add809bdbe85893c9283a5365fc03bf8c36a881ab43b783d1476c48ae96df033

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a100dd821bd0a6134b26245e8297faff_JaffaCakes118.html
Size

18KB
MD5

a100dd821bd0a6134b26245e8297faff
SHA1

3ec0bf474ae6ff8615dcce1b131277f0b3eb585b
SHA256

add809bdbe85893c9283a5365fc03bf8c36a881ab43b783d1476c48ae96df033
SHA512

a63f131c9dd62d3d839effb8b8aec00a669c7f938338b08616307197983c3b412949810ff2096b61e25222f46407a513a54dd7d6c1bd31adbcbffe43990ded1c
SSDEEP

384:S0aedoeAuq4uWgKDo/H7o7x3J/GO4hO7z/fL7GYXlHXK4X5Y1mm:S0oeAulhgwNx3Nzr7/lHXK4JY1mm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE2C5D41-28C8-11EF-B47E-DA79F2D4D836} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000dc9a298d695ba64626b20cd19d050a3db06ac0310ec697cdba4f4a8c720ffd8a000000000e8000000002000020000000c23e39438f4d07cf829b8c961d41a49fe614ce8862119cd0692b3cae86c649d590000000044017c948be872252efc221e4dcba89e55b887e0b146a817d9892a84165a562b46e6bc35fbed322388d5e0eaa2069530f13d1504728e781ab86f8d7709766e4bb477293423dcd3b594071d07f954b275343aaeef6c86866e9a84093359a4502a2b80e673d991d86885c39e9acea373cfec3b40e0f0e3b741e68571d4f0ea02fe1c32f5c65fe62e6690a85b9d2fb492d40000000038690640e3531acb9d0d8ace2a4ba915244c60b59c83f1349788adb60eb0585a9cb09012bc0adc5152239af3b2eb70d9f28809dcc30c004734ccd9b60aac3b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424364654"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300fd7a2d5bcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b4aa390eb1067fd27c89f0b0b78a3d82524942ed35f8bf3987278ff96fb908be000000000e8000000002000020000000a0e1c240e85665b6cd9da197d9909ffbb580b7a115c41b18ec5f4b5c23c2ddfd200000000247117226dbd82b541b9784deed5a6ee284e84cc35e1976d497bc24cb42a55b40000000cf92bd237a1d06e92928ae042c12ad7f41e10d03e71beaccd75bacda497053daf82db9f6a6d025b7c5159ef3cf51a0d36f4d44a2a3847fc07534b5b19f4402d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2952	2928	iexplore.exe	28
PID 2928 wrote to memory of 2952	2928	iexplore.exe	28
PID 2928 wrote to memory of 2952	2928	iexplore.exe	28
PID 2928 wrote to memory of 2952	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a100dd821bd0a6134b26245e8297faff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a27e634e8cb9f23da27f5a1858c1227

SHA1
09bd313ad55aee80fc4be619face7bb7809ee4c1

SHA256
5d9122f0009c26ea310834c9d29c14357a7c9ad6217c9cdef6aec9229169e26d

SHA512
03973f9dac0450875727d7a705a1958a0b12d508477a30c5279bbf6c3d3ef307ab17862769814bc498af59f95eb3e0dfb901d9fbadec1ba3eb6d170d4b5a272b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
482c1824e33ad9afe66f5a2d1d1512e3

SHA1
0ff29d74472c08504cc35b258f38f6c7169c3453

SHA256
c08c8cb02dac5d8208980f7555bf0a39cd039fc354f6de516827e57a8d7a8d78

SHA512
9c656aa81c62d0019e1fadb07dee4ef252d458613bbbf3b9c625e47cf2858de2cd224f76f3c715d0df90c35979d75d018f99cf93ffa7b18020acc1f992d414c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
656efa524538b04951f44a44c697f6ec

SHA1
c6a3b82caa6f7cddd1d757a98cc5662424b5ced2

SHA256
1b1d5093df874c57522112f315ef467a38dd4a8dc6bc6f6fdaff7ece94001b50

SHA512
595cf7e736b583bca46ffeae4136d9b701321430ced46e25b174d1a459cf5e5264e8a831779db547f3ffe50a9510eac3596bb7eeed6efd9dbaa7727e4313dab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdc77a249c142ebfe44532cefe128153

SHA1
146603817bcc2eedfb697021d113bc66919c9cd1

SHA256
a33a51189ef9a8e4f42a85da0c7af4ee69c600418ab7c3ab0d4e4ff087b28c2f

SHA512
fa4182f067cb0ff06eb4bc9cd308a788e9b9250b62ed99bc1986277b2a3a3f2d242b50a6091c82db86d8dbbe88c9607ef64aa16c8baedbe145139058a8378de2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
586ffea22821fc9a516d16883fb58eb2

SHA1
a0912b0075176ccd5232124e91d7f880951a0d8d

SHA256
f546ce806e0d9e7ffc4a1dec13e23a22449444852bb87a259a6cb0ca28e45537

SHA512
2a5e3708167bdbb1a1228dfb4ee576bfeaf5aa0aad2e9207af14751c60c3f0c202e682952c7251ec5c87d62919b068c2d68bd66a0add7c8e4d2635b86d97b072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
153138025668277dfb0c9266e365d5be

SHA1
3e9df64f5fce512f6af1c9492bc142d0d83f9f9a

SHA256
a1c7ca7c068d35bba54f450a40281ebd69b420fbfe4bda9956e58e5abae934bf

SHA512
7a7a57bdb1347f43dcbe5c9748d5c765921a3299485774b524fcd96260a309d57c713feb66bc14c16c8e553621eb615ea3436d6325c55335e69eaf583572be19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c75dfa2dc65547e90688dcfbe428d51

SHA1
1f031f907c86f8fd485c70cc445f1bb0f2b2d7b0

SHA256
73ceaa479feca33041f09d1a6369609dea600da8ca34fbf51a33805f1538058b

SHA512
023614af02c1908b6d7f726897092b445c00a7f501205aadbc77dac2af5be9418c1f68323cac5c952b8c30002e5e799e729b891be2f55a8121f229e8d8de1768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4cd451b704cd553510b483aeed6adb1

SHA1
56a3b53fc9ea2742440689d110ce55bd15976fac

SHA256
39171cccfb06299e5175ea2dab7fbfaeb75c223b20db00c5d9a11a342fa2e903

SHA512
a3f36293619ddb3bb5faf2dbbf0ae9967beb155ad7cba17f4628ed4d0c3a5dde7ff78af3dfcc1ac1d6a4d951184d0956b0c5f70e5f2cb48e06689aa421f96575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
218ade039343b02f62633d27fe0bede3

SHA1
29a70f51d015e3f4a5759e0bbde843b3c44bfd93

SHA256
a8c585762e56f3619cbbac302f4815f8469ee16ad8e068bf2c0f544c2b3af6e9

SHA512
4b5db25503c7c19d5cbf7c99aef59fc9ecbd0d1f068522486597040168715df85bddbe48e3abd4ccb87fa0a30d8c6722c3565e78906ec8b138993bcbbaaea603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8029b8a5700c9b17537470e45aaf395a

SHA1
1e16ee4aeb80c7d6876ce9295bf57f9b4749f86b

SHA256
4cb805d18c3bd1a83bec33d6bea7fbde5b231998fca275174592a71d4aaadb94

SHA512
e1315eb1d51e10519d6f81b7f97dfa26e2f45aaf8367a822387a5483e2b7fc9ddfaa3e9f6fe4ec3bb21f7d8993662effd8927797137d5e7b7895026d6e69c87d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a231cd2313f4d19f6511964f43e76c2

SHA1
9622593fb5dae56eae09a4ae30b2e3107f63d810

SHA256
b307ee6d14c83c98c0bd16ba453f84bfaaeba434209dc7821cc3a95447eba362

SHA512
737f27282e592d9ae04f1292ee6f84f40c60b771848f4b847132cf15a253fa56deeba5edbf104214da3abc9df61e768ac5048ad4363f4c6a1ea89eb4674ea5ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b26b7e27b8779b07ec5986e7610a7811

SHA1
8dbbca38f5958e05cc4ce491f185800749159003

SHA256
cf151330e633516de2818dd4e54c3f96dc0404a2ffb3ee8c05bb1b30c28bac9f

SHA512
72080649924985881b4cc726f61c853cd21005ed1bda64ad98ca1e452f4bdaebeed6b9cb6d28d9d9bce46df026abef15a056a75166e9bd4eb2adc919404301e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f55e58533b3d5c0e7b733f3c9b0f8d70

SHA1
905d966a4e989265284fbf17629181ea99abf059

SHA256
59c2e79c0d590bb3c3a22ba4ea9f5c4d6dbb93931a6455866cc4d68a9e89456a

SHA512
efdb53f8af02054ebca6def5f98f6f19ead6133f303d08fe35d1431232aa797c2023236f6586d86ce6221227397debd205893664b21dba530884d0ea6a109b66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab35D1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar36CF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit