bc5de515c549b09e7fb4577898df616bb607ed572c23899c208d767c55c1892a

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

224c75c4515d42a5aa7e83c2057f8c2a_JaffaCakes118.html
Size

1KB
MD5

224c75c4515d42a5aa7e83c2057f8c2a
SHA1

033f45b34c2495d6cbcbc98565b533d550589853
SHA256

bc5de515c549b09e7fb4577898df616bb607ed572c23899c208d767c55c1892a
SHA512

4f287d4a21535cb0439973e33b770d53f812fda402505a98a11f52ed110e97fd541e570d7f861792d198af77263f5798f6cea5ac4c2cc53471f39c77ca063058

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F5762E1-0CCD-11EF-8A7C-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b8da8cdaa0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421288144"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000a3a44f16ee865d30e424c46398d7cdd43ef86f0871b7f5898aab5b3befca6337000000000e8000000002000020000000697ef83fe6eb7c6dcd91a7821307799b0e98c877ec46ffa152c1d7a00b1accf4200000000341a4d184a0bde45c6664a0434140a081aae5b45684e940c210ef22ccd060b040000000aaef0a526b652c2ce07a269af6fc2cd7b924d78e80f42d5d0903570f82543d2e7d9ce57d85375775284587f45a08588b020ba7d155386592639800bb26f79b4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009cb7a240c4a37e78b19834d85b523a3a72dcc844072c9d58b620feebb633e679000000000e8000000002000020000000d7de753ad0dbf18d82e8e82c52762235e51f1cc70e37e203655ace889b9a305290000000eeb6fd8d46ed66d68a4ce0f6f4b8715ba878c775293fe5a180298a31d921f70c89641e1e3f0c0380438a490130690ce24fed7b66ba133b0c91c6f1b866348c87d254b1bcdc660e92d915c49c1672c3ccb325ff431482b74ee004add4038e8011e2d36dadb2c89b59f596a330e94e537a551eece74fc1856a8533fd93844e9473fd5b02e4e338ba510c48ce84417b60c240000000e631637edf9faf721b05f9fe10e43d1d9be46631dc27e1b769d9153fead016b57ab03ec55540d1b3a24445b6f4f67f689c223784e6cc6d97300adfe79b1f986e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2936	1740	iexplore.exe	28
PID 1740 wrote to memory of 2936	1740	iexplore.exe	28
PID 1740 wrote to memory of 2936	1740	iexplore.exe	28
PID 1740 wrote to memory of 2936	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\224c75c4515d42a5aa7e83c2057f8c2a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9b3566e32514febc8555f25349442c99

SHA1
668ae0f204e11c09173b568dedd4f7fea89b816e

SHA256
f0cd8082da31130cd4e6a2c642b2e8cfd82885ab924980dffe97c8db195b8044

SHA512
6597805e05db6e406bf8bd4c7ad16b4e59210dcf509808086b71e9c55a0a64c93b9889a73056b6470a6635c10ab03a540f5b159552a21a96fcafa5e597e78e8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9fd3240d511500f5c2fae82e94dfe7b

SHA1
4ecdcb7e4b659371c31fe11deccb26befa18ca22

SHA256
d40ca9af904fc1d21d446e4d74d410eb16b365ed361cb57b1c3fd0124a68162e

SHA512
e016a3a210b0df187b5eabbf159927874a67482630f8904c45ec2e857e7d2433f082f6fac4999c72d148e8b86f71c0df4a77cf275e5b730b1360ce0917568665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a15995e202502791a5478cb91dae0cd

SHA1
f6d97b8df460f81df31d93aac197fed6a54e24cc

SHA256
aef6545b3912ae534c6140e5bd00524c023bb4176b7a0b26f1b98e94c0d41438

SHA512
c99de697c9e22a6cbf945c18e9b0ceb634194b87fe6b865669c18db6cc53a69fec8c2108deab5d28da531fd89753d164794af885f9593ca594a02ceaf6bdb8d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e17c8bf882b7270fb757bce81b6fc5ea

SHA1
d2b55c3fd066e3fc308aabc97b8751cf80d25659

SHA256
ffb963ab109e46750ce53dc7718f2242b2f704052ff3bc1f2ae042cce21bc81a

SHA512
7083709b43752dcd6d64ca98aec8fdcd5b3b4abc5d5b53866448f6e7fece7d399500a10efd74f1b8761eaa7be8048d61f01f1cc5837a6b940597c6367827c84c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb14e31dfd565cd3196b93e34459017e

SHA1
0bc32333c9441bc2fc014474c789d959390f42f1

SHA256
26eb689fb19effd2c580b42b33aa3f7abcf92181dad9e2976a4eaeb71275ad67

SHA512
148181bd050bdee3c62f5e39b92b2d8cc72e8040df0dbecd963104461a3645b5d559f8df5fe4ba5267280dfbf44ac5f5c99f896f8c01a9184a71bba171852d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed9a22503585719a30e9439ff3da25a6

SHA1
4a8dc13ca7d516856470f6adbb66eddfde48ccd3

SHA256
ece888ce9cb45e2d0ea74f5b92e198c1ccada39ba5c8b7f1d9422e493d5b2116

SHA512
e277adcb7a7e432052e8d226be9f307b383f0fbbc36e146427ec025b1e1131ae7059ca3929944df2298c0111958e00195a7cd6424b9347842167db3c7f23476f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0915a797914876135eaf949bf59b83d

SHA1
5d892717632600a1ea9f41389f7832b54007d965

SHA256
aea819db4d20ae162e4c00b42976b0fc002316e13a9675397a5719f5d2874dd1

SHA512
c6917be470b618777bcddfd875f896f5cb4cba984c5a945aa66f2a0470f88c888f866f75b05175afcd6e4856a0f9256cc6fae86f9f9bee931d64ca40bf47ba59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a612536e5d3a4ec6304d1633ab043410

SHA1
9115d4ba362a24c5101c81d55d8aa483a4f6c805

SHA256
be1bf069e6c63b0fb70d4ca5a218678a0540e47a7ee5568ab509b4379ac55a10

SHA512
a791a9ca24bfd365c0c39cec440de800207e981602a4b26d4f2a05bd3dc37d22bf69504ac8d9c1a591e7569a02d2ff1a6deb64fe6cb5ab84c5d67555fb435046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5909762690e26bb77ead180211cd97

SHA1
4081454af472a2d179bb45885bbf675942967c9c

SHA256
0adb89821f44e326c71e18e3455f3dfed8bdf57e5636a7b8825455aaa662433a

SHA512
c41f9918904975d0c4ca83466079589fecc238f1d88168895084121da32339406550619914b0ce056211205fa00db707d29609b85317455991a2c5e7d20c4778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ee2410072c8d7df0c335728c55223f7d

SHA1
f6ef3f50b315424dde956cbe15d79de698d0e358

SHA256
384d7c38d9f6caf7990d32e5a72abec89a68004cfb6b91e98c284298f6adf3b8

SHA512
50e6f398f71a34a965ee4ced2e092aea2368db9613849f8fcc6107b4fa359bdf8b712b231ca4c668e85897232b9501a7c6feb3881f3708fb7e85c63906fa8e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC746.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA3A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit