1c9bd12926dfb5c6b721c6bd57116fcd6dd061ebdb2c268005ab7291319b1b09

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9aa72d609afffd8b6a46eec06d5a7100_JaffaCakes118.html
Size

1KB
MD5

9aa72d609afffd8b6a46eec06d5a7100
SHA1

1d1774714c9b9f132b930cbe659a30726dee96f9
SHA256

1c9bd12926dfb5c6b721c6bd57116fcd6dd061ebdb2c268005ab7291319b1b09
SHA512

bea25cf1c3ca19eab7f193a061422fbc83c752c319cc4330af462a00fbf3abeb0c9229f2debc669e751307894ed6ffb39525febe6e735f6dd2e554ab80fb4eda

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424183997"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009f4841b052a78f469141f16992f17edd0000000002000000000010660000000100002000000008ba846cf67843e049515b8502fb1c7eb1fededf9a90ad347c04ff1ec1ec6c00000000000e80000000020000200000004cfb8e8b3e05b5339b43179f8c5d0f2ed10cb2781765440d2ca2256150405ebc200000005b1b192d3168d62f0e73ef24ee0cbcff0c1b99edbcb54a3c882d0a5b3f09e51c40000000d7b2c59834cdab3710acfc5edbca9eae7a60fbdc9f1a6125707f715f2da6025c3299172c0f269f93061720bfab5bc8ccc8646f2240fd06cd0960e1731072dae2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30003ae130bbda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009f4841b052a78f469141f16992f17edd0000000002000000000010660000000100002000000089927f4d903256f985a48111604ff3011c00454abdaa6824f496cae3cb3bff5b000000000e8000000002000020000000b48b746280b7c6753b4be41d892def0ed807d1f233c85ffec0aa5a31970e5c1e900000001a2067fca3cbe262f8386cd8fc7425d8191018c340971fa515d6487b9364bc6862453fdd83ea41085a4156688ef181342d99db392b6e58701c3b9a232fc02d9a36fe2f7ca3f64d015714f3ba32c1de96487c1ce26ec37b93dcca52288685e6afa295c61f3b49e358b6f91bf83f6f872b46318d117946ea7430cfd30cdc4a6f41333bce956dac4c9ca4fb1c89002e300340000000d2150840dc8c4e2292f805dee899a2785368ca231093db55ee6bea1dfaa6db49a18437b64149e166f6b300a07980277abe9cc7bfa1fda678a0b8c92738b64c23	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C7F7BD1-2724-11EF-B33C-C2439ED6A8FF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2376	2416	iexplore.exe	28
PID 2416 wrote to memory of 2376	2416	iexplore.exe	28
PID 2416 wrote to memory of 2376	2416	iexplore.exe	28
PID 2416 wrote to memory of 2376	2416	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9aa72d609afffd8b6a46eec06d5a7100_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c313db7229b5685eb99eff04265b32b3

SHA1
76bde8d31dca33d68582f05cb7e819ec53b9e37a

SHA256
1f527285c79e17e4ae2ea329b14ff56a68aada5a45485c896b7e04763b45206c

SHA512
c7b4392c4fc3eae42b0b63a6cb850b5b3769a3585c909208d462dc5dff057b77702f29eb6393cb2e6305b57edc4de19294b2812482b3f16c9f31efbb9c6b81f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0391455b388d7dda531e407b3da5f248

SHA1
5e51e433d700c5082135d7fa661149038e7bf4e5

SHA256
afd1febddde3f2c6900322df39d41a7869c2f89d5026cb721b019c9ec03da87e

SHA512
47224bd7045a5e427fb369232831634903d56beb853a98f639355c556c6c74f365280b3b8b035ca581f59fd5c0e943cc41395b86b11091f63f93e8405c6b5d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f643fccbf779f29a25f870b1504dd19

SHA1
4603133adfe70b62cafe4447917fb0a32a8a9e5e

SHA256
f36bbf5659a33347f45b786817bca8daf598a9e8340b22199352ddf493ef7922

SHA512
1999dcc478dcd3021843cb91cfe114ef6d3d7255cbdd709b607b92e9cd406545945a0c4113aa099be7cb31a476d7d6887cdf58eab0d3e2b6d9d9230bab6ec379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
773d3b4ecc14f8fe8f3a2c485796f02a

SHA1
3289a7ef351cce57d88bbb50f1a94bce36bb085d

SHA256
6bcb8d4a715b090fb483fed9e60c7ae684e816bb40c88d3ef23698ddf0d16682

SHA512
bea185be0dd0d47e409afaa565f8648b5ce47c71e8bf6736052e5cdf260efd605296e488adfb0e719f59941f766b067eb248220f46d4a7b9b943f42cf8b17f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb189f0797e86d4e3befcc601e7941f9

SHA1
e3865d20b6c9614111432a22de271ff2479b3f74

SHA256
6e998aca1f363f3d556641a93b0ad79e26a00877cdd605273f28ad980d3e98e9

SHA512
19bea0145d50222b7822d2c881e5f98e7213acd791f5f3a0a4ecd22ffe5839fc8d6ebcf325d0d1cfb0c18241441e279a83b1d9f19e87c5adf498b40083bfe7e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
969951a28a0788052440580c37e74cff

SHA1
3c5019dc100c29f32e87dc09190cb9af8900f93f

SHA256
b522aa4b7002eee714270f21ffade84f403ef2ff9298a60b770cad38fdb05934

SHA512
cdeb979f65f7b763f16055d492fa21ead7b6c02122c02ac32600ed0f42bbe2e18c45f1a442246bf430d5072b173632776303f5b4a7ea0e00f4d6b6aacd78759a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9de650f839674a00b86e28ed1de71a9c

SHA1
66ecfe8ee3687a482230bf955ab1e0f317347cfb

SHA256
8d5607d565835499ad3d8743dd27f72680bab6b2ba943db5388ae0bbc233fee5

SHA512
47d3d0d96ee5d0e4923c06670d878820b91ecf1ce45d97130a5245e4a802269d505946689d0b8be0f404db890df3a593a9106b43adc20d62e515d633f46595ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5d43427198b16702261ae147668c68a

SHA1
f8a834e111517a08eec6c31a0488229d5320f8fc

SHA256
4dc33a4a3f2e7a78eb13c850b68a7b0f3f3c640749d6fae67bb9fb01efae6829

SHA512
aa63bab75c15d708dcef355a78725e6b034f57eeff491709aedea4fc8cd57c6f32eea4a1a42ae3cbbeae85bbbfe013f27e5b6a87f9051a4eb5a509fcd7ff2a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
202501fd04ee14c791c3e2789f2bf5a3

SHA1
67f21a5fd4afda1f30f27b2892a7346b77ca7b70

SHA256
89255953079712a8fe2287e6956eedb68eeda4c7aa9bded382e7a87ec7eea746

SHA512
b60decc39082c501ae85b728b2933ac95b13a0c11f42a19ebeb0b1c3ffe0678ba6355e2a725c4d844cbd75f123ca6de5bbe3b7ec5179f4f791e6d41a7640429e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7aa3894213c65f4d54d6229528a6e7cb

SHA1
1ac7b887535dc11557167b00cc238255f957c7e2

SHA256
bc3fc00d751803bc7bce35554e789f96a06281049f9a3c00fb549dc950be2145

SHA512
69ab211cad7e601ffe25c99a91baff3ebb569e8a2ea6d1d7722b53289167672049e021b92eee3bff9e6d5fe3b2da87807af1a6cf313a3e1fb2bce28c7ddb6793

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DE6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F93.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit