8b85adb68021c04c75db6a941aada553c5b9f47a25274a39052c41256526b398

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

252c680724c563d4f5a0c6b1eff2f1d7_JaffaCakes118.html
Size

2KB
MD5

252c680724c563d4f5a0c6b1eff2f1d7
SHA1

c3ab769b2d7f3c4c445275452a0919ed572208f8
SHA256

8b85adb68021c04c75db6a941aada553c5b9f47a25274a39052c41256526b398
SHA512

a4e3829c0382e389964e0ec0ebb39a583d6f3cdab2b7887148c30f8d7bbe1b02dee97175e33a8af759c57ff7b0dcbabc130e0451d62b8681903774acdf630870

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421338655"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00bd6a0f50a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000096275016a26e3c4c9cd1df5f57a582866e1df0390a5af62b0a48e50923edd385000000000e800000000200002000000049e4416ca6c788f8fae136a6a110b6f253ce379965a8718c7685bbbed3935a362000000060f055634ebc8a9bcc19ffa6faa6b5ebcbac1808058c65c55788ad68b155b06140000000b5d91b59055ae6a0247acf57928a5cc8f6496fc9a9f5efbd9eb72b5e6f7ded207155f74cdc6caefa5041b9798129d6b868b19b347380c170d9196a6e904321f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AE04181-0D43-11EF-873B-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c0563c6cd916cf48e5923737e334146fb40ed4671a65590ce68f1bebfd1a39d3000000000e8000000002000020000000e54410bba580aac685a8c91db75852060d3b7a2e517d222a2503ee3fa7ca8c6190000000acd009d6b613cd7c1408e38ee48a524718b2279b503f5f18aba3c17bec886cddde796a9f9242c8b97bca95497556687a8dcd15c0a27a6b19a09e3ea7fde51646db057f89bca59a3e5b8c7c65f87da69242b2d41904d3730b60542d8f3f2443a5d650545698e4e9b70f8d4380cb2b7300ad641becff4d85c3c74dccabccfd2a669a1e09350f8b8b891b62fded0e142611400000003bd4940119895ad91d01a651da049825f18f37e672bb7ec13db4e38e1ed8a78c553a616e80abdcc406684043eb6cd8b3b378c1b4904b762e2497af1d75e767c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2340	2512	iexplore.exe	28
PID 2512 wrote to memory of 2340	2512	iexplore.exe	28
PID 2512 wrote to memory of 2340	2512	iexplore.exe	28
PID 2512 wrote to memory of 2340	2512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\252c680724c563d4f5a0c6b1eff2f1d7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785a8aacf97d857e221a5a4937e7f357

SHA1
f17944b353e3bc8ff12f66053374dd749489de43

SHA256
6b38d1341b4b0e1a38aa7ea271a98b9a769c3a4208c8b8d28cad3bbb5b34f270

SHA512
f29b9c5f4d3b66ad1bf9f1d2b4cd7413b3e9d31876d02056db1446678740f25c3fe47e9790dfd1126e77d5e84ea9df0954312d421f0ed132ebe53cea7150de1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d93119e34327db72d96122f913ccb695

SHA1
b027afd48560d72583c01095e10a578f6e739018

SHA256
239459598138e4b27e9ffb33247db22edfee6e1bed4e1ed55bdc142490e0fed4

SHA512
1cb7033e9cc59ea06b63fca9105bf090f0278e3787f1a43b75864d0cb4965961336d69776a6a830a30e2c11f206d6f2a4231e172fe8f609c7f616ba76349056f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43f0034a81514e0a65d5c0175510c4bf

SHA1
b62f8561340bf0816344e2c0e2b8408db1359a11

SHA256
26bf095bc32a5eb1223655dc0b168e97762b3040b3326074f007ac39132016b5

SHA512
9292fadf202671812fd91986d1cdfaaad4990615090b32e821c6e57339d7596e8b99b327b50196aad0808f0eef54c425f766403c015ee6fccc7ac4bd3b360ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f3cb3c31b9ef5541853c5475642686a

SHA1
e2cd3e47f8e383da4b8029cb1af8d837537d0816

SHA256
57c6378d9f3467ff1b50f99871ce60426e9555ffbb1a7116f9d148f6f6d2c016

SHA512
4c08c769c554f01f5379469e026698329f67a15c7d5db177daf10b074ea68227b1ecfb46c210c557798a01c10fee7c71e4975d69b6c0b27e8f605464087f1120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a3b19128e9befe89d37d1f88f38e03b

SHA1
de2faf74e0dca1f7fa75520e534719357185f560

SHA256
6cb3026b2016d55c62e4988026588bebf1b4515ab7d59f44cd4a52c6cdafbfd7

SHA512
a6c2ee54ce41dbef13787e07fd091d8f0204c2490121ae1dd4f9332ac70610be6b6b4e09f53b1fd5fd81cbf45460bb41e6a33465b575a3c56d7ae78af7d8f029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
359b45503e34e9fea53675fcf6cc3417

SHA1
2ed0e2101a5ebb8a8f448699dc5677a6799c43d4

SHA256
3dec2ce669e55313d045e879fe0e54093a65868afb263bfa18fd7c9e74ae7769

SHA512
3cf7567852e76dc6c4fd62833750dbaa62eb2288ab19bae144b0a836a32f14a8df5ed6aa1ced6b86120149e23afbf6e0828a89d739e98991347aec215b4ec7c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
723a9544feb54fffc0547bf2d0e9867e

SHA1
752f8d3391680e06530852aaef269cb7a42523e1

SHA256
ce77784ded48d9647a691bbc726276d2db5ab8486e65439dbfb8175fb0d9e1b7

SHA512
30a8830e9dd20d91744d0945ed44b50f714c67d168aea860910ce87b8b759312d438f0d8af37cd878b75939802e207916f59c2683a3ebfa2e62edfd2133300a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b7d4ad52be75a38e9167b0b0643aa7e

SHA1
b92239c8c110ef7a09c838e84a7b54f344f6c2bc

SHA256
46c0e56b6bb062379c5563f40defaae66a16fe46c7e11584bcfa7e90750277fc

SHA512
cf658785d199ca0739cd4e0a37f009fb3e6e2301a565d61d733de540d66b02b90efd86add357a7ef6e9d2229f56089d304e3367c0312b15902164ee5555f1db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5006f66d73a7d2174b50faed11123fd5

SHA1
e9aec957987f42ef9948d1979288c0010c1c5ec1

SHA256
022873913cea394d42ad5fff8f2e7b5c61034060a1035b97159cc2d2026aa021

SHA512
f53b198a12f5429d4bac631535b79c070e475e1d7de6ddc8101e48aeb884c7c2c43b5d884b9984bc9cb884ea9a745d64c9201d241b31899468ef63df4edb51fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94003bd51b02a850c8952c3256ef92b8

SHA1
ec74dcf9ae9e4387cae86ddd960a8939157c9d68

SHA256
33fe77815b52d70abdc89b73c2babb853549339b7d75cfc0e0b607ac5bd4b52b

SHA512
704c6e5acf242556dbed7fa1e2c9191121ca4fb8237efaad4d0d2b07391e743dd048c5cb8386c0a3f1805486febce1dc07fb9c510965a65d2a449968f7292ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab342C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar355D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit