6d7dd833ee826c942b1ea8d6da79bdbef4481d4e6ec4e1566f420ed599c95d53

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

732c5db00b7855373ec34f98c13b4f86_JaffaCakes118.html
Size

972B
MD5

732c5db00b7855373ec34f98c13b4f86
SHA1

093485591ff8fcff339431d1f4302e6f09bc8ec9
SHA256

6d7dd833ee826c942b1ea8d6da79bdbef4481d4e6ec4e1566f420ed599c95d53
SHA512

8e9cb6d04348a53c0addda2b94f3aed6f32dd4e248ec92c57dfec8054041e6748053094ab325865e4d9d175e4c73925ea0a0c4d0b47967e52b5ca16021f6dadb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000058b67746e10b8a45a2b196701af93205000000000200000000001066000000010000200000004083f7117d1bb813f7488d7db3fbad17962f6e894349cb0afe235f8a5f4e88e2000000000e8000000002000020000000dd564dcf6b7ec15cc8813fdb26e864b0d4fca36c2d44a2c27bdb2e7889977aa890000000a987567e23305740c9d75f5613883cd89c21762042cf1d5a034feaed71278fd123f140f082c9326fca9bf4ab611aa920349e87a28ebdf1bee9a8492073d5289a57e9293ca7bce4d36c41a82f3f3e3535a1d44f963a2e2241607d1762b1b55d81e20a96bf1c4370491464314a1f8c6cc8934239a51ff51ee8dd4887a4d93fdb3fa3527bf6590173fb0315cdeccd5dac4e40000000dcd5488b2b23cfe3dfe773bb454acd37e3d722a48e828e5940a4946a8706ce3613d29febe942038d8779b33bfe34aab7f5dce0ea8d91207919ca385abd3d2abf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADCDDCC1-1AD6-11EF-995F-5A791E92BC44} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000058b67746e10b8a45a2b196701af9320500000000020000000000106600000001000020000000a6e23b51b55764383206dc347eb3ffd28c1c384ad5a97b308a54ee354bc2aa13000000000e80000000020000200000007dd64a8f2ccceb178baa1c7f6887e286c482240c9d2c867c555b3e175d8f6f9b2000000063ce385b754fead2b81155c8f0ece70e4b3bf4d4b9f1f11d037a0d82a64548cf4000000053d26db045c4142b9020e276a5eb928a4b0fa6db1415cfd19eba77685e55330a5a2211cc16d59757e07ee992a8dcbb370aad4769e741ac336d90a79a1159ab38	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422831351"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60517b82e3aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1376	2952	iexplore.exe	28
PID 2952 wrote to memory of 1376	2952	iexplore.exe	28
PID 2952 wrote to memory of 1376	2952	iexplore.exe	28
PID 2952 wrote to memory of 1376	2952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\732c5db00b7855373ec34f98c13b4f86_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
826903aaecb8fec3030efe5c4aa33285

SHA1
f3bfb62fdd7e927b0f2cd2bbdb6453ed63c36daa

SHA256
5025c23e73bdae9c03f62597ebaed7297895c1a0257cf9d2c81b901a516cc91b

SHA512
676040425776986700833165514025c4d555bef852a7247e3e664965d4c04633fe0a1193c389d583c14386cbd083e35c3a1c27d2e31d3ca387b977084e0f9760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1c4ce024b1432cb8cd89001a9e940ca

SHA1
aee9bff8028f32fbcf74556a2bc3d0223f4cd28a

SHA256
c47f35783bcdbabcbc14ddd7f1cdd4a9f23fa583ab37ad696376f87958218fcb

SHA512
e87bbf4e366f1cf8178211299218ca99179ddce4f129e78aeb1afc3680f4fc4421ebe318288409355c4b2ee45fce19cfee11802b5c34dda173679bfc71448f54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89faf9a588ea283cce3be5fd7d726924

SHA1
860514d90e45c7ce89229b2d2dc739830535a4ea

SHA256
d95d8acc42a39f4bf8caf4a8d7ae35f39bdadd6642be8f269994fefbe22c239d

SHA512
6be6bb3f79e04a9b94cd56be518b62013aefaa2647e9e943ab15150a2db9d17a8367cd06196a694d864206042559664fffc8f3d4b851dced95e23f6e3c261b4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e56705653cdc4bee15d8db12d70933c

SHA1
d71e48a30db644ac1fa02336fd190a4c2bec8758

SHA256
0c23c131c4f9ed84ca6dac8e87af0f99ce0bb7f512ba7fdd35dbcfae4c3f05ff

SHA512
655e5c2f83c66b4f0b905078da91de754117eb1ba13e9ebd33c2f796d28b2fc0b9afaf584ad900a691180bc2a388808c82f65a058729a7954a06db40eceb78fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d33974b18b826d648184940792d64fee

SHA1
9ad831d1a8eeb60907211857fc4f30d0338da52b

SHA256
cac361e9953bb720bb723271adeb01e3067fbc2eb778e7f7a408c24d583f9e2f

SHA512
50e8fe360ed1fb0c24df6d12e0ec040bee697602fc461381b29f81a96500e3d135f14bae5bdbe998cbaee4fb3b5fe8e9cf009ad7a887014c789ce965bfa86270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5da93e34943d439a5b9fbbf1ffd07fe7

SHA1
8c862606562bb84a54edbb8967b47b3b7bf7a9ae

SHA256
94c7dd94768f980956e6b6d81a69fd5ca45f0f54ac90ef656469d59ef5e041b9

SHA512
1f96c6b55cfc40980095f664393f3b56266724d3336ddb58a811abce70f81536776bd8bc9afebae92c385b2a8fd39f277532a1d47c8d7986161490e94799452d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9da36b6e063434faa01ff7846a8e0d57

SHA1
c914a5276d97dca076b8f15c89f8d7681a15cc35

SHA256
633b4c8d230b61074e8d57b44cd574d2c1f1a3b7222cf387fdd11c65e6cd58f6

SHA512
1ba0c29cb2fd4a2b87b7b0ab611623a22cf4fb739a91952a13d66208217724d2a212c9d1f9ac2c39b4b947d28a4dc907f551906dff24512ccf2b9914caf7baf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba026192b0fdfd885f407e42d4300bdb

SHA1
1f492e6a1943e2cc8ebceab1809bf62f950d93f1

SHA256
3322031cadfc90141d7ef85d1bc572d2dbd88920ba8e9aadba91be549545b6f1

SHA512
b641b11d2c86000e2d5d35a0bacca8614db4943f0235aeabfe5cae3122b13634d78503b7adf71a032c0adfa2ab1065cab29b17c4d6800d9915996a0ec2709e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d84d4acc7944bfcef0a7c0eeeecb29

SHA1
b94846b93ba073d03dccad1a4907e0a0f6ba4fef

SHA256
050908627230936dccfd29a39d8cd301898d77c97f0c8b23c09451161d5174fd

SHA512
212fd8ee6907951778270361b99f11972adad10ec4faf056182e40bbb13fc7e55b9e645e7c02be492573c875b15a9e362c52d4bda027b66e5ce2fc7809c72568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ebc41ea8d45cf2d57b44ccaff7a0975

SHA1
ae4333e4b2a3c9a53f497f9c5fd56e7877513dc8

SHA256
ac857ede81742b428acec336fb00f2956f614a1c8bd920c2cd579973c2aa4309

SHA512
7239946b56c80b591c3ae8aa735b1553713a8a5573b17e56b4c287a8a0a431c74e6f129f45cea1126e3bc909ccd317d56b43642c47197df7447438206ca2754d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85d2bb2878bced87cddeb2b5b3570e10

SHA1
98186487c57babc7929ca56e7ee81e4a9f5a122b

SHA256
d99b6ccc7b316a98e83bc1ab5f14cfd7eb395a085f777ab0ec15683ba983eb51

SHA512
7bc36ebdbab06cf5e23187db22f20b5f4b45469383b4562bef2127e7b366b7d50c32fd444018966f2628b69c841d21a02f0f7344a5aecf475717e13d17897ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F8B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3473.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit