8b0423cfdc4e2b4098c8b59107955428edcd0a45f999efff17449fe0aa61ac5f

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

39967924e6442c5ee873b1f5db6d25f2_JaffaCakes118.html
Size

1KB
MD5

39967924e6442c5ee873b1f5db6d25f2
SHA1

8c83351b47cee6f5571b20478e0b0b632d3e8a7f
SHA256

8b0423cfdc4e2b4098c8b59107955428edcd0a45f999efff17449fe0aa61ac5f
SHA512

7d567051a31bb4ac3a6c055ba4310b2a4023ec317b08f01e6b3cc0871c37293fb02a4066fe4ffc90590762dd60628333cbbdccc5b844e0ddbb328297b7cfd0ff

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421670812"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{975DA081-1048-11EF-BF06-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008d6d34e7fcd7a61173879e55e43b8ea4b8f45c39a63d8a23ce50159055345095000000000e8000000002000020000000739da2fdd3e9a2dc7c0ac06f71fe958db8bac8fa58f0bbabaa7c188d8f557984200000003cfcd27ccae353e1e6cade80ecf6ec9fcde49ef9cc7feda428c41051a658997e40000000bcccc935f2a8575a5faeae76d1aa6dc8192e86dc5199108f3eaa63b1a9524e436559722a32025039357faf47fc5910a5049eebdcef8158392b52cf5691ecdea3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a004097255a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000125a5b263072b403530be31032ee184a35c9cc3b80a2978bbb323d73fe050a62000000000e8000000002000020000000f372315df74b93b6b7687edd6f9b59ede13f6f8c9be1c4f8f77bdc2870c2f63190000000c1a8b229f9991445e3b616792c309aee2f591bf27f33e1086f8cd167bdbef2fb562534453003bbd4e74f9518a38a3f0fa91827d30c211238527b472d13f6ef87726403d29871fc5288c1aa79f01dd14c41f96eb6589567d2858db6503ba212350c90b66d2cf9bf88d8eea59a0eefee2c7177b464feed41c06d769e695c87dd811ec84bcc19ab6fe9013305ec7f61e7a040000000d67241af30179bac85def21fd5609c2d23e6baf7635733ae6467e272a888fd2cfabc95f27aafedeef3c2611b05bd1ac0eeddbd200a008c84e8ab93a054f6d958	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39967924e6442c5ee873b1f5db6d25f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f37d3d20818f539cc3d3e28be9537094

SHA1
164bcec74b6b4ca0e06d06e3fdd55b7b0dd984df

SHA256
93669620ebc5b6580f82529747bd6d4c5a3b711afa1dff6c0148248ef4c01e71

SHA512
614864f184f42f83f39e7421a1770749d3218581535bd2d16a5f0a48d5018180aad91237655f07b9f8c3dba58fb16b2bf9d1af054f3250281341ec7c7f62a1ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc9265fc9683df77ca2698b1577da24

SHA1
8edde29d4e7b32161a2eb1a783d2411a9c3d225a

SHA256
83759870be382186a2cfcc696ad8db244f45585a0d17f885853f8fa3c67445d9

SHA512
aebbd9f48d9181b19320eb77ce017bf96bcece791c0c3f817413aeddde73280a9f4542496b7aaafbd3cbc2794fea3e900e9cd699700725bf844d674fb1678d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
317def6bcbfc6c34b2bd35d68d5861b6

SHA1
b0fd509276449208f3862f82ec458937644d82d6

SHA256
38f50149d92a8407eb7662df4e9721386d8e2e41b5ec334c6f2b06a578a97fe4

SHA512
120b9ba7e92898658a805c5b047c0e58833e868ebb3218123a2bd8dc399bb54bb73776806db1f54df1e56d665ed9f1730684a00248e9dd7163184705aa5cbdb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b82af34f8d1bbdde55667f92b11951b

SHA1
54c3324a5547bd636cbba2b7224f86712d632b57

SHA256
9755af926686c31091e272ce4319eebb163671d24a42cedb04255a650263e8c9

SHA512
677f7ea80fb5efddd5d4154ef6ef2b1a2cbd61d3dd16a32b29a283bcaf590386859da7e17f32bbb9401d43b761db06340991a9541cad6499f85dceff2953e669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32ac6163d49a38e21c28489a55f7900c

SHA1
981fe19afc30572ce0941efa488f60edf2018649

SHA256
a2bca581fa8a108a2ac720a5b489fc7ce30717b4017dd958440b826cf65889e2

SHA512
140cac998d32d6b6a456c066cb5939aeb3f638fd80a60b80e00540271934027060fe0ca149e1b6c6330868dbab4df37d713d1823e282f531a30723e621b51cd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
988d28fce041b1fc0285dc5dfcaff2ee

SHA1
312d05370f28d0cb47ee594670fe7365c19db9a4

SHA256
064c2d10ef71deee2d2f8e4a06a7f8f0199428f96c62db2ba276e32af38672d5

SHA512
21c47bc7a8c83a866edb326cc42089184f6aa1b15c209596a3e4b968da750a601989b81e30ef5c79fa4152a490504ebd1147b05a497a522894013ceae698dd1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b1889b8df64a9be5c889509fd91f0e

SHA1
acb929d050e4143c309ecb25867c327b5d2cda4d

SHA256
81f51c18909c8fa10fc35261848a7af85d8301dd60c5ab2db76e57b0f5fe40b4

SHA512
67fff7eaf3ccf53d1740dba47f7233afe070c46ab01c44d3de44df66a906c57e78522208e19a1f4f8aceb8c42b017ae12181115611422afa0f9f2ca16d74ad1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD4D4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit