2b19d682766693091559dfac76ed01e052e3a8d87cc2c83cf69711e38721fec6

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79c2808ce15d2083aafa25b5c913fa53_JaffaCakes118.html
Size

31KB
MD5

79c2808ce15d2083aafa25b5c913fa53
SHA1

81fd3d7d4b3bee11f5a12e1363b22343e5800ecf
SHA256

2b19d682766693091559dfac76ed01e052e3a8d87cc2c83cf69711e38721fec6
SHA512

1f4954324bdf3d532259c597f0772f386245d66de7f6ebec08dfcbc2821729c787c8dfb4edd91ea0389540ca809b1e81df62e7560a6b316f0659a0d7911bb4b7
SSDEEP

192:uWPlb5nwhnQjxn5Q/jnQieiNn2ybnQOkEntllnQTbntnQ1MCKA/bLU/IfyINcsi0:bQ/syP4QLuxVP2ZIAlklOT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D552BA1-1C47-11EF-8DB2-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422989564"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
292	IEXPLORE.EXE
292	IEXPLORE.EXE
292	IEXPLORE.EXE
292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 292	2424	iexplore.exe	28
PID 2424 wrote to memory of 292	2424	iexplore.exe	28
PID 2424 wrote to memory of 292	2424	iexplore.exe	28
PID 2424 wrote to memory of 292	2424	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79c2808ce15d2083aafa25b5c913fa53_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
386848132598438c55b4b847e7a40780

SHA1
4324fa4e037921ee2297443f13c6c06ef5873652

SHA256
725016460a81549f7028bb56eed47c4d480dbdee64d0a3aff03095bd79e7e982

SHA512
4c1950589dd3ac5190a9dd4b8793ea780471a65040cb3b37ef57568977fe5f763743de980fdc735489a6d457846ceeeb85ad4e37961542446b26ed3e28af5930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0169c41d36584ca6c9cbad0d3d5ecd5

SHA1
fbae29619676c7c389e2e040ab1f67a0433683eb

SHA256
e18ae08b2bce32bbd115581be38c261ba91f1c61f3f7bbafc496823e221d0401

SHA512
e652bf3657b5a1097eb707728576983166128ae16a7156ef85bd9fa332e66760d4221b1785036403045355941a84619ca313d091d4d9ccf043305aec6dd47b46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fad87074a4e62c4fa47c2cb00886ebf0

SHA1
13e5d1ed692b6c4d15fc5deebfcfc4e0bd4854f8

SHA256
89705f49dd7512c19c6797f30c666dbcb7fe012f4928db2120d53061ac1b4b8b

SHA512
bcbf346195c1956cbbd72bb33a89c9686ccd8c4c16063aa3b2c12ee738d6a3ae00f3b3ac50460d6cfc2df857453105117b18f007c5d817be43fb494a2176cb3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7c09d3ecf36ec5410f8496c997d8ddc

SHA1
2b4961faf5bba20fcdcfa7a066f45dcd80b502a9

SHA256
6cca2447c5c3da140834ec81ef8a02070aba772fd988e7953cbf3a4f04f7c576

SHA512
d76776d819c41a725b3ee0dd0146f3f931f1a6e7508455bc64638fdbc99827a8c56809eb0c437673c1c8c601960e33851fb2d1b9b3e19eb929f53171141d770d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d9b8340e13848fe4097beb4b9376f41

SHA1
b84ff28218b733a5185a84cb77c4167e15f67ef0

SHA256
e26b41df0708b48e8cef9d246a602ac20b6d5822490419501f50ed7e7c4a3aad

SHA512
9fe2017036667f8e49b08aaf1186a88ea9d6265af4125b8ebf99c8c3ba8883ec284f3d5fb0f0c9efb1db430271be6bf70aa11d2bcd22f334f3fbd207e6db6f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
389ec68abbefee6354e2011a99e4be50

SHA1
2718436e15d1bae09469b2143ce9ad6559567fc7

SHA256
4b7663140883b6e6408d42ab1325e1378d3ac57fea383d8c406ac2359533acfa

SHA512
1334d3bc2fa24b6dc4c4da4b71f8798bae5706af6ce0c526550b6ca3597f456cbc96f0c47bf5fc7c0c6a5b279a525cb581e76cb7a80b6a1bd71b118d8da12f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01b567bcf628ab87ceb671982e96db43

SHA1
07982ee327c56b269789f6fb73bed331cf56697c

SHA256
2f90bdd469d2c1c4a7e91e01f2bcf426bb7376e52d450b91403fbafa76128975

SHA512
d9000d6ba62648c0dc95066bd5e85ef2e2e91591b3c3da82c197b93bb2a368f565815a4e46fa044d7261b6726ad588ae1573e229123c7fef0d60768c1008fc8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1101b57e1321e109f262cd48345d1760

SHA1
1264c323eb0441aa67f5370a7ce9c891d62c82b2

SHA256
72781285b9bc15b70f777c478861b3f93abb7033d44cd01b5b2f6bc2ce55db17

SHA512
c674587f2aa737a06afbf21d66fcd1007c7ac95f50b3c8b71e24c31d151532ed19dbf8ab3098e1ad63af1b5c54736ce907fb39efc96fadfff508dc6f91fbc450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f178b02ac7e64a1344e7fc0b30a095f0

SHA1
ad42f8db4ba89a2119aa639425b1707f93694c1c

SHA256
38bcd3afbc4ad7da457f1892c78a6c26576cd31454bfe9544ae270790c8bdc74

SHA512
61061c1ba94a54fe9176f91c57b66b7f0135263642ae757da5836c26e5fa18d2e07c0d4b0d0a49772586353e64392f0bed5fe4be0b6481b31ae4510007aec118

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab209D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar210D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit