02d5c93587845b6c594c20af37db633507b26a75acd595461949c8dfce45f6a2

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45e25bf4005c1ab5ed5682dcc1e9e00d_JaffaCakes118.html
Size

37KB
MD5

45e25bf4005c1ab5ed5682dcc1e9e00d
SHA1

f3c20edcaebe3583d4d2eb47a37ea0d0b56c3c51
SHA256

02d5c93587845b6c594c20af37db633507b26a75acd595461949c8dfce45f6a2
SHA512

d240d6ec25b46b270c90218011356e0819a79c4777cda2448dfdc84ce832d88ab3810ecb196dc4af258d2bf18f9242f0ec0541e478cfedffe17aeed92016a75a
SSDEEP

384:QzLc4SXRDoqMNnCyJjyZbFhHw8aSZPXk4iqQ7rwbfAVw+fY9/5rl8n:QzLc4SXRliyRFRfvPXktqCVq/5rl8n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0085b03eb8a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000016562baf38b191aaa9f4e5674cdb047e621ed07e9f260193f071d5f13c6e97e1000000000e80000000020000200000000e777ae82a30f37d8a3a48ec9e7e7c3a705dc58262f6f74817ddab79cf6103fd90000000ebdb73d7324ef8b43208e8687f0c89bbfcb838e0ddf2776461ddbec93f6b056c7bab5bf7c6223c4f5b616491733fe38143c527dd62c4636d7125c9a55935083225ecbcc89f552304acfde9a906dc1776f69ee6c045fed0a5f1d283fa279dd38778abc88ab6aa1fd7df4c57917235e5acfa556737852fa71c79158bb56fb3b1f1f1efdf782bf7ebaed5740082bb43a65d40000000478b779743de0af1d53c09dfb16f31a236665bd909499b40907ac74357508fc1451ef7359e20330b767dff0deee35e60fa8ffbfce624532e06d4da32b269b7b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{586471A1-12AB-11EF-B27B-DA219DA76A91} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007ceaf9c8b0a162b927bcd414677095c556e7c290b8a5bb4bde82fa05091c5e70000000000e80000000020000200000006f34ca014f120b7a543dfeb6caeea862347aae8c594623daeaae76b3e3d503b0200000004b9761258e9295c1da8f877a97c6beab549f26333317e350e1dfbc76869d744b400000003080270b1e3c3bfd902cf7d7d8a44219bab1865817da005ca2b4565d783339a11f945f1f120d9c99c9944776cccff1fd90a4ff4551d03917123c5a32907c7e78	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421933128"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2028	1636	iexplore.exe	28
PID 1636 wrote to memory of 2028	1636	iexplore.exe	28
PID 1636 wrote to memory of 2028	1636	iexplore.exe	28
PID 1636 wrote to memory of 2028	1636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45e25bf4005c1ab5ed5682dcc1e9e00d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
767f3bfb0a5ca0b2fd2bdf1c4eed103a

SHA1
740f0b3821e1cdbe59629807ea9e4695ed6e3067

SHA256
073636a3fe288f6dd12640d856dd6742308fa8ec0d4fd6bdc5ccca0859df793c

SHA512
104ea48f2ea02bef627a1585dddc5e533933ceb9b17663d0a11f8c16cf30c92345d34f1593c5072beec8a653bb8dfc11a58be281436fc7dc0a6e300681052d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
727a2c8ee9aabd33f5e15f7eee2992fa

SHA1
cb1b9a439162ed925d1882b5401ded0b83a25422

SHA256
e5f810190e5813554c008f94aac7d0c6ed96d6e8d4e5e791b4f75a4291141257

SHA512
1396391b0127cefd7bc08aa76147b4000dea1c96f7f706782d755052a023d4dc36bdcbd14729bf75e503420dd9f766dbfb5c223eff59d1f99e0913842962dcc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae5a4a5103ec92dfa9fe60c729e31dab

SHA1
bcf49841301e05ad20ac359dd3b7e85e755956b6

SHA256
c48d1c70585242bc1d26ab75d3fa4152ae82bd3d127858b6080561d144b67f2a

SHA512
f5df90d4d71fbef95e900de6d68f825d2853cd2a77574d2d526815577c9b752399a2e0b5fd938f2f3c6da04fea11d6207ade06529c536154c9cc302ff12f6208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ab84b5457070b532849306910f7bdfb

SHA1
de28bb32173015930515b1fbad778b0ce00fac30

SHA256
0f42ff9e60f36392c99f5e91146b6cd1686d5c0689452cad288dcef494191e78

SHA512
e7af0e7de72824f4fe61d9f43198d5e625296f48b0055e1be003dbe68d932165dfcfeb2e63b57e61ef1d8ecade91074114ac444dbcdfd4716448214704a0416a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9da7dfbe9a6a8f560f1855195441458

SHA1
3c5ba6d962a8bd582321cc484ded6a6f427aa27c

SHA256
4a712f28cb39dd5835630152dbbd448f6c75bacb661ff2e19894ab862a052f51

SHA512
5504ff86f9246f2e4e3b5400b8dae3dd75d7a80e2f81a900aadca92423f1a088f911f41ccc811cf88cadd385bbfa5afa46a7b1c0b7e96f4344e3dd2269f0bfb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e41c54775110013ee7f1350ccd7aac41

SHA1
a678fd010b3f70f15305b61b8f1deb13d327506a

SHA256
0bdbdd5c8159ffb8b4639bd37958d28b233b49e31d310a06bda9bea6e3203dd1

SHA512
aa5627dbcacdfaa9293fa2a522f27d4bf08d6e019537e649d47e4b58d560789633b206041e30747c7f32ae4d5de804c9a5753fc971ee8bb2cee867e3be3c96b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4e76816efb2b4b8ed8b70db468a2d95

SHA1
68caeeaa2b2e2c855c2b0681b74313a5aaecc539

SHA256
7a19c32e981e0c1bc1412815cc00edaf4588a2c2625519117cd0648598bb711e

SHA512
711ee3a3b2c56e05eb4fb017c4181ca600a2a578127471e54c289411000954de75d680fef43301d2747b44a0509ded45704352b035c210c4db6971231dc13bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2801aa3c4a675e87490d7954c9b5b60

SHA1
ceea6dd9f43f2a84b103073d310e10ba3246971b

SHA256
835dfc231dfa16a6e3fb9ee8521d33751ba9550b885e9c40119c8506c23f5b23

SHA512
839c19ecd9cdbebf686d297c5ef06bce594089e9c614d09b1a14b9f3e0510800b851db96a46684c7756a6ed80ba7d522c94f6f12b13b6af89358046da4370172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba094bcb6b1118974c988844555b41c

SHA1
4b7227f9072f2c9733367bee9d5a5af06dd6bab2

SHA256
372f6412a09628c67e2c41fad9b49775a1d22e46e5fc570d11282b7d8727f5aa

SHA512
e8b5d656e7f582e88d2eabd65565c94b8fdef317da0345e71473771a9206e9bd72966697f074b8c01d789ce3fd88c354f7824b62906871bbebc14c0b90df8a5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB55E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6E7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit