0040f1adf7b9b0263ed51fbdc0df203c0283123c8f2285ecba77a23d9bf1fb09

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

809b0ecf6a672635681d686f7b51e3c6_JaffaCakes118.html
Size

27KB
MD5

809b0ecf6a672635681d686f7b51e3c6
SHA1

7c23e21deb696e1d50176d0b8ca0efafbce43cc3
SHA256

0040f1adf7b9b0263ed51fbdc0df203c0283123c8f2285ecba77a23d9bf1fb09
SHA512

13557fcc5e109c4500712bc99bec72654f73855aa66358d9ccb55b1e2ef7ccf2f2a4859142a9a058087f3f6f3a956ec9f90d7e9895c206aec644cec015ac00cb
SSDEEP

192:uwPEb5n8qnQjxn5Q/XnQieuNnCnQOkEntJxnQTbntnQ9eoem6uhOYQl7MBOqnYnH:1Q/upWMOrSMYod

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3594741-1DAF-11EF-A296-4A24C526E2E4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423144543"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 1984	2784	iexplore.exe	28
PID 2784 wrote to memory of 1984	2784	iexplore.exe	28
PID 2784 wrote to memory of 1984	2784	iexplore.exe	28
PID 2784 wrote to memory of 1984	2784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\809b0ecf6a672635681d686f7b51e3c6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0785d5ce36004401a428cea2be0f418

SHA1
79b306a2d8a7d8cdcd56d768e33c68a8fe7d1956

SHA256
ef04760b506aa6ae95bc7d7126236de7ae0cce91dfb8d7631c2c73aa65a12995

SHA512
30d76e2c9da5d1f4f7736b955ff89d08cc52de476ab475c16a3594f563e893d07ff39d88724377807fc9d3be8871f52e47dc6eecb00fdf7639ed3991ae884cae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3af62c8fc9ec94750311afe90deea9db

SHA1
fe6c7d1927a32c6def0e32629d6dcb4b473b56f1

SHA256
caf18d049a564cc9e7cb33ce937eda16ae585a84a6d8d994d07c5bb27f49b065

SHA512
c97faf54aae91cf3c6f2e8d5893e85fa5997ae71ee1be4f2945473790096c52f31fd366b7cd5d3f793da1fd7f185a220a920a73c3b361084b6ea846c1e2b7fbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61c668aef11033bd50c98baa00fa81d2

SHA1
0a4895f06c0719c538f827e1f13e07b2dd68e21c

SHA256
669a82709daffd2186f07a94e47ecf324c7b7709144586bbd06128f80ebd3737

SHA512
b9dc3bbb0ddd545dddd8e6aa864d97c0f3d703367103b514b8689cf03ff3458ed021bb7455776e93a315aaaf0ff2039e08ae51976de34468077b2072a439bd2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb71ec28a332838a535a5f67089c74d

SHA1
98619ef64de57128d71d6d8ad83ffc7d0c4ba255

SHA256
bfbff997b720d542fc8357c2f8b76fbf0c450afec8255be489a8c0863e5265f9

SHA512
39d61c8b89da91e309e21f185a91a453cca2a2122ce6e8d777663281460b07e309102ab6ba180335126e742b46ac5f114e3a8030b5417a3f0678c4cfc2f4c3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f5744561f21b16ab05575a9dabd671a

SHA1
b10b617cbaa9ac1c21c31ad3d36e4ec5d7c64e1a

SHA256
84f29871cc6865486221423ec9905db6264be8ded0f6ee65d760a1497383f2ca

SHA512
04f94f1f44dd22ceb2a20575f81a295452d3ab903ca19420f963408c3f335df0d5d3fb8e57cd9fcb114b20c8a445c920fde4a65332282b0797af999ed67fd05b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2669aac52fe134d1b38357b563dd1072

SHA1
fbd89fa1ff4846419e42749b57bf827a1d1aace2

SHA256
d74750373ae25f0be3452a90cc3570801e220327e7546988fff1d76e9963dfbf

SHA512
b8fc1d43fe6cbec3253527f62add1b0f4c8d76dd4cd7516649e9014b478b8b6f362f617c8730baddcd0fd7a2fc36ee285de14ab5c97646f4ddc1138623f95959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88c987bde6031bb7b3b6f80bdb54dea8

SHA1
9dab131d08d0c707975f352f5d31163a851aca68

SHA256
259038a24ec6b4c6ac8d92529b2999bb8ce2973dd2c365681ee8e5bfdd76e1ae

SHA512
2261e22a4b07b9eada36a3aa8c2d148339f50a12865add1a1bb7aa09dcd609b3174e93cb3f3e03266507b79d582b609a6872bd73916d6bf6760e37ac39e8e9e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e09e695676938b0643c28a7d8bbd83a8

SHA1
04e598323df049480b5c797237343d530c913444

SHA256
d2a621760d106b9c19efa45b4054704ad2edd8be26f53e63c037b6c762553fcb

SHA512
41854c257c39bbd1937ac5d49c13388f0e27ffe0ff6af281722dae2269a21938cd5116a8a81e9084f74b04270ab9ae51f2ebb750521607c12dd7c8342937fc6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ee186e748b0331ca92fd68a0990d6d5

SHA1
258b4606aef47c2bb7667766ed1a3ba58ef79915

SHA256
cc76e4ba2ae1f9f759d450706dc74928394e92a56119c256b7357f626e6bc458

SHA512
9d3f7c4254414c5caefdedaa7c74b69d7120bba1f373fa64f7d23c4d4494e0fa50328f1518722953516e52182d3518dc55e6d461824a96c167098268dafa8b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AB4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B96.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit