f25584745b0f58530d97aa69725b7222812229aa5b3f9c8ca06790f3f701b131

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2482aaf34716966aa9e4fc14ef82a937_JaffaCakes118.html
Size

204B
MD5

2482aaf34716966aa9e4fc14ef82a937
SHA1

8c52d59579641d01e6db01da37f52a0fef3dba37
SHA256

f25584745b0f58530d97aa69725b7222812229aa5b3f9c8ca06790f3f701b131
SHA512

8757715dcf954ddf9a36caca7ff23ae5bf6fca17be85dc009673c99e42c5e3b571707e902a812c914a4f1e225ba20313b9064b5edf74883bfdb97dd89f2da654

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005b357c93a98f1298ee42534701674fde58f83738f540f498cd749e74fbd42155000000000e8000000002000020000000760490f66cc2d5136b38c76a31356875160e170cb569554e8104c71a44f4df1d9000000080644611b829ef35c39d52240f07f692a1d9063e18c8498b009ac3dfda9d39e09343314bc38d42a5d6f738a2bc7f928e41fd5ca3aea5a307028a11008b021f7fadc657684ee35ab345540492c5d3ca3fa4b642403b336e2d01b8539a98592f87b0ecb0f089112b09f5c7c56dcee34b1d815c6bf25e9e75d761f2649d457df69052a9ed58db7894dcf1672fbc2e0031934000000048a155f91f2171e9c08b102bf9c68c2fc576cb2b7e22268f6f60bcf2ff292f202b90065945dde0e835b988ff6eecb4f3c9a35b5a59806aee109a5b3d061d3e8e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421327390"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d2b00a10a6cdd611693138e473792ea809524070416a813fb4d04d9ddc310b9b000000000e800000000200002000000010938c0b5fec21544b1fb75bb8cf1f4cb01399bc178b33d9fc4aacf2effa905320000000c5d78245720b727a5d90a110ed8d1469a8e908104268a841b629d1e9c417a3b840000000346c5faa1559a0519a5f7823781cda7824600b8872024320dc106f881bf93ff5ff85007ae2b3a337624e11d6763226a8a38fee7dbd01b5466bdbfe0eb5ce44bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00321871-0D29-11EF-ACCC-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08312d535a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2864	2020	iexplore.exe	28
PID 2020 wrote to memory of 2864	2020	iexplore.exe	28
PID 2020 wrote to memory of 2864	2020	iexplore.exe	28
PID 2020 wrote to memory of 2864	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2482aaf34716966aa9e4fc14ef82a937_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a40aa0e3b22eab5d261818bca4f096b6

SHA1
a3065c0d9dd10fcaeaa5f2d7f02ae0d01226c8e7

SHA256
7e627e54fb4efb340fd1c44bae1e8c98dabd66e3eeff4eaf7af95f82545a4d8b

SHA512
53be68d6fd5992368d69cc8e0d6f64ba905dc3218c1596c71369896f50cc7449d994efe9cf91ea448a4d971a3c912bdb4188efd40b21b975784d6381c6ac9d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b7fd51490f6fbb26b3adf6b159ca6e5a

SHA1
2a296d744860db8826e2ea6c159aedee21547e77

SHA256
3cefe722ed1d73929715e2c37c016013d10c7e1a80d2b204514a81161fb2251e

SHA512
3423b40ea0df1a85cb9715dfc61877f2b56d6954ed7edac2282dc845835d36d0c2f76efee20a722a81040b49d6d0796d22828cdbfe8c4649c158dfbbdd0f7ade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9685e95320303f638f74fde58ad2beb6

SHA1
4ce900f26ded437d363a951b56c93bd88505f038

SHA256
1883f82a794d2a4999bb4368777ff8f7f60e27f73eba3c8b52e0f68c0bf99cd6

SHA512
33f0124e30dce386bef561ca7be87ccd89a1283b4e2b9346fe933b392e8540663666ce6217fb31a9e30108cad24c12cea46cc1afad473f752a1107e1cd6ada83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c3b9ec7aebc2715758e3fad70610ccd

SHA1
d9131c4d15d1035fe511830eaad942373caf4c0a

SHA256
fa876d36df0ec0ccf3acb043e33ef6246910ac5cad7ba5c4f7bbd8987aecc8c3

SHA512
a8b6b479b9ea5c3fee9664138eec099328a7effb3892fe799843474ca4e276120179f8209870db9485a33f644a9f734171f772a3ca35d626905cd933ca1870af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7566c08b665a7cd20967036b119843ec

SHA1
000013b07c86b68b78be4cae320152b044f3f398

SHA256
99b03b20fa070ca22eef0873a43d7b65fdb4a8c9e70bd2f1763b55a7f00c1704

SHA512
a54b6a1eabef2ade68a5b4d5214afa62c2d5ad8db2042ed4b594dd0f61846f2bc092af57bf5e822addcf4fd53bfedf1e83a7adb9ac4a219ddb48a1ee7b5f256c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ce440df4be474231044da569bd288ed4

SHA1
efbd99a8bfa59fb120bbfa3599d93a7616f495d0

SHA256
aba896e286e11bc8ee8ea545ccdb7dd35a2c88f0d1e11a09b44720529337a5fd

SHA512
c1f0581d47ef89fa2b17186bd3a306b6f956c132c4852f0875deffc214c155695d6676bc005930a59a59f7311d13aec40abe3098ac96336900701f28ce2f54b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d90ec97e7e062f80d5a0c6ff41946b8b

SHA1
1537c6e08d143e711282a516624ec600f3bd5ece

SHA256
1cda6d0d3bb194e947fa635e921dfd3203a768dba441e6e1c12c488b6dc76890

SHA512
0b0e302d274bb759deb7dbb4fb105c18efbe04a9af267cd77c1afac7bac7ebf5974e9dc5b9bc92e0c3f1e10df8c860f87b342391d0ed11ae521e515e3bb9fb42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3b8c36861d3f85f30551b86e1eea04f0

SHA1
957eff5628e3649337c8facb825254a93cd4ffaa

SHA256
dccbfa007e0651c24917db48e162e85daaac24a45722b25c36fe8aead8b9dcdf

SHA512
c3aa1629ecba5cf3862b84b77a581e3dc1d0037ed9a7e8557d37b3e78566265718538e0922c5cf6f3ab09e994547f68ee218d415a89a6710475969512d5ae202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8313b9102fac30051fef490e7cdc71a5

SHA1
00e56e80e22ce632217a70d6b59cd6b121352f21

SHA256
5b9979150b0d9dfe1af12284f685cc0dfda5c9c8aa52688444474f27814ed9f6

SHA512
0909bfa2f2c2d8bd7f8b403ab18059457c584513e1ab5eb9775b7a63317c6bffc0335b23e56977a2c92e5a15e439a962e0d16d09e15eb1b4a5bdfd424ae1f7ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
829f083bfdc7fe51b3b0d55586e92cf4

SHA1
139cb9916c6a39c3fbfad1d42084c5d96365c46a

SHA256
c205eca64016890a913cede6a4fa36ad76408b9cd7ecd11120293c66565d029b

SHA512
243c76203f05f69f99f1875da5a5efcaaf2cd21e0a9764ce9573ad8bf5f19717609d4a6e951fe7d86e21d0b04b868a57d1271652288abfe070a327a97bb51f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
10e63e0e860e6fcb06e54cc2c4016bf0

SHA1
5bd4bddf3d4478afee60c45e2e52563bed08b61e

SHA256
52a0205c7baaf3d6931554d0ba422b3ed301a0b3de9143b8b5be328d62b20e21

SHA512
cf37553272f7c861e947e99d1c9e047a1864b78d60eb932b47b2ff7a34d90dfd0d62f9a5992859724f80d9db2de73e63cdc8b78bc5473d12a382eb5915193478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b09882d2c5403a15f48c08f454f42871

SHA1
f2f306400cbc3e9d076b5b9784ae993715dce24f

SHA256
51a18e73025f1c0728a8f36a5abf8dcbb674376b754e20ead388fc8432d1c3c0

SHA512
2bf37d1a4dbdedb62bf0b41a1d2f54d6a4196265313b149e24d8be46be4537bdfc1066d37d514fc3276bc9a8bfa915a3f4f36596af2f25ce827a426d81b06770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ccb7ac905d938aab477394452c054961

SHA1
30d1504fb418d32292455712337cfcce05f32c20

SHA256
374d4a2ac82ff782525af6f499ad09187d6cec850c93bea333d2c63974397a79

SHA512
62756b7631070b5c49bcb06f1a7d76eeba4a7ec9f631e144d8518a8e549f7f03c2bf381ca71578cacdaf4b87eff1c36a0fc950468ed045d8db37f33f3376af87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8129.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit