c8aa50975ced9d7a82bbd5c2a9f26e7babd5715ebbbadcd812617ba55ceb12f3

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b720d25eb2bd65ef2cb84f987298747c_JaffaCakes118.html
Size

938B
MD5

b720d25eb2bd65ef2cb84f987298747c
SHA1

01ace3ff9cc47440734d76c911f511bc940275e8
SHA256

c8aa50975ced9d7a82bbd5c2a9f26e7babd5715ebbbadcd812617ba55ceb12f3
SHA512

e8a510684423b62e17cd2c0c340376dca986cc84704d795c596184b3c7dde328ccc060354ca0e7527726063661f3799eb3a99a3799ffb39f74cefd3228432971

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25C71CA1-2C70-11EF-8FBA-CEEE273A2359} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005a78fa7cc0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040ae4058322ed744983dc0d6e001812d000000000200000000001066000000010000200000003b0b56d8de3de0f4703914ea41fd752d318dd0e6c680796d9ebbcfb5eb8442e6000000000e8000000002000020000000107a403b85484ec10071a4f530976f4d9142de0c8d4426d09aae4456037dadcf20000000eaa81ff02a20ebc30f716e8142bfe601077ee1b5810197bf554cb268900580eb40000000b0a40c7b649cf32f2840bf8bbc3d93313bfb8232aa3fb25bb7cefe25cb5c026075a8be8624d8ab538de7dc01110b062337fe93e0ea3391687ce2e3d850a813fe	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424766433"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040ae4058322ed744983dc0d6e001812d000000000200000000001066000000010000200000001717d428196ed1999c267cc1ba629df26c72f9a21f443adff31e66bec20e0225000000000e8000000002000020000000850f4ce537c5ffe1a8ad6123ba492b872acc853bdf0e5d3f00928a915729188b90000000f37c167eeaef7fb06723140f1310b3f8d7b241724d1111085ae8ce02b9a72c25489f53d2559c2f9de0ac5fcdb30a0d58073b9ba337c299f8b20eb22970a73f6707ca4fd58552a5f8f593500aa3a8a0d069f845876abb7912976ac5a9acde37a3175f788928110c86f9ac8874a71c4947c53d0f4cf9fbe761f2926739c4bb6e5911f6e58a5dc8aa99e049c7d71976a33940000000af5ab12c25a300f687dde47adf7e13f73c8b4cdb8cef77ed4200fb2f22ba8a6ef784ec0ca6cc4d6e9c0469b1afc7e5a75fdcbfcd7afab5b7ac02cbbfd903d5f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1884	2440	iexplore.exe	28
PID 2440 wrote to memory of 1884	2440	iexplore.exe	28
PID 2440 wrote to memory of 1884	2440	iexplore.exe	28
PID 2440 wrote to memory of 1884	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b720d25eb2bd65ef2cb84f987298747c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
803360b67110253205c4f3b6266e14cc

SHA1
f5f748cf9cd06f9b7acf7296f0cac841e7c451fb

SHA256
4c87428ca1fe4b85e8781956c8eeb03a40e0cc1f1c8e045129cb8ab8c6037b69

SHA512
35f1295f79446475b751a4b91a6d6e108a9534fca8e6a283f002eec8528b1cf55d14061c4d2a084ed3403648adcf6cc512ff77e7c48d67d7e399b4b80202933a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81511dc445ecfa81841d1a9cd9424a2b

SHA1
8912c802a87c8c4ee5ac22d74323369d3983cff3

SHA256
21588e9ce782cee293299b4ce54da24125530e950b10123d6bfeb83e9c759247

SHA512
827ef48bde66de3d9f49ba509dde994f63745d2a6d7af8bb0848f8e840c6d486d457e52cc40d78b1dfc02220f93c42a46f1bcb3556a9b859c013c5c2fe3416e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df77def67b94ba0886d7ae24bb9998b4

SHA1
761e26aa77d87874e46d3db3d4b3dcf5fab00cce

SHA256
5b19bbb8df87de799594c48a2fd78d457ef302e7a16e44be0e6569942e9be74c

SHA512
c1837b5508a8489c32cd6f3469e8eadeb7cf45dd46e82697fc08a5d5413b8cd99cb65a63f29bb2b38fe58e42f80fafbd63ab798b8ffb961259f4d60aaef13b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c07f5325699eff3b9c4245f2519a098

SHA1
35f124d04a63d4f7d99137a2262bd3a1ea888797

SHA256
ff1d046f932613423ca727a5e10285888be141bef2e64850de7a4b7f1e391af0

SHA512
0618f36203759e453e49c812d81510f36528bd01c0f5b5d0036d403c09b248e8a63a1b61a05635a16fafec19312eb08eaac108ace3957fd61bbf962900986510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28c790d12da5168ada06d767a8124b87

SHA1
aab9d7b82afa16a95d212f4cfb0ba7360f2d7cc0

SHA256
24d19fa1acb1eb8c17972ca1cdfdb49743312d91cb36551ea1228a077ca9ef55

SHA512
c5cf051ea3db7ef1600117f3b1d849bb9c0953ceb2fe1cbb65425052b23a1d6e1b1df70b0b13d28b72ea3e2c9945360c792ca8eea7bb3c2a3aaf29a41e1afaf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c1a0f712080bebc33d50563c04e4333

SHA1
964a8928113ceafcc3cac613fb9f66a2f44d91a2

SHA256
d1f4eca4159bdd2a7846df9d06d0297f14983e02bcf630616d7b2327e315b023

SHA512
b2775a1c812efb09453c3444d7c6c3e6c068f847829839e8cdbd90ebb0d15f13f20792585a3a197e27521a28363c6e0a6bcdd988eb6479cd7c282c7d3deb67ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06827ef3fccecffc7116f88a9c472064

SHA1
a004cefe72344ea88ee2cfb1673a5ef5579fa66e

SHA256
2de72e90c020bceac9e4994d8159331ad7d6345e43c22d8d9aa7d96d7626d5ab

SHA512
5432d633478cca6856587c29f1574290e9ce64e4cc08f9725a7a34c6c8ab17d4abde41423cac6ec270095e78e2898b930f852232e3ed58c0de04d88bd31dfcef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed558244e0563c992a4e50c4c6a8447c

SHA1
1561468826ccc59af76be3ece0a0e7080f386de9

SHA256
a8e5685f8835d80433d088385c77d992e04f72b8656977814476422c2bb724a8

SHA512
0769b7bc2f57ee034972b60c285d3cf5618c8c613821e3b2245a9825dabb96b4ab71d642c54b44593c9f072197403577fd6ddf213cba4b692db03dd84c2f1214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fc7a9b84603b8579a27140f3370103b

SHA1
d567f784232c4a087acf47719f14880966495e99

SHA256
5dea1dfe67b918315bdb97ab8d62a42e9e98139242c6cc4a99a1ec7d8c37a5c9

SHA512
46e212811d7e9ee5e2800aae68601fd604c55cbad9aca74fc5b0aac7d3b6098112892168aa7d1e480e4f5dc0ea2c87021e070c185ee97e988023f21d6d801bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc5cd5df2ee042012a82737586f17c9b

SHA1
4456537b82226abbd0bec04019e56bad78b46d0b

SHA256
389d0091bfb97f617b5a4c758014d744ee5f9785e0e3ab34e06377748c5daac8

SHA512
cc058b5fe59f2d42ec438b203de3c499e44df85768efd21f9a1a72412ffb43faacd240ad84b918f0d8045627a21426df9ec0724d8e9f66bc0a7a2d2406e4b674

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BB5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CE4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit