4a6b475e39d1ea155a9e7b9da7b27c30f3ba6576ead4005ba2c100e47ef9f711

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f8c91f6a4a980435c7301ced40f0a16_JaffaCakes118.html
Size

4KB
MD5

8f8c91f6a4a980435c7301ced40f0a16
SHA1

56945b1b9c3f323ef2e927c38e67000ec9bd9679
SHA256

4a6b475e39d1ea155a9e7b9da7b27c30f3ba6576ead4005ba2c100e47ef9f711
SHA512

fc0ea35016002b0c18aa25e349b00c3e83d17c045281e7630f1d9bdf7a15bb931bc1e5883b2b0c04ea115e8ead8e0c7481d5c4cf10b007da72c1b30b8c430500
SSDEEP

96:ziERZmV4MSEPBDvV0n47ej/hgOKiljSR1QnyneqhAKiEs1dtFcE:zigwV4GD8/h/KiZwQn/qSKxytFcE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423526822"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2CEBED1-2129-11EF-AC06-EEF45767FDFF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e38ce3a7e80045bd9eda52e83ff72b00000000020000000000106600000001000020000000584eb651d8d2af7da9d411f52c78153baf6950d45cf7e1a4f9baae63356844d8000000000e80000000020000200000007e3f2c349c68538b0f81a752c169bdecf52e52d95ee190cea01eabb4ca195a9890000000b989a1f93b5daf21aa7f1cff406c9ee836fbd957761ad3fdad02530f8af708769062517fd54ee8201bb1cf968eff2118ac70241276bdd59727dcf0f90b8cf3642cf1eaa8a3a3bb9cebbe7058a5e1182bf80d09744ab00549f85c4b266b22114636049b5380ebd6e7a817225f9b31f4f48d0c8e9b68532177f6488b16f5efb81df4ce4310a50483f08df94de01601168440000000d2654fce9dec8a375dc42bb9d712d71c701dfc588bf6368ae56ba18d25110f688e550d5b6b817a98ac95ad631a5ff8ba16aa1915e4f22ace0431b4f33beb0fd1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e38ce3a7e80045bd9eda52e83ff72b000000000200000000001066000000010000200000002b7816e96a1fcc66e11d2a36e03e305b68d5b5a253318868f44ab27bae9a27b3000000000e800000000200002000000016b58d281dbffdb9a01517ca4f3fbe43d248bf5a541c3ce4b67dcfaeb6d6357520000000d72412a1b9fa94afb9fdc4093602ae4df4b8c5a1a685186924ee58a736d30d15400000003d8ef9cff4af5de9f3d76dc115172a44d0e80668226f4a318511eb8e79e23749093aa45d1d7ec291af65869c08945401db2a3b2e2165f5adea2b8e05d3fa67f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a006b636b5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8f8c91f6a4a980435c7301ced40f0a16_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b29c4ec6c245d80d84f6747adaa4333

SHA1
1e4884ed548c838752fd580b0bc1d33eed0d4500

SHA256
596091dd0b5ddf0860d378f4f719b5630915697c01e394547b6d26c9fc35f863

SHA512
3b1e97abed597b7c8cacbe749015a0e439ac4505d7be287bde12248eff30448da2f46c1f88b60436486f93dfdf556164ac631908abbf89165a0fcda79dfacc21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ca912bf1cec49a5a3937a217f1f0be6

SHA1
25fc4948664361cb7e1740a8e4752de4ec0fe6ae

SHA256
a20d6457daa5a29c0cdcb7f9817feafebb010270aca3c7dee37d7f16106735c4

SHA512
07a60e8a935ca961dad6b0d48b3793fe335e6ce3c200f5743b44349869bbaf79163f9a45679ac1fe891680a8bf886e3c429f70a7fa74351416c8aedb0cda67cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70df00eb8012ed9966bf3e9be2e20e12

SHA1
abd6b8b1b49b9a509475f28afd8f0c13aedb4cf7

SHA256
cc459c844eab75399a64f5366fb4f7d97f1ffeb919f2df34b828689de6f8b957

SHA512
16e5f91c11ee8af8c343d9d4d9cd1d464e814f321fa01518b2427520b740331de8f1c23b02df7dd6c5cdbca39185e056f58865af34523edec6fdb1feeaa4e1dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37b423e7e88354a6d2bde78141c96b2c

SHA1
b3e6076038a62f9d8ff60c76d400754370827836

SHA256
ac86e61718d6a5800dfa1d2d414cb03cce0908a17ed8d3f9730378bbc209823b

SHA512
8e989fa99140024d29ed8f0c9c2d03e6a040d19ab6e5c29a71e22f31ce80a0d9359536a94e54a94560b7311e19b629d71830459a21508eb6633615b4ef0c3b95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b2b979365788cb3feed8ec3284efe34

SHA1
d227bc0fb068fef9e767ba4b1148157d874c0f06

SHA256
56f811279830d98b7d0045ccc49513252ca8326d9d772a97cc6bb5454a443ef1

SHA512
5f814c84629ad1471203e2829f389110501d816585b6a54c29b7712ce5dde8fee602a4ccf29b4b08f0103c8f57077c893138a1829b35c106c69d5eff8f585889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7119a946b4b622168a36c7597d5b17a

SHA1
b88ee2f239c34057c0ebfd1c7baafdd0848930e0

SHA256
b04e3e481b92e8f0244c782fe4b4aefd6acc72cc86bdd68a9de3bcb59854db63

SHA512
ff6dba2c3090eb9a4c1b904dca779ae9b8192d7bec66b1ed0551c46c47e76a923c56ce2526f1d9b0a2894544686bc86137ba21a78e8191715d676392321bc75b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca8877f9b5f61a899d3dbb986060e2ad

SHA1
1bac3ebb6658191fed529607545469d2ce30ddce

SHA256
c3b65667a8f06e6c5c20574dd15361593031ea5b9bbea7997ce2383f7d302590

SHA512
43aea1672e6c6206c90caf9aecc314cd87759139660598fe4f242c8fdd01a4469969ee07dcb24c89c927e8a714384f37b9b8f694611c57ec3457780024e6e57e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cd59ebf857e2d1f482c79937bffb19a

SHA1
618f18f983b3ff83cfc76b90341e6e645b168206

SHA256
b89b5aa449ae4f7b5c9acdeda79e630d895a9c72d33adab2047eb05863c74b0e

SHA512
45619e2cde8fcbf20680a1bca71f05a95a36bf32111132071ea3aee5981ad54465cb19c3b3ed8bed55e7ccc809e711f7e89fc109b2e3b81b5e934c36224dfc2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b585d143c5da70f08080c27748ead4e0

SHA1
2866598204a4e71fe4e5b511e32d89667c6e92a5

SHA256
9d8ec93ff06302814fc96c4b31f57c2bc685028d883bf02818cf7c59b20ae48e

SHA512
db054db4ce2084c380152efa64dc891dfc8466230fecacb278645deecbedd47fe8bf8d28b301f2bb16b6b37daeedda6e12fb5294e7d3102ca1791c331fad8344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6817ea21241002d0c010b6198ef803aa

SHA1
7c745593197349ac69cb926921f3ddffcf9a8731

SHA256
a93208371cbe7bc827f779c7c6aafe9945a502eef870a68edc79129b0ba7c471

SHA512
51b01fb86963c5e93935ac5f3e0fb4d6ce1d1b4c929ab9358984e87519416683389fe55a138d6ffc4cd90ba2ed2c71908faec218d553ed7650db194612540eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f64c08cb9d0222af040e650fcfce4eae

SHA1
ad136f8fe9e638bd1e687c114ae0235364ec7ec7

SHA256
ccb2c889e21170cd0a0472be371c73ae720801d8592ca56f647bd0a154d69a9e

SHA512
da8cd31262ca9e07e0fba5e47153729a5e3dc772883024921a966c7894b3f787b842bbbe0709dd22eb3cf39d2747fbf95d8b6cbf8a52ec299c83a17534fb4de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5e0dd533c73139312af68510e710e29

SHA1
752117a2ab75793d45ac921b8adab5f8b1bdb44c

SHA256
e87f686b20c45b21defa52bab34dfb6aad101991fea22660d3681606669f0220

SHA512
de164d8ec39591d86a3f7decfa6c8524c18c8419101aaac676aabe89ea44ba5b42dec1fff98968c3c0fb07fd66ad096e5b2c4fef869648366163003321961937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
778c91ea9d519c79ed1b740ff3f928d4

SHA1
f2ac5a688c840a2eb684aed69473f910051e41b6

SHA256
ded29447cf05d2b4d7c8915e99a9f2292f4ced8ded191390844e0ce403cc1f5d

SHA512
2f40eb117d4e020d5910f2fb4c8a807fd48ed1f2428985a76c26152793b0a38216259ca63f6bc423ed9e8f37fde4903f9df19812b58ebdd9bc5f9dec92e6aae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f615c817d054b22d4a149e7505b5dba2

SHA1
49d2ee15f086f2fed91b7a670ecd2b54f60dda2c

SHA256
ca046077d0f64a67b77e4c2488dd53aa59db27f48e46090a4944c858604dbf6c

SHA512
48a77f2583b912be3c658b0434ab2e692bad9ca5fc9a4e3babe56a4f0e141fde6ff591a34eec7a5f5d0d710dec2f60308be861e48f8ddd2ca6986ef9cbd13add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a63d7d9cc3b9d994ae174b00257990c5

SHA1
23d4edbceb7d7ee425b5790d56ae416eec2b477f

SHA256
586f2c9bd32ee879cd93ec21dee612bd0dfa7621f15966923b7152e65fb76319

SHA512
dd8b8b4821038225c807028953d0f03fb6e7f4dfaeca6c06effa62b3084f3d2ba7c28179b1acd83b2861afc1e89150e093b776ffe49fe419ccbd8f8a73162060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f160082ca5cb49da9a63c0ce78fe893e

SHA1
b7ac7c907b3eaa076af3cf7c44773865054bf2dc

SHA256
8980ccaff9d6b2370c6808a1b80d9e1e65298804b371d70c3e5154a6c9839912

SHA512
cd2fefa6f8d1808d5fd4b61592796dee58851c4ee27118e538b7e441291718fcb928880c4728197603c5671761cb1a6c55a7874cbfaf635aae550151cf7f7837

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB177.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB323.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit