064d9c440dd9fb6b054f0239586039fd6cb81567faf6eefe931bc7f01b3d1f1d

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6381767973434691bc012e65019b241c_JaffaCakes118.html
Size

221KB
MD5

6381767973434691bc012e65019b241c
SHA1

5469ed2b4bf50894bedfccde8286b23472299ea5
SHA256

064d9c440dd9fb6b054f0239586039fd6cb81567faf6eefe931bc7f01b3d1f1d
SHA512

bed45fed07d1fffde61339d1c1a8c590d04ed2f87b48ef0981b97e89b295709767c4656f4b8ea3576976386b1b4bd16131398f364c47a15ce489b9636bb7a539
SSDEEP

3072:STReMcX8iDE65zFxHyfkMY+BES09JXAnyrZalI+YQ:STMN8SEUFssMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422461205"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8DB6511-1778-11EF-A4EE-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2792	iexplore.exe
2792	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1272	2792	iexplore.exe	28
PID 2792 wrote to memory of 1272	2792	iexplore.exe	28
PID 2792 wrote to memory of 1272	2792	iexplore.exe	28
PID 2792 wrote to memory of 1272	2792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6381767973434691bc012e65019b241c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32bad115e3e84e063d7296a380a416c1

SHA1
07911058c1f0ba2e13d5baf83424f82be2d0430f

SHA256
e6d533133b03fe45f9e3e0ed0a2419409e2e71095f630d867889fe0cce495a94

SHA512
194f2dfd8067fd0c55ae0f40617c4fafcb881b5ac7f7cd66fb1467c9aa4c1ce7d67de613924692ea766c171522461d32a56e353d756ff903fcdab675398b8659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26139fbe24d3d040c2f1c9935812aa3b

SHA1
ee5fcfddf5da95bead0d302a5efdc045f3058219

SHA256
e6ac84e5cf24fa2bed7ac212f971525a66fd2ec742595c6aaa0f47be0f725a6a

SHA512
51026e3a0fdff4ee98e1625049377029b1fc6c2da6aac552e29cc8550603ddd2c384676169c4035ce99b486eef2a507efd9a6a25934318a1a42642256f1e902c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dbc25e293d8627a5a15955f21d5da3c

SHA1
3d3cffd6a206a4f8cc685e3949efca79c60bb475

SHA256
f48cbd3f5c97514370d31795fa9d03645e503b3e76da3c8ba070a269c69a05d1

SHA512
0c16981885036ff1540d310a889061b0e28fb9b6d308cd75700facc53a2e76919c4d9921f667d4856a6c35a1fc58c94751387a71434ae1ab706b57f5dd66931f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60f4cfec4768b1c04118bd7b94bb2b7e

SHA1
497329d0e70ca5238c2db71b53cb53b8f427154b

SHA256
55ec43dfa933e6974da67207850a6da673b99d80c70a7ed38a2683fdab40d4f0

SHA512
9cbe80f5d0ab51cb82285178260ebc89ea0c400c4fc6e5d6a40296724b8b3bd8761abb50a3679303a961fb2f6ca2034a40b695fcad955b57b2fae6a39dc4d5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ac415b42ce406dc7725c30e4f5b93dd

SHA1
bae9a40c7995491f5a76ab4b4e6312f3d1c47883

SHA256
678cb4d1fddd3cbc1a9211462ea2efba6a525c3931dbf217c2f83153b4efa67c

SHA512
d044ae4a9eb1dc801bd3b3ae2613ebda75492a4c48185b8d37ad253de32d3a3d602f97d12988a9599c946737acf24cccfb2c5ea0578147cc629054e8a2e18e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
547d5e403aa02077b153b0eb10e0ded2

SHA1
55dc36c24dd1f1259b884ee5a520a2f84374e39e

SHA256
5b7df2114d6c9949b87fe2e97e4994672cda2c8e8e129a0395f48442aa78082e

SHA512
87545cea52ce9a6a1e5beaa17a81f1b5148d30eff381b9e47b55ea359919a794e9730511e439d107cb0efbeb9554212251200389cf5db111c882f50d22d32f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
143d82b9fd9a0c58eed36d08728899cf

SHA1
a0902e9ede9a15bb99d91f1d6ec6336f856776be

SHA256
217281ff04a90818b5b440dcc6278810582229cdfb2f37e72a2b6610fc728e5d

SHA512
0bc7a626f67067a1e839f2372f641e1225e30d67fd4effeca28a3457a2d8a669082d06b41edc4a1ca9fc42b3c9e8310260c47a93275851083052064c674ec5cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f1bf88469f18b290aea3c2bcc6f4dee

SHA1
a5cb0e00f7e19520aca99d696e6feb56e82d00d3

SHA256
3b564958e3e4cf20e9df50820445ca6bddf90b65affb981ea64ef4602ddc1943

SHA512
8d0b05dbebc5de018805a3e79f238e72c98bf2d55347b96258d463eed78f691c1a79869c8d0e2259e414906c429ed230dedd5a0bde0fe496da579771bd973b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1b8fc17d81d1ce0d57f94a105923e5a

SHA1
59d017f2cf1347af6a31ec0b5416ab9b5d883f8b

SHA256
f904adb8f1fe8341b116c4abff97460d3be92fda15c6394e5203aa2a443521c2

SHA512
d3462e25a6ca7726231d60c4d99bc6e144333b75213738f74002c11cd189780d18e249642e4cb422a4dba9fdf7f3516a0caccad77b8d93ec1103f687f70d7020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dd2da3b590a1e1767fb736fcec036e7

SHA1
105f988be4285a954424cab02b6c35f6cec5fb94

SHA256
4bc4d97a1eb6bbbd8ce6288556070e9861adfd943ba4c2c4de7fad1b667842bc

SHA512
2be74a293e7f0492c195d8af52da717367d2ff779bafda03b1f20e8a1188df81c438aff37e229fe6123304297c99e0c587505e059843c123791d2d10516bb0ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D20.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit