aadeec14a346b0bae770d5bed03421c33068b06fe6d88c439d0a6cc732226cca

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

71c05b594cc5be8555246ed1240544e7_JaffaCakes118.html
Size

3KB
MD5

71c05b594cc5be8555246ed1240544e7
SHA1

c1e0df87cc61de30dd5f110bddf2f05bec79b36e
SHA256

aadeec14a346b0bae770d5bed03421c33068b06fe6d88c439d0a6cc732226cca
SHA512

8757a89a3a9d8e87b275254da63206539379da8cc634fefe5703cc52bfb72f7ec2bf50a50a5cd3c0d0753b42901cdb6f62599474290813760eaf0d0cf8d88022

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422797183"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ee9d44e31c01bc47a764c38f798c13bf0000000002000000000010660000000100002000000087540d3cff6e75e29eb14ef95a44d902de955d459d9dfe6a1e878c700c180ef2000000000e8000000002000020000000e714dc316a80515ba321a041dbde2337dfc7235335d46b7a03731a1799b4d1cb900000009b03a03572355a90230cbad21853ebcc9b3b46c23f4a1c284d4ab47f640ee4f330f430cb5682eda2796275085986e0fcef3b3b9d42bac149fcd84fcd5d66107e5c5b5a6607d83c94609a3647d0e8599aafd3e5021f5bcdc857b50a7543a887bfd2c107ab529493344115f586092de443fc26943c4384fc860e70e5a30d339f70d64a6201114d88d735ce49ac3fd2645340000000866a901c3782758df8b7f068db76afc167257f6b542eadbdcc42bce071ad8f892e0c1308566739b28a3574778544c45451dac1699b8591d4242f4217ef45d7aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ed6f0e94aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{209E5811-1A87-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ee9d44e31c01bc47a764c38f798c13bf000000000200000000001066000000010000200000005d529e55a153d413d77f78c821f6c4a1e1f3f3217296a7e888d678b2f609ee9b000000000e80000000020000200000007dcce2cd0e5d756fb9402144b79442763e25099b219e63a032489ea371a7a52420000000df036c9b002adff5376027f0ac9e153628398ef41fb60da6acbe24ae36ddf7cf40000000e06f6c3cfcfd10984a998815abc95db53911de22b021145f11b88ce35fca0f63b2a93074cd58bc2388df6f6f63be005c6975a235cca14e82ec52382f325cfc35	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1772	iexplore.exe
1772	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2900	1772	iexplore.exe	28
PID 1772 wrote to memory of 2900	1772	iexplore.exe	28
PID 1772 wrote to memory of 2900	1772	iexplore.exe	28
PID 1772 wrote to memory of 2900	1772	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71c05b594cc5be8555246ed1240544e7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fbc0327f8f21a0a968aee1dabbdd0fb

SHA1
45e6c14e0bf0aa73946336ec1449fc56c13f3c7b

SHA256
dad866202d851623716565e3a64fb011d650de3ac2114d624bd1402d88b93c4e

SHA512
4911f1deef2b73819eb6c332cddb11a411ac64422ff26eaf6abc547cfded753ee95569ef80a9cf6ec341c35c3d7fa141b17d9133e52924513bb1d649bb495096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f437e96d319c8f5fcced782e35369c9

SHA1
83b63cfcde50fb25fca5de5df77be8876ced58b3

SHA256
3e0fa0b89fc8318bbe300c5e6f57a82c734fcef1495198efb3c925ce7f5b448e

SHA512
2f0362d358ae8a08906684bddc95e6b8c03d83e20ee3f509f30e35c3ab5b2d19e75170bbba4bbbfaafbf6435724d2aeb4c4f326b94769a91b95e51200c0e851a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80024a3cc7354304b921d0ac5a58ee0a

SHA1
b34bbcda41099d1f03a058a6dfa40f7e93f4a6a7

SHA256
b53678b91d3244b2e45fdad1115a2a3153253a55b87b3eadc1be972d407ca32e

SHA512
2c2339079cbc5b0f0b8b9603eac388b647f9646402d2debe496bc051986abd26b637bfce428773d701a403565ab1d4dacfb94196684c4b0101ba0493104ab05c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e6cae71631fdea4dabee38232a1cf5c

SHA1
cf49ab57e8e7073273bb89153e508b5656f2af88

SHA256
f5dab742a3a813dc132967a9da39260edb7da8e07a9dc5d9fafea67860b0949c

SHA512
0c6dbe6aeda0e1bf2895ddaf324b444294d39ebf9199bf84076c4beba042de3e851d77455e95cb28f20e58c8374b6d03eddf2632b1719f6d95279966521f69cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73b4ad5c5d4b81e8c98b19579663b1d6

SHA1
fc4f06cc1997b8dab529fda9366fa849847b4945

SHA256
2eed6b7e2b79410dc1106a2c5f28665ea59c6911d5a5a2f4379dca23d8f85612

SHA512
1577a4392d2b675f82ce48ac566a6054f6edbd4a6d4d666132b876c92b35b812294025295c43074d5df6ac16e3a77c640cfd69e2bbcae3278a3081eafdd915c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
327bd0519cbcb2a5780d6c67b98608a2

SHA1
3138fc4d8c6beea3bd02d3c316b82e94244330ca

SHA256
7c139145d938d8b3d379984eaad1586cb2d3f25edc80586457e4a2f82e7cd255

SHA512
1bea00347d49fa321b363ec28568d51fb9d5033a2b09c37f5b617d044b49bc0e10edb3277d3c54f16eafe6862c64553c86f28e3085d250da248459edaed43ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3f38cb189908f5db3a537a4269e95b

SHA1
4975ab367ed6c6513519f1d1cdaabcc03c053fe4

SHA256
f1a8c43d7048e5fd499ee00f947423da55330c2a59058ea1eb7fa15707bb5a33

SHA512
b42bd57df8eb4ba31557f2cc972f99ad7f679a1ab34823d6bd47b75b3abcb5c285107e218156b0fd0f274cbadebee64c16be3bf1cb44038575136aff49667140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1a61839c1ba9de9694c03fc0049f34e

SHA1
d7275dafa0dc7cba647217ae0c155385043f7013

SHA256
08337be0b2654bbb2adeed9297d1d665ebcff4496ea53b8942ebb8df318af367

SHA512
da13b715ee230e366f524419f0322e89034d9bb3a6c4a6ec491e6314169dca024efde233c7af7a7709e9c20a9874d13846ca390fffec9c0cc73ceabc191e0e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7573cf57705285715e352e760d338609

SHA1
c697d3c42289558d7cbdc557aa2a4f9685843364

SHA256
978334af1b1f0032ca42ced562df46eac323eecd84fca8c884b419304871c254

SHA512
e5c8cd670ed81689e03e9ce9b043b3f5139fd2becf1ee8c9b19d643469c5c2dbe4fb1d00c0ccab244ce3c0d9d3393b15147908a29e994ec6b6d79c73bb42c281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d0e8bf763e2093c72addce7c44ab901

SHA1
826699b7b29aed4dcb7555eea917c2833b89bb5c

SHA256
e59e031effcaf0c3755a703a0085e6d2c8477e4dea36abc6f9f7a9ce9da6eb01

SHA512
b27b67837ae841d29dcccfc97604a9dcf5725b94ef74f52364c2e9ac99cecd91bcf3acb832c5b795766d6e3cd400ea0777dbe5ca747c9414dfc7c47ef7738de0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E21.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F81.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit