ee1552dbd796c705655f3ad4d19ed61e2dac5a190909af8ebca90eccccd210ca

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c427d17a9d2a4b607e1da3608f04573_JaffaCakes118.html
Size

480B
MD5

5c427d17a9d2a4b607e1da3608f04573
SHA1

98b7340733e1a550883905b12a18c74292de398c
SHA256

ee1552dbd796c705655f3ad4d19ed61e2dac5a190909af8ebca90eccccd210ca
SHA512

12a7a7bd0aa02aea5cb5b2bc1a786131d6de704d7b9fa35fb83b01d60ac2a7c8833cb46777221db69ee0bdd7c14bba07a7f3070433fe71a0a133810fd107b8b4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007586814caada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422326688"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD0FE711-163F-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc5b096408ffee47b2117b0cbc66f9ec00000000020000000000106600000001000020000000b5917dc6a99d105b62031923843cd62f6b38b0d73a3bc51ff4d1e81c81e9d191000000000e8000000002000020000000b3b380f58fd1923d5a184818095ad79a6b76f4c1bc7846e19bc81c5f4cdfbb6120000000b4f76549af698b69bd1a0c913d24aa8eeb8e7db475058afbb609d37feb5ad1da400000001947b862aae95757aaba5217f100da570e790695fe3c9163c755381e9928b5ef980833c49722f9e0c3bf3c05d27185f35e83462531c81e8b79d683254ac8e350	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc5b096408ffee47b2117b0cbc66f9ec00000000020000000000106600000001000020000000c47c885ed4d0d1b8a0a90ac4a6b17c6a453bc2d05bd646ee838cbe7a31b1dd77000000000e8000000002000020000000a9277099a64c876272a48ba46dc290cdbe404b55c1c32940e3c08526a9d49eab90000000f2e8625fef1ca770ca9604d093e93ed3c0e55df54c8524ba11749776b1a3705f1aeb7c2808c295db8036bc80b15c8d90f8725f34de349e93bba2c199c12779b1f35d39487df3299469addb4b5a91d3dc217b1de3bc963d119a780d00716512adc81d4cc9bb7e2ec1e21c6a066e3a99c03351a77e2465dae9c3a18e355af3186b6f6bc3296f28bb4b7ab914ebee72111540000000f127d79989f243e278103e83c4a5c31f4999087f19cb7a1da14800046b9c1b5d729b7a64755ece91e27fffcfc136cf1cdfaee49945f940cd04d3e639aaf3a452	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3016	2908	iexplore.exe	28
PID 2908 wrote to memory of 3016	2908	iexplore.exe	28
PID 2908 wrote to memory of 3016	2908	iexplore.exe	28
PID 2908 wrote to memory of 3016	2908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c427d17a9d2a4b607e1da3608f04573_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
46642c8d56967083bb897456dc1a3aee

SHA1
df13d389cf8d4f4c118dbaca77f644a233ba0bc8

SHA256
1202cc0188e5dc95829e59c0d410f4c6915d7495481c5b817329df75e170a3de

SHA512
7a0d98488a8c7436d95e98ba7c9f741d50dadd2bb3235a39eb9fa1539cadc67503e9b4b68b56290b4f7b6d9f96912ccabf4d1eca195ab1cd02f3d13292c7111a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
973d845d75b5896566559ae863316f03

SHA1
95d2cdb143335fe221ae35edfb6e36d7c2f9acce

SHA256
b270a90dc870c2dcb407a1ef207ef6bf1519378fd95db9bb59510da0b3268209

SHA512
99dc1596fc84c8215ccff94696c96f4eb81a35f30b63ff3943605dfa601854b6ab1cdaff53861edf756dda26afaac91e3ad8ca438e234a895c9f7f383887030b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f24d3768580b9e4dcf522f7fa84f3ba3

SHA1
3e63d7f0af6635f8788cbce3e02325f0f95a8cc0

SHA256
e97a1dd5e551b1e8ae4a5ab26e263215fb84c610cba90ad5c377b85facb70ce1

SHA512
15c1a87fd44056c1517063ea1fd45cb2d15e9a478399075737b3eda65f16a829f05cbc55127aa0bd54919a76efe302c49a42d6eb74b14b6a8104e40f0aa9d5dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
32396b14b077b2da61815bf867374c51

SHA1
e99c4b69d8d8f052b58bfbed5122f181f392a1bb

SHA256
8d0e421e6f515c6bfba564c04d66f1bd7cdef1b6a251b91db4bcfffffc428c9e

SHA512
7aef054e473d5d8e232c04648a49215dc3f9a0450ec0138243e349f935732d386c969e59325e7bdf750487c3c04a256b55f1a4492ad9c44f1109e01c12857377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
71a5c38ca79767ed7b47dbf40dfc2333

SHA1
a199cc56b74cc708e9fb2e1e9255997e69aed923

SHA256
afb055272bd829d6396682ca8c50cf0958dc32d3ef3085040340379142707c75

SHA512
7f8d0458e0a4be19e8e2bc2abc16c7bfc19696161dda62a0d47c62df3c42ed5bc57633d5a867031674d077776ad157ed474ae6c805afc69a78593b2f7c746e45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
214d8f9426b2a97042e0a12de07ef796

SHA1
2f890f6a3567106cd97586f1cc889ad5fb799002

SHA256
bccad29b46f04bd75dd1369b16b1cb28e2eb106a037891168887165bcf17e734

SHA512
fc289a2f16e6f4df438e7c0010c753ab66f51ced68641f22ee65934742f99da963fed65f95afbf9760b55a230b3b9497f3aaa72530c769365ec0d04449eeb7d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5172d61074a5d576e752beeea4ae9336

SHA1
f6fb86fa865e19c30852c5265c8b35c3aa8362d5

SHA256
7898f00001e9b516ef8134162a1b9f041b5b98040d6895ab71179fe5e9294cf5

SHA512
e03ada62cd459bca00a16c082ed95c84f83b7d5c0fc59f7bdf4984e340b729f4fde68e30fbdae220a579b1d42b1df771d01be9e90cd3a738a33620d4a715a230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
444e69501486b50fcb218060949791d5

SHA1
827de595da708f90f3f259e371b08bd19bdf3719

SHA256
f55ae3f719d5633de29ab15cc53481c2a6f3d564ffad5a0fc8820afa1bd03e2e

SHA512
8df3eacc3bcea7c6440dd4235e594bcc4e2ed90932d7282c68b84cea01c1a187f07e21b0f2cf935d9ee8fc5ae1ba8d9ea03cb527e9208e61b8e1f9c2e8cd7a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7310780b32c3c99663937681c199330d

SHA1
ad83f561d63bdeb692ff591ee3bea6a0093dcb28

SHA256
6f0fed106a27066016ea587512135b54f3c9a3f072a9abe385151c1ce5c90fd5

SHA512
eb1b77286a3a093f77f3a02c10b471ad4b3e6910fa8abf6e311572f3e89b0093840f291772f365f385b32deb5db1f5d46b1d2df5a96f9dffbc460573d4e9e1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1cde34f344101320d7e75eb93410bae5

SHA1
056be4604169f4369a913957a8691270bd58d330

SHA256
869eee446e27f6b171fb4432a749a94d5238d5042ecfd579c469b6985e1ca20d

SHA512
0bb6795526de6280cf9ad2923b13de939fa2c1fd21a272d5fb0fad9ff77fd805a42fd5e8a3eb0a296855b871c6ca7791782738698d6a07616464c0fe048b4dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9eff566b60c2ee44f7341c5cc349f6ba

SHA1
61a8029a4c12bf9374324a3d6d5674dc20f4eff9

SHA256
8eaf6f097b9ca6db1dc9c91bb282b44324d8155a58506066075c17edcb6900df

SHA512
a0b3ec7b31bd6a738d280299086578f040024482f4745c367f62cbba5dfee55579a84a2bf52290f7eddcca1794dfacba4df7b52e96f181c22dadceae9daf7498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f4c34b1d927e0e5ec23afce414140407

SHA1
632a698f93c2d062273cecc1d1c08f0049240fea

SHA256
4cd41ca1d3f6a6200f0dce7b6c2d422e7c50f20f087c3dd5c0fe99296c3435ed

SHA512
8d9fade9f4d7d3214e40fad21dd9cff3ae374b2be5b2f0107d30c6f7404888a3990e1ca3afc6a4620bf43dc8d801f7f20ee7e382377d5fa974a3d173d872c29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
afea772e1948e8049632a4ed9e3a73e8

SHA1
94e652cf4536f4f1cbb227a6942cb961e4a7b823

SHA256
70a32160b60bfb3e9e4e1fdc82cdb00c14dfaef21b418b98ecf1aaa0bc31cb2b

SHA512
8d488bf034f7653c0b1b7d1d891b33f1fa61f0808fdd1b66c5ef610b7780234e74baa052f3ee4f3d0b5620231ffaac4d080151510a2de29050942f398d829b7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0b47b7f1a0549c6148c796143c6dd41a

SHA1
73d8bcf988a5160ef71f49c9e58222fcefe29688

SHA256
9557bc782754a71caef8b17c012b54e7984348ace1b265e5f68a262530fc5e58

SHA512
0a10bc6fd74901cb835dbe063674e02748d0418b45cbe068a8fca93c436b11860d2f3bfc7443d53f1e8aa89d8527816e14873beabf025aaaa5828e1cc19f9908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
56344ac87f86be6be31ea5c8e9264654

SHA1
39c115063be9af85c99776df7f7cc9062f805e95

SHA256
7a2823fc65fa92f98e1d834d73d01ee1718a73dcb549f7d3b329f11109f236d3

SHA512
07f59d5cea939b4244878ee1d9603131e58f69d57cd4d283820e5a7a981705b67ea0a1235f2abe236d955ad0684de018857a341295a0c9a049b4af7235dbf499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e5ac78cf3a6e84ff6faa737d51a8100c

SHA1
dca3f38f7a5b31ff7f6623f8bd5003c799f30142

SHA256
eb2a753843e5cebbe3eb8895d23ae5d4cbdd074f035f6875f3c517020929c0e9

SHA512
6774cece0a369a97767e412e3dad8b5352d5ae29612f7ffa6366b091f58d51d8df66c0d7a5412a8a232233b19ec588628769c652809cc2c6fbf51b83f39da09f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3a446b93b372e7f571746bc7378fa652

SHA1
fc79e2c8976350c838061b01b0a83016b31ae3cf

SHA256
ceb4737ad704e7830596ea94af6ceeb8ce64738d09be1479180fa3582044c087

SHA512
abf1b12e1af1224ce2051cb6b751327fe220dc60ff7c8ecbb68c43da471b76f93c7900f161f3be26b12243892a9b42ad7e71d7c71536c85f7095bfb699880f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab340D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar350F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit