136fcab54a275ab63ffd74db4ca

SHA512
bf2aefc64d95aaf3df1ff69881747a4c3f37523e836ce489c743b5706cde29d0238d21ad81f27d5f55d0951e93e82ef8cdf68490e84cb838cb4e0c191703651b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
228156ef5e9b29d24fb404b6e33ce073

SHA1
92d3b34f7e29587eae4da783960d2aab9b3d309f

SHA256
bcec02ae4990083a4d648a8cfc00d2670da8bfc9a41c1511ba8586c2a4bda454

SHA512
4773b65f16ab3fbd1e14f2ad0ad69195efbff711f8b7a3d1c69a03a69391461a4c5a088035377177f2afb9dbf4b9522a586a11b6edfdf05863883a52b9ffabb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
808f60684fb49a8a7599a2cdeea982f7

SHA1
c1ded0fc7030f0af339ba110c0aa722733ef2f9f

SHA256
99cb924957ec96cff6bab07077efabc9226d6ee45be7326e72dabc1bb144114b

SHA512
73080e668f07c4002281b5ab4bc40457734f32e9c46c9ba5d1b6220f8e7a718e6c46d083a1609a0275b4e3987a1da0bf35bf14ec391bddef39002fb373b8033e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d1e04a220f6402e11c127ee481b17db

SHA1
fba42e3881c264753f4cc858647d2f0c99092aa8

SHA256
98aab3649f710b6ea0bdbdb49f7cffe1a073cf352f94725ece383c36c971ac00

SHA512
731b6144ef3ee26cec0a574fc64e70ead07a6d5adc8307bcdc90230d81d3b737e044917d711bd17990090d9fbd1aab4745481aef21f916817aae95678f9748d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0625eeb4737d1a3b7a7f216633f9cf54

SHA1
9f34fb12a07d7287298a0aee34702ebc12d32f30

SHA256
8918183dde9a91a93af43df413adc1851d9e5353c42fb42738a43d3203b8b4ba

SHA512
f60960cda0e9d7f40b3c390a66b51a8b1fe809e3d173b1b44aba5ef09049ea37bcd7474b6f060f42cc09cd540cf8e2343b75afa7bcac738f3f9f909313667cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4e0138605e4f953c8b6635d7198617e

SHA1
282d1d508348b6c78708114a4cc621b3ac768956

SHA256
c0c4ba7c25c821095b2323b11caa25358b7276d4e78bc9237f0464dfba167bea

SHA512
dbb91000965dffbce52b7d864dbc326a95304f36cacb08b7e54dc31dfc4bd8c898b60469d0acbf738a5b9b1b4e3994e12645d2f520b84b6ed3e310e3cfec6cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f1b15cb27ef40e4d2385b910287ba8

SHA1
e3dce8a9527ed128b4beb2c57d4bcefcae20f5bf

SHA256
7f910fb144f034aed84de17eb6f9194b239ca7706d6b78a8ef5b332610c3db63

SHA512
cf197744f326b6a0dfbe19ea0998b548c9291bd7d786bb7cc5f654ef4d29fd3b770bef8b2ad19fad76d6f80599edea5c7e56eaf5305a63cb12b1862dfb40823e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e04a9b1311ba14abe48cf4f84afcb44

SHA1
b4eedddfbc52a82c1237726b653395c30ea557a3

SHA256
fecffd6d428e076e3755eac9dab9b42d51452517136137cfcc83a135005340fe

SHA512
7638c47c7c62d4e0b0e299b4fcca62f32b2b5c7f927432dc8500b8a74ded108e778255773cad1fbee6ad65a050a6857f2b73d757df6846e4528de7456a4c6a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfae172d50880bb2ef19f639c6d5f57e

SHA1
c0cf2d5e887e21ccdeaa1abae080eaf58f3210aa

SHA256
c75f953ca9ceddbbac3f52ee8cac48c3a42f875e18494ba3de68f5fab1c34c5c

SHA512
8d5fea712216843d04635de186146cc44662ab5d8e803dcd4469ed7274c9dafdca506b034f2b92f7620bc26d9e181f5491223f6ec7a287c6f1a81c26045fb272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ffd8588a2d8c2abaecd248a7b36155b

SHA1
6bbcbc365a01ec89c3258f91c2bbf577a914e323

SHA256
d0d80601a4ee211fa7c5678d4a135ecdddb9a84c783b29e00ee0dc3cebc51b2d

SHA512
18f2a4706fa05cd4e889e8dfa829e90f8496216abbd7ccdd6ff6732a8c02661ca1b4d6775b2cb3e59ebad44b48c0fd7c036e34cb2a9eccebfbe994a1ba61ef21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
503e00142da12e7a482c091d2f70ecdd

SHA1
de2abdc4ac17c991b16dc3cbc62013aea24f6230

SHA256
6303dd007d67b958f06ca6727d943861a5b8d1499fdfed7ce80217c9231d6f6c

SHA512
7fb24e270e9f7993329be0ce6951c19950b49d16c696d11a7498a2f9f28c2469086da131c8f7d35736b4a8591f3bb20a7fa142da140aa999e0c9711d59570bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e040b8e3bb35c603bc1a5d247116153

SHA1
f42d8e672b56835d52feb8ed6eb49b8368c14ed7

SHA256
02ae5ee0d1c3d43a6ff941016a7888b6d7844bb4cf668ba0238c177bd2203868

SHA512
9f5e415b019df872afb673e4228fbb71663d9ed5f6a11a3daa645433206c76eb6a915e4272e1df93fd8acfa77fc85cc820588738de1b3776e880bf37c4e9431d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FAA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar309C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit