6ee4c8a681bcfc02293eb0f49b3ce8418b518bc921ae17d8929f523aa5aa03a0

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 14:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

875bb85c73bbdbf94ba0c11a6175f19b_JaffaCakes118.html
Size

2KB
MD5

875bb85c73bbdbf94ba0c11a6175f19b
SHA1

a11ca0b1e39095f520c51f6c0b2b0439f4481da3
SHA256

6ee4c8a681bcfc02293eb0f49b3ce8418b518bc921ae17d8929f523aa5aa03a0
SHA512

cd2b381841c6ec52730f5978c2296d6ef55a6197197c46ac0d15fa48b28fc850a4f8179437831675dd9d7b9ecb22e0093809efd93bb6a8dd52ee2a37fdd3a36f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E8AEA61-1F5C-11EF-B2DC-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081671399189218458e5335654f72681300000000020000000000106600000001000020000000ba752d75d5db099724e0d108c05e5dcf4f4a817d8f836dff8c68cebf52139202000000000e8000000002000020000000fe941bd64622e7a42ccb9c4e5dc43e64f9c61b8944a0629fb480424c158b794290000000b4905aca311c31c5bc0f354392c14e0535733852cbadf5deab67db7018df4c3f18de0a541a1f605bb15966e4a2d53d9eabee47ba7c2d15b6583a5343c8217cdd7c964dd2a01c4e47a49095436f2f99ca10a44359f84d7e05f0204b47adabcca558888d21a755b770928d0fa73b86d8b506b99ece1de8f8c9f6118ea67b011c1609cac74dac77f55173e33b9045ada914400000001e7aac866e6fc5247681745e59ebaff6d8eced6a43147d19f32eb2f950b6e15fb8458f7dec8f1a726a9fd3500629fb345aeb28ca09d50fa7e0e0c8b69185b281	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081671399189218458e5335654f72681300000000020000000000106600000001000020000000d06d637b7957a3beec7eb78c0aa50d93df6226b36a39af25653b1b65bcfb24d4000000000e8000000002000020000000eab2f54995c4e9da3a43742bd76cf672035fb6536ae77038ff17d7ce8bea6b8f200000003434f340d6b5555467e302d1ac4e44cfb5106addb1f870539bbb6eb13801584f4000000068b16f7599842ba1d51e5f97bedc5b14fde306e2a47bb76f9df693eda57e036c6ef245b3963ee2638e72000cb48b8a8955749a1251e7b3ead5253a3d6ea90544	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50abb4e368b3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423328440"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1744	2888	iexplore.exe	28
PID 2888 wrote to memory of 1744	2888	iexplore.exe	28
PID 2888 wrote to memory of 1744	2888	iexplore.exe	28
PID 2888 wrote to memory of 1744	2888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\875bb85c73bbdbf94ba0c11a6175f19b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ae480a489cc54e2d3a25b04054e8cee

SHA1
70aae8547bae1684aa050c9190e284f140f84040

SHA256
63eeeb2d7f8d7c02930c9b7ad312a06832db77c1cc7c8ffd74e262fa7e8ae504

SHA512
a4a9ba62f4f3e9bd2b588be3f432c14da3f5903d4f8b9924cba7af05289d174d6331806536b96cf265b2a76242186de58215599fc9b489bc8f7f38bda6d4e52e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf5bd485dd76774485a57b5b9d5174b4

SHA1
7e96aa0de4feba96f26de50451c59a6d16ffedda

SHA256
4f87c7d76dd620557cdd681ee8c0a40ac5bd9f94b80b3bef232b3a31ff859180

SHA512
88c72e88510e07f8c3b0179d21bf8a40777856deabb64b3f6a7eba72b81333388caa2ff99faef892ba108eeec529d3287c6a65bcd725fe6a3aa11b0a0f2df786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1400aa4563dc62ba3071e43c280cfd5c

SHA1
aadbfeea376838dddc2f70f44e4caa873d301e50

SHA256
1ed82082ad89a89823915b53e384b65b749a10f80429dd41b94d610be0c48608

SHA512
40e9d1ded46d5060ad011ce00ded501bcd61b554b9d14f384c37fbf11c7ee26d31f4356bdc3aab5d1a1ea3cf58a0c139fd53222b6c98203d9e083d25f2ae0e20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea4750ed837417797829ac1728640734

SHA1
ca995a1a62686f7d4fc6eb8919d5281c4713a4b1

SHA256
99c0e96b83f2b1144f04e924af36b03a1da2dbf291143036ba7a4531f03c5ba7

SHA512
f81b200f370766668f679f24665d254412a07c75169926c4e5fe549cf3059c424ea0cf72e68df7c7f23212f9d64e18ebd2f4147d30bfa18400485bb8edd67e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3397ea11673b7e579b2d4d671e14cc9b

SHA1
7e0d3332f333b1f95fb03b615873df11c39ebd46

SHA256
c903fbb4718dd81f4a8ad33deeea3a22ad64a3fefc21c3da5355783962bd3bdb

SHA512
ff71a124405a25176a997181e7e1ff92117d1473194c61ae06ad74f294e4d89761175d864b1421b961bc37dca78cd88797fb24fc5ea52afaf5cd60ae73c357c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eeb293cd00ccc00f3126fae8ad7b5853

SHA1
def91e8020082c9bf0125e49322a8b32e9026dea

SHA256
95f0052f88ee9496fa770f5138369365d7109cf861899670ca3307086512ffc2

SHA512
4f56f6a924098e9fec23f1a647117b60757af45b72d91d3610c56149761b808edb8d705b7fcbe4e21f510e42c7a7759e9c9405919b30944f94730f39c7d28790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3676b65656f8a557cfbaa9dd8bc87875

SHA1
e5cf0ace23177758ed4b034095d657e4ad9c9357

SHA256
e6fe971525383f363e14f648d05b66d19111592f1cbb6cb3933d6bf84a3e1880

SHA512
29649fa7f293b40a7ba65b308bb48e6b205cf233961683addc2b217dfde0336ef90f6fa2ec642bf070398bac04133a95e436c9d2852abbb15b8c24a08079206c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
269af61777c3dae9597771efebf234c7

SHA1
274a10e39706093f78ce2c60e25a4fcfa6b59e89

SHA256
5ab4d95b32e2856520869811bad917ae0b4c41749e003cbf74e33d76de25434b

SHA512
4d960dff8eb1b6bf8f37a4a1e1b77bc7f7839bd6dec35cc57fa658b77d81a00dd01c436ba270ca9a7bab5381b66a00ed6e905112b79cf7c7d6d49e894c09806c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90eebcdba789ce415da2a943e6d03a40

SHA1
466dc5757f2b2c9d8ce99cb73d30ebf75eb532b3

SHA256
3cc6ba65158a58e09e830ef307200d962615f95c4a4445ee2486be87c0e1776e

SHA512
35126f81849bc85098301932d7fa1d70c39acefc7454ab41b767a5b0492acbc7aed2cb0618fe3183d277013ffc8b176d8fafa3125b706a111dca1fc66b59732a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0996853f1b317446b2beedddedd291e

SHA1
da6c37f4d9140925fbe2e959df40e1b532fe353d

SHA256
895bfb24c9cbb936401f70896b5ee61f462883703abf4399a2dbfa14e5924408

SHA512
86726c25bbb11ed2c68c0365b9fcc6bec71c5547e5bd67bfd42e714803052e766bd91c03ac7f7bba9733ec97db538dd6b7eb39b775fbaab5bd1d904e4b681b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0784033e379b4e81cb0aaf0d2a6e01a

SHA1
4589454a14431a44dcd37d0c4ef540d3986a5fda

SHA256
58a5ae4ec0957542fa8b286cef902bf1924cc5edd108f5d21096f596ed85bb60

SHA512
b461aa1d75eefc58886700817d0c488938700c46aeae227dfdacb8660cf31a4a07d0fff5b0aaeac4aa53b662fa46ddab83157f9f2f44624ea74294d84f2a50f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56ecbbe29682ccce498302927937acc4

SHA1
fd1d0fd77a63c220df66a5ba6f01f3e1b0a25a6f

SHA256
82de6dcc02f4271084ca305fad87e3c93a7f5f004c6a84e69d36a712b96efa11

SHA512
332e1b7463562e9358f305a16b56c921feab7c4f78da99d86e4225dbe8c477b410d109ab98cfc5777e70a8052de03bc0eeaf17f8b70b6c4f9ce349d25a6d965a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d5715ebdd244dfd80500abe1a2b7b1f

SHA1
2cfb067de09176c77c77d8e6f11728b2aa6130e5

SHA256
bf91ea87decf40bb934a7f37dcdaba422acedaad815866bdd5202496ee01e037

SHA512
a741901d5c7a756f5973fc6c98751da83f37284bcdac714e857b0f6d94e4a2cfa40535760527e8b466a7f7d8e6cd5986020a29450d12baef81bcd4ed4a0c6eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5bf55084eca1977a53fd9dca99ec225

SHA1
a0943104fff8e3d7d0a3d4f030de950d30a818b1

SHA256
9370917cd1152d043eb05e950ebf1ec5efa81ffca6f78350f36635799716fc4f

SHA512
6b1407c5f6781487adfb2dee8eb2a216dc5b324c95c7d441aef4e2343938b8a650502d46d7a14142c5e4d8681ae9f2504989b5118f7f87f91c3fa0558dc21819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eecb336d36c79ee2a218396b8e500a6b

SHA1
77e0f4814346f0af601e3bb55102434d1e544e66

SHA256
7fe44cde0791c8eb8d425ce143d9a71ea35951a6c4b343c6184fdd516a13b882

SHA512
2846902c510ef06ada24b822860c8a504826a5a5f7d1daf4805513a7b4865968506a086aa917a9813323cdf997f0304fb1a85f795fa2a65e9fc65010363a15c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20713c7590689255539987d06205dbe5

SHA1
66a818469affceeb176d02735e11dc7fcf5d555a

SHA256
c0bdc19152959fc55a6219e2a6c079abb561a3a49496d6084138bab22cbe8198

SHA512
29dba1b28fad3defc3afdd86a99619ead84b588adc8791b8c076c248f35135cdc370ed82d114d8afef6f5d683f1c86f184f6ebe927c9163f8de66585eff31314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6b671bc28bb621b72ab5a8feefba96f

SHA1
1848fba024aebfb68849578a06a556a761793d32

SHA256
cd70d455b0ca3395ae1696a4aba037a26f132cffcef10d6e05521e6bd6b43452

SHA512
ea2140a0a6624355ddfd646366269dbbf3bf0e559570a08cb6e2d9484f904452984368feaed4a982b4f05a5baefe9f498c6f64912aeb8c6feb25c139a53fc768

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD02.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAE10.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit