2b5d47802469c8a8ef567f7e1ad39914b706268572734f106c91d1eec49b269c

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73da25861d87a8c10e784ab175af6d63_JaffaCakes118.html
Size

31KB
MD5

73da25861d87a8c10e784ab175af6d63
SHA1

82c0b50d531e6be2d534bacad2b7bdf4b69f89b9
SHA256

2b5d47802469c8a8ef567f7e1ad39914b706268572734f106c91d1eec49b269c
SHA512

8ce6aeb18a08961a596965b8dd35385d8ce84a38f3665172372a5aef32675ae4ad0e533b4e5c047d6ca6fc12361108f83467fa32ac1d5ccd8b7ec284aaeea8ed
SSDEEP

192:VWCk3GDG7GSFGNGeWqGUpGtqhyrRb5nfqnQjxn5Q/2nQieFNninQOkEntiEnQTb6:ACk3GDG7GaGNG9qG8GtZQ/SWS0SQ/jzO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422847383"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02D1B7D1-1AFC-11EF-BB1E-6A387CD8C53E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1868	iexplore.exe
1868	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2584	1868	iexplore.exe	28
PID 1868 wrote to memory of 2584	1868	iexplore.exe	28
PID 1868 wrote to memory of 2584	1868	iexplore.exe	28
PID 1868 wrote to memory of 2584	1868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73da25861d87a8c10e784ab175af6d63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ccb8141f0468d49674edbc1444873ce

SHA1
8bea238c7adc0d8f7b0f824897a196e4ade90a2f

SHA256
7e8c456e8d3955f632d049c0a95c592633a6fea4bf10424292c622d38680682a

SHA512
ceaad00675a166ecca651799f3c46ede8057f9aec94b2a553626605219461c58d69f8ec93990610b8e1fc799998b933e0fecd56e4f821dc84360854798e4477a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b65fd73e0d1c6a77b79218ef8a12dc91

SHA1
736309a49377701bb3ea5f75f52fa96c6af6ec40

SHA256
021e9c8d6c090660fb0b9a0e0452dc99b38cdb992754ae1b5654db583b976f27

SHA512
5ff1bab0012cb917847db855a6933f8d476c05bef3b54cce3ca69167b3e6e470b7819e681537efc84bb476dcebbae377c589c941a2eb1637fdfe3c4e9592afec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da532cf5c8a474946eb6fa00c467a437

SHA1
f16a42659932c11412ccd9531d3231b004b16bd1

SHA256
535edfee4949d03eee03f3484305e820053e3f794b4247851e9e07b161d2605a

SHA512
a54fb5ca38b12c04bc835c908016bda7f66fc4306ce9f22150f337ec7575546cf882047e948fa8e7780d26dcfba3988639243112a49fd451e1165f895c8ad23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21098484bffb2a867460c57b1ae023d5

SHA1
2fe07220f59c2737162a62adfc325b0c8887d4fc

SHA256
8af6f93dde40bbb528146152ea76821cc2067901b02c797f5e54e3c068190ff6

SHA512
2f9364ccdde0429a14683106211a41e7e3fd236513da6f95ec81a81c1649523a4178e3d34855c4e9bbf8ea437e120d8f3917b0b9e19f083a8ac5b538888731dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803a393b5232505d88e1dd07f556ecee

SHA1
df0e438d68f031eb41da992c9e1df0917928a123

SHA256
70428fa1d51dcea3836ff764471d1e06478649d8569f427152dc0ab4019c0fda

SHA512
530ab648396293bd0295f02dcb350f5dbd0f7496c02bd4c5b322a6db24f803b3822970f1741cb629953175bccccdfa9c6b1e1a310920cc0194f51c7506e1c082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4659ab53f6181e4c2d147285ead8a4af

SHA1
14c0c7b81634dd7dd6f3a5fd8c1d324ff2fe4e4e

SHA256
28cf6d735ca2c48f5405ec923f4d67756d2512c6c4c5902df785e2ba2cad72a9

SHA512
573bbe7bbf3a59ae4e96c7320c7b524ee71c921c101a280e100827f3e3cb1b57173f6eb434a5c7b5097dda2f14a7df08a61ee547934acbcad4e0a8799df6bcfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5618258bd218f155cfa9b1292635e8cd

SHA1
efc027ca733292c055aa7ebf50cc59ac7875d609

SHA256
e6d8b4f02c623611a39390cfb92e54d9abb7f997ce261981fa2fa5255fd270a6

SHA512
8615d9c0da099c7ef589f2763f718a86245f8e8a3b2e54858c7f07dc627b7c9ea718cee7c13364ea7a95b6bc148cb189fb70f9236e9c1fa67b707e7449fe5738

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1096.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10E7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit