981cc02b088a6d0d3372a9f0a0149052ab430ec15a6ee75d2bcddf354c192048

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 09:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

78b131c3b4f1621ae884e8c87e4c6da3_JaffaCakes118.html
Size

27KB
MD5

78b131c3b4f1621ae884e8c87e4c6da3
SHA1

ae3d375755babb64d954bcbd39b25424f0b1ee1f
SHA256

981cc02b088a6d0d3372a9f0a0149052ab430ec15a6ee75d2bcddf354c192048
SHA512

9a76c18453b46ba52251e94d402a091b07d5e85c9142eb8c8c20b0701f24d0081449ecef186db4fb6505ba6a207c9ab7a310d210d7c9553f5216ac517545ed0c
SSDEEP

192:uqGr3cb5nNqvEnQjxn5Q/pnQiesNnknQOkEntDPnQTbnpnQ2CLtJVevo7NtvFo+Y:neQ/PIgc0qK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422964340"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51F4DD91-1C0C-11EF-A692-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78b131c3b4f1621ae884e8c87e4c6da3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d393d92ab8209d3cdaf105a850b2670

SHA1
4c974a65942bb8af01425df6325e9b0c5ec35ba8

SHA256
cc089c0a9472adb3421aec3c18dc338de34d1e95126154dddea6fe52f59dde0b

SHA512
c981ae8f2b5e27ca2d4c72287f3b4992f98ee1e5cd63f8dcf078176f0a99df2372014911ae26dedb85d836f24d8bc0b7a0c7628ee0818211e476d1e9e26d44c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
759e730beea2ab6bd5dc47e1d2de7c88

SHA1
1f1e5a82c4b12dce5e71557870759362ac3b2393

SHA256
8922c55f241a0d51ef098b70ec6f59ee6bcf08c4e267fb3268e2a2fd9a193853

SHA512
8a884782d5293f476990a79480d6bcb1a0f55ece174c94e91adf3146d33d8710a41c3e3aec63e55411b82f8853236de233be147d5043f78ab2c8aa328bc61f12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa89a0f79ccddc871e709f850307a6f1

SHA1
fb600b5713eab0ac6c781da0c66792722870b5c3

SHA256
69165b9ff848a2788625b9a40ab94bbeb48af2aed3ff7f014714a4f039f47f32

SHA512
8cfedecdd939c25cf0cb8aa03744f7a964c0922d34750e05e5b71d372dcff3dc76d93f0e30ba16ba26bbea8acf95240047cefd68f66c4d25872ae3ea41187707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b109c8218f434c02c0fe37baf26bf5c0

SHA1
b82e0195d0831249b5361bff1b038a208bacd378

SHA256
ac4bcbc0e3111c1ac23df4a57ef0f2d26cabdb3b6bf9e0aaa12df2024f2b7a61

SHA512
2ad4bddd80ce3197838f023c9db65581992a398c1adc1e4889d0269b6d9c96cf1e9f925afe0da1c665fa80dd38061f593db88c8566abb7862283b0badb4cbec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bf6239da94d8662d211f5f4441d2f48

SHA1
8158a5942bec734cffceb28cb13794d0e7295b3e

SHA256
87ae428965dc1e69bd1202ba8c8af94d595e8499dd95f1dd771972d1843b1cdb

SHA512
d6ba56dead0fd1412a33cb66561db9105f69bdf36c9545de7257bd4baafdcbdc251d932fd0dc295995705ec0e91296cd0491002448593b4265550563df5d6d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e14dd6143b7aa07e27a9aa1d223bd4b4

SHA1
087f817ffbcff03ec7a6c5c5547a50598f1fe845

SHA256
19e28c2bc6454b23918759c68337d77ec22d42b0d31cf7c63b7471c6ecf608cd

SHA512
5d981c3fe818e5820c513afd23c0e93ca223a34f27c2ea41cbde318a3467cde58eb7909a23553b0ee5655c7bde9552176860a98d7262b743fd2d23774822ce23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4a1e54ae34464bbfa72b533266375e6

SHA1
33b8397b2329d7f4d19eb6fc63c32b764e7e075b

SHA256
7d51d5746b7b38b7b3543a7f7b2331c016e0b58d2dca756fccdbbfc6a23e1b31

SHA512
b6db3e63d2bc28de496f48857a8f3c78e8541f3751eec3bf3db5653d1c65ac773eb413f03f3b87a670e26027edeed5bb24656d24faee3a4d36dc89fa23e70e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68050d1d2bfde02492096911cd7ef64f

SHA1
a5d537fca09399f7dcf4698d84786374529596de

SHA256
588f121653a0dc04e31999956c7eabec9a0cec9bb3dd76d6a1f3eaa718a3e08d

SHA512
b378d3f7ba0f651b576b90ddfc382998718cf5be37c312eaa6777374bb71c894b8797c09da06f7183354fefd43e7294061455abdd3b1dad475a8572957540e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2660b7c48c6730bd14f9cb9adac3b682

SHA1
0dc01667740d8df2ff4bd97940c0032c2db2ad95

SHA256
c0c2deea29c814832ba6d02672d35925cedc9fd9e9b953ecf9523c82a90def95

SHA512
3c798fb77de685209ccbc4642a3ce26a861655824895edb422681cc48a10a2f1c7f30d797b985cd54ebf651f9d6ff3ebffe6d115df5157101ea0937b2694a88f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6DE0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6FEC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit