9fb61a7ae5a2a903badd6ea5eb48b87f57bed5d37766fd5068e40bba80cb6edb

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46295e08812d58c093b38a4a973e0830_JaffaCakes118.html
Size

807B
MD5

46295e08812d58c093b38a4a973e0830
SHA1

8a68a009be8e306ea86175e6c4ea9f7ec8501bef
SHA256

9fb61a7ae5a2a903badd6ea5eb48b87f57bed5d37766fd5068e40bba80cb6edb
SHA512

45e8ada1a714bf7a1eff7f473411e2662adeec637c224c66c6e000c3ee64bd521fbe9da473cfde3715e03634f99680ce567ba8dd64a106a388c676086f7c240c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421937672"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000007679dbc8256c7d0a631d60937508eeef27779975fa786a1776415763d296b34000000000e80000000020000200000005ce007b1e3712ef31e28894a7917c68383274876667790bc80e4ce243dad120e900000004efe60fc682341f3c65cd8126c8af3535aacfc3208d71d4a897809dd3a8b7d59abe5fe66fbccbca9e2657a7446986a9cc81bbd2fdf27cc27a26c195ff42a7d683c264692e51c07bb1654b05491acd0d52833c191bbf8dfd299eb669b5c4995aade4deb287870d7623db18fe0010066a25ace55b1e7ae0180386c22dd128e1cea24f3466b77507dfe552ba629df796cdb40000000bc6f34d8764ee77ace57f40a32f5c5c8b55943f6baa66efe5123b358164a6723544467be6436c1b05edf14750bc67c0b07be2c3d376724da6af241a611c584f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB9B9021-12B5-11EF-9BF3-52E878ACFAD8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d6f25fc800e7f256906eb69d1cbe9238a670dcf9ee1f2d97a1286a100230f690000000000e8000000002000020000000f952b6f97aeb5ae765da5172dc4a721f97b4c80e16675363d08bddc8b10814ce200000009d1f1b5229e38e76f308cc3bf7e7e259bcc133aed7cce7f614028f3aa95a318640000000a9cdae3b5b256196eb46c9721c46e36df2fd7a16a5da2b3ea351fea8d853e39e5b2412a96bde84649f72ab7b0bb375d036894eb35d9b9fa2b5630f69a715843a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05310afc2a6da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46295e08812d58c093b38a4a973e0830_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
729461bdef8efc90f2cb99a88724dafb

SHA1
e0a896c69e744b299c39daad655da5591d2f4d5f

SHA256
887382a56f31e6f73d86770c89596d72745d44b7b9012fc39701d539ee400bc9

SHA512
e8087dbe794412b560d1854f4780575621ed17cad3748d5f12728f01a2161b27d42fbac8842d8594a010bd5b4e6088f3fb915aecddef319c9de2661186238a47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc3d58d8722f783908ecfd4bcf5f6e9

SHA1
d5c993960ce573338ec50b75419ea439105f5b27

SHA256
6a126f38d2f101e86bc5021b57a07a62c97d34a29811d372ad1214413c44994b

SHA512
aa612e712b1707c78839ab5daa058eb887f08d76470ea3ee99db73ad5f2d736008577b87839011520cb8f552aae0964a748386e3545348577ee2e0c2b0a69c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38f15fd780f51e97aaba923ebffb84e1

SHA1
b4988baee9dcccf691b39871e35e49149e5acbd9

SHA256
7e848d771b4ff02dd0f6be7a18b2e0ce7d191360b3fdefb362afc6659f9caedf

SHA512
0550d6a32e13a8c97d3b704e4e6ed810e7ceb70150efe3eeec0ac58c7d3d3f3ca38fe769b3b5073a254fe4b1273291d42c42d8b4617f652ba2356b837e305243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c2d35832dde344ac8b1c0207fca509c

SHA1
a2d2ec4f8a1486d55397e065d161c86695f02c77

SHA256
61ee8977dade3785c1489d5abb0b54bbe0ec21cd65c8440bf75c59706ae5bb99

SHA512
133d65f3ee10a3e6c3747c51dcbb6cd5fa007ac4e38e4ea71c0193b92545c9c0c671c900776e954cd9b834c5aa8ba6c44d8ecdb765c593ae00014b729c328684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9ed9a40030fc2c118d55756f0754d73

SHA1
ada271c1e64bda913ad6fc5d00abf005d607cfb1

SHA256
789913923912c6dc638984a1eb32d7415c447a858838721124347d77a00ee6e2

SHA512
ed9ae6fddfab30176dd4bd81a642c30eb92786da8dee7dbbebbee00644fcec045ccea5ba2e0fdd5abee3d32ccc0e838947bc3858db7e91fc58819ee6560f779c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ecef9d5d96d4daca16d3fbf70f363ba

SHA1
46d8d793476ad54f0712b7137b7e963a5d6d1e40

SHA256
42901438fbe0b54cd6727f9df9ec676890b9a0e56961c8439e010de9c5a9c3f1

SHA512
276445768232501c88fc1080e82de3bd8655f6d9952203410dd0efea4bb5e68c779e9c089fee7c7b4da281d872f0020c6c244531acda448ab7f1fde5b6f25f46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
497fe9f16999da3165a8ea784b6794cb

SHA1
28fe328f41652b290bf0962aa034162eda77a4f4

SHA256
2b556c0001f1daf1290af3e6171fed7df2de6af92d63030a37c2c1bae6781de1

SHA512
a6a08c48eedadbf2faee8328162baa4fa7daadef0e617d9aff3f85e3a3d4a016cea4ff1e92cceeff7d860496c383f8a438c2d469bd72b277f3f63d1e1801c33c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaee70bcf61861dd1faf73c4783c48d1

SHA1
48640ec5fbb47ce569184eeeea9bf68742e75951

SHA256
03b9318b677bd3a2d7018ca883d466453ef52ea560ca8578774db7e4848d3435

SHA512
403e081d71d92bf651339bea9ac375ca859a6156dc770eba547148c1b2453dfa818f96279f13d4455602de6d5a8459ba7d6c4ae239dcbeca2d0f2c94e89b1803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd4591673ee4c20b30e620ddf571c7b

SHA1
cd8e525a3c84ee4a33d887db9bf040018d339c29

SHA256
269bc5b4cf0e3ed42b324cce3305f65c47487256fff075b0124dc9efd494bc50

SHA512
fd8ef659a969084002b4fc46bcaf08a1d75618dec4866e154cdcd8fc114f5c01ba3c3928b7bd708b256c854133f4159ee2b516f2ca12fd2220f1a5ee470ddf98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bb5a94808cfb9572b9f5562b92daf47

SHA1
c07ec63ab716040e618530072b273be88c3a09ec

SHA256
963d84b108c4a32ae042a6a9e2976ab627cecb03d6808643ba4e3688e611ff01

SHA512
a187070313ac38c3cc2071e6dfdd01490e4a121673728ef78be2ad1a48328fc77dc158f0ebbcf4310b85ae29166a15fdd5b9dae4ca229af8b94b0e3ed1895a47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
065a1b5f7610f7be98bef69392d1f6f9

SHA1
d290ce18cfdfa4fdc5c4771353ff476782935e65

SHA256
08c241ad7fc6d884d40af2c6e9e193a428505f1f1e1af26e99f6c1237599f658

SHA512
255aa5310d9e86db2a2938f3546833d4ece54a3686423a00dbe08f9a0b5aefc657ce53d2d79ffae20ed7719ec77a7942d938d66540d1fe33e1e9a6c7c32f199a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B5F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BC1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit