e9c226c52a4e8840a7751a34e16d7eab1e1f13e92fdfe5a9c9eddf2e8f37bc69

Analysis

max time kernel
137s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81d3680bb835faf63eafd81243ffb0ad_JaffaCakes118.html
Size

69KB
MD5

81d3680bb835faf63eafd81243ffb0ad
SHA1

63494880326674ee5afc641bebb3011bf28305dd
SHA256

e9c226c52a4e8840a7751a34e16d7eab1e1f13e92fdfe5a9c9eddf2e8f37bc69
SHA512

e7eb458ac3897fe3d43f43555ff9601a40c61894bb9cc2b3d9d4796a00a2de1c228446bdd3d358515eb072cb986fb99ffc70575524ba3b937b7104f20a57be02
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6s36yGJJoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:J3PTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000090674baaa8b90426cc379abd9dcce06c4fd59d2710551ea9a5609b9d3695e247000000000e80000000020000200000001a9c2650931e16aa007ded6c20eeb6b53a1c62930dbb5a42ed0151f6be42914a20000000d414685c85cef4ca57c0c9835585e535d82cd527032825140b7755610cde586140000000daa6439e8ce98fe9bcf99631c710dc56cdd8f962a57d21e3b8d8efb271d868e324b3be3ef79f308d88fd6aa754576d2ccc93bc7eaeb4f6954a4b0d03f3e0820b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B3E4B91-1DFA-11EF-8B04-EAF6CDD7B231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423176498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9004de1f07b2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000c878a2f7e0a5ab8e095a39afe9063e1264752b59550aed5865c188556e9e7e3000000000e80000000020000200000004416afa079e686a1ff35793ea5f93ed3abc10172199cdf204c1127b480033136900000006d4e129e972c7addd41bfefda728de617f443821ee358ab722734069f3b6f3a3e2cae85d5a4fb9e8aa97ae6aa9092326a2b3a45518cbb39bcf162fdfed8d33b704c6912828b1a059c5aeb5fc6882c4d06e3d3cb284ff76742c4abc428a182fbddbd4c02a9ad2f92cc6095cd4a02a03e4e2459c27baaf9d1e6445ed2ef7e0c0cffae893a5648f39dcba7d6fda46c1a99340000000e4ad5f5ff707a9daac972fd0123c9b6e1122cd16b0b008ad9b79d823fa7b8cd36e94ac0b2442166dd95c8c2513312322ccfbb42e3ba1b1791e7537c5bbc1422f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2576	2368	iexplore.exe	28
PID 2368 wrote to memory of 2576	2368	iexplore.exe	28
PID 2368 wrote to memory of 2576	2368	iexplore.exe	28
PID 2368 wrote to memory of 2576	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81d3680bb835faf63eafd81243ffb0ad_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fbaa1b95c463fc6312b40ec7a7bdd30

SHA1
feb8b28ee0efde5a885bd9c753353688f729a0d7

SHA256
a7156b800b769cc3b6a44ca7c38d854f2ae78a1705e46204b2c15a39e8d028ed

SHA512
648444e2c55233c66e2c62a50dac19149829060f1b771a614833f406e7263cccd38df2d01c1cd75c26a59605a575540da752a2866852c7d777a38767e0c6bae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02a346fe580ca25fde025561a5dc3398

SHA1
1152a8fb280fb1f6fada67b2227c9a9c1128ddbf

SHA256
817a8bac15caa398fab6dae9c3e93f98e7e000c888514b43b2413b8e6e49526e

SHA512
8f8d00aab9c195a916b9991551d350d89318367ab2e860c8202e744c6f01689731447e6a288c37306ff189556d458a4c39152325495f3800aada6b62e9b023f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10a3afa813a465b810480037a6437ace

SHA1
d34131a546fe2c3ae424f0d4db5e083f5b616f76

SHA256
f633bd5800a12a751626a57e74275b86972429006274224797e403dda387651f

SHA512
4c95cb1439f280566707d1e93a3082b2aabfd77c1546a319a466fe93705792f57542b52827e02c853f6c844b76972fdb86c21eaca5959918a6b5b98f6b7ca0d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ca190002732f2aedbb48bf182e8e2af

SHA1
0f2b934fb98facd3cb11768c98592572eaf80f04

SHA256
3187da0ff3e67b096a21126bbd2591e332759842999b772a1d5631ead21eb140

SHA512
4510b1aff31202d65cbdaa84469b1762d4172b13cef0f981742e98267d50ae5053a2cede576ed37fac95f1674d4ab994591e193ad1163acf2f967c7f02f3b081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daf1a7a3c0d76efa163a32f64ff85ecf

SHA1
e583e985f59f7663b448f12003ca87e7840e1ff1

SHA256
0e34ba78b34ebda4ce8093288efedef6c6984577065972370a00f8f526b8d5d1

SHA512
fd1b383be2b2c2820c71983ba4e0cf10288b622e00a52d040dcbc9e7d513d5a8a9097ff450d62b9ae036dc2a09e56aa9fab10cc43ecae1b11e9b58575c8b0888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43c2394a2dd4f3055032e4f31f4177de

SHA1
37fc6bd0b7505691300d50d7a5b61e6f1e1f53e5

SHA256
4fe06e6a643589a248a784d299b1a3ed9a0aea8e0e7464b8f38281fb2f94c1f9

SHA512
af7521e9a572d60b5d90b97cdf341e0d54d19a417d0aa712439647e0427cea92beafa530bb71a190bb481bd689638650f93fd81c153b96b8d39afb4b79c4b757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b4ab205706fa76fba0461a2a372558f

SHA1
cb2113c6d067006c9fbf3a874bbd6b560973d1ab

SHA256
c2f2b3e165d0f053f3c6097a555cc74bc26f8fa47aa719d676f24450bfb22d66

SHA512
bed6586cbed2ead12fd3fe5d29fba434f51f0f51cdfcbe45590ed2fbdccc542da4f20f4183b418041be0aac52b7a16cc87e14a53d11a967e2e4c00ff51a0a95e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27545f433f2fd05291b3ada3bfdb8941

SHA1
dcff1850484cf4cd8e8f1fafbc37642bb2d5e6c9

SHA256
421e0c9028c0dacce3490b495dd2453c1f753ee5ae7879fb6c57da419f974759

SHA512
af0df32feb806dac74f6ec19b13bafe0a41e19e9ee001a7c2f226132b6b68b3a47378e9928d3bd4aacac885c4cd85fae0802a8116d15edc5b12dd32e01a84b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46b0b59665f1ac191656862e44fec88d

SHA1
c4aa73b4a98167c56feaf250e3dc62bb4caef032

SHA256
d7049bff28e48a7298b62b2c65294ed47e88c11ae56e02424ce212710103c547

SHA512
0d8c20f2195d74f493be49cbd92cf8cb39d143ed4bbb0182144ef27ee760d72dde6490b5271718d5b38d88e6b06305943d1cc12dc9267f4b600a55472204a041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5049ebc92570bb694eefd282837f9053

SHA1
d3dfd5550b3a7601af3436e85f6c76af92645422

SHA256
a83faa58fcdb769692cca67a287f0664f66fe4a9dff9dd6b42bb63ffa9e20cea

SHA512
9c01368890571073c817bfd40d8e2742bac071b425b95ca4be601f22a64abb2a734ebb9a6028f853d3fd96905d462aeff942109764af660ba808b40fc8f7d0a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4a03c67279819ee6e5c4f2357ad1331

SHA1
1715c8aa01ea2c3ef440678ac2872c3d634b46a0

SHA256
bf4076b89e1a204f5465ddb26e4ea13214543f6735e1de0182c71db8801d10a2

SHA512
831aac7d907a3acd104d1e14f00ab619f145547f4d8ea73aec525b48ae0d94688d519c2b56f16b88bd8bcb5bbab47b4ab892372bc19177c76afbba1d56fb2a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff97cf5e29f04e59a7481d41988891aa

SHA1
9aa8004c1e88fcee5159db25a44e51a1cc0328a2

SHA256
bafd06b9ab506fe3130431fea2fa96c134838eec9bd71be772ce6bfe9f12a999

SHA512
2f26cd95fcbe03888f073b08a327edc454e845384d636921fe53c54e5749738dfaaf52ee1eb55d3e1c264eeb6a2d44754741343446d50a52e72eb3cfcd212b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4848.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4979.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit