040d01daacb7de64236226dbd14da86bdf4f816524ab947f88c5fdda7ec9e20e

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

463787936ab0431e408534282e63f650_JaffaCakes118.html
Size

32KB
MD5

463787936ab0431e408534282e63f650
SHA1

057a2abfcba2058e211547c602af7a5ecbc05312
SHA256

040d01daacb7de64236226dbd14da86bdf4f816524ab947f88c5fdda7ec9e20e
SHA512

4e61e2f52da78f582406d6d65892015446eb042ed82cd044835cca50a8f5bc9b3592ac754c4f36313c925aaf0f995d1db277ddcdbaf0b3be5764682633d4289e
SSDEEP

768:Sxfa2CeXUdkacpPdB+c9kpvfPCqNqLVqIp3:Sxfa2CeXUdkaSBaPMVl3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000194cc68d01e87b720cd6ef7aeff78988966f765598077fa51f3a910159cb7bab000000000e8000000002000020000000c007395505af0f1cd5510ff0a3780a9ef77060ddc247e7ac46b86dab2e8feb38200000004021f135330099d86c33886deace1c8bebfc88b34830f2e438092ab6392cba2a40000000669cd71ae1d445a591bd6967db2b38d49ddab53005445163d0df84ea336764fa09ba09c44510fa5c82a03b985f79d3aefa658b2fafde605676619f94f3b157cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{417277F1-12B8-11EF-8962-7678A7DAE141} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000027a5c267fd8d59e9382d6a498a57470486aad4c796238a7ab3e037154fc19c8d000000000e8000000002000020000000d34fda6c35f0fd9f0c9d0831efa733c829f600691c69d8a38df40bc053a0a04c90000000ec8c92289c18d346a789769776a130ba37a5cc3306581f2a8fce81ea194802feb1f9691c622ae7411fa822be57ad045a17fe64dc175b4cde7e60ffaf6ece095b966679d76cd85db4ae0feed8e20c9627d500081ab8e621985cfc3d27d3e5923ad3c98b2a6673826cd5b188a69cc7d646c5f2295fae887a92937b5d564bc4a08c9aede810781bd525800bc529b5aba05b400000000f82f9e56917cdf189b1d211aa0b6e11f35069170dc79d2e8a3ad7d1886b5a9f050953d2e01c10ab3d7de74995356d2bb2992734f544aa7a0ead051bbf64fbc4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421938673"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08aab16c5a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2312	2400	iexplore.exe	28
PID 2400 wrote to memory of 2312	2400	iexplore.exe	28
PID 2400 wrote to memory of 2312	2400	iexplore.exe	28
PID 2400 wrote to memory of 2312	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\463787936ab0431e408534282e63f650_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a8525517db79845605b1dfc20b6ec70

SHA1
2b3da9b4af6122f0dc2db4ce2e6ae36107d242ec

SHA256
3c6f8595b69582f0d330f93cf76c1d42d4e05ff480db3abeddb6866b6529ee97

SHA512
d11fe10fb199dffb68b36e1f876396917a444aedadc04b555d9cc6ff688ac3a5edfb477752c9b2d25ec490d1ba498aaf0fcbba66524c02cb2dba8a4504b10b86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3010ed60df3256a4206cafbe31c624eb

SHA1
773f68adf09f5990a45c5c815156539ec19e946d

SHA256
ea024360479df4d46b41dbf16fcd492c3bd7b88fe8edb3a4346a9a8f67a36f9c

SHA512
7d0324b50ca3ded00761491287e8ea8199129514b3ddcd8f03c51f6c035cb780ef6d0fbbd9f3d117f8a769e519b562113a906858dcf0efdd48441cf252df83a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
305a98decbeb239d1d4a1f965259cb7c

SHA1
2b6e422760ab4cc19f32ad27de6b29c2630fefde

SHA256
b5566e20df37fccf24cfa084b9edff1a179df11bb33ecdfd6af269026ad48f5d

SHA512
bd809abf9443280ee4afe8aa3bacaa85aa638dea10e545a097a232cd78deb596ad4f7884aaa2d48875f92f95240fa99e0c88e5490d2f75b3fb33639f89c7c62a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7a08aaa46c0e04f7a7c064f57d10b7c

SHA1
02d75a6f44dc460f34db7d21931e0181a34b3474

SHA256
0c944bfc53fef1a97d72c977ed39aedad06a3ff5f17fcd5e5a7741a7b5371cff

SHA512
2853794c9f86f51816a74f309d2ff07308d639a1e779a12f740898317987405c33db8df2f154e34925bf198ad76da67f7e40544cdc4308eccf0765d23471bd9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d220bca3442387a87e2f33dea2c60cf

SHA1
8e9617bad9a7ecd84c150b51c5f53e11b4e064d3

SHA256
0c0f3a1d98eb1b9fa1107a4aa8e4ace0342a020bfd574b21598a1efaf77b5893

SHA512
da54b1dedd206cd7ed786625eba0d7053a29b7406ad3d8efcb638aaddeb0f3efe46dadc3bab963bce845a557424b0eb8b3e843943e4175eec7bd429ff0da9620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f417ebecd92be01f583462ccaea3f3c

SHA1
8e7ae1785e1b3b5e31bba2e107543171556c56e8

SHA256
a6aa8ae270708d3c67cebb09f3d1b95139dc4e1c45f91f66fd06c80e18362da5

SHA512
9e5470af88c295e81c750e5fd0db1c6b5f0b05539f129fd434935f9ace84f6507a1b4f6465359870a1b178a8c261e3a8af17a5d185ed5f32abf1f2ee6672d2a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
162b6a0c33fb92fc5f580afde77fbd4c

SHA1
b87de0977da10ebf5440b541cd0bd24c8b5f8230

SHA256
cb8336d680341facfb7c989108e7cf58e3a31155723681167a9270ca04bc80dc

SHA512
d27af0f41d7c01bda00dfbb82096c9d4a4bc1f35aef16cb85fd478cffae94dec8c9f92f1b7a7c0e1d9ee45af1d61b348032b5a1b92f0c62b8220d3ee51dc475c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcb212270ae73e70fc698e622728a32e

SHA1
08cebe99d22b7348860cd2514fbef8eb273db932

SHA256
a87663883dc87887b7c697c5ff09510d4832ce8b9230e857e89eae7d8b80ec4a

SHA512
a88d2fa2fec50beba2466b1100fc05b2bc52755cd454d9e350810ca790bc92b32af0a359f79eec5f08cadacb75064d011ebd4250476a108fe51f6113d0c2b75a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4212.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4213.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit