bfd2fc3ff8f535b9e5bb85203190745cf45baa4dee4eda536f524b9d151be66a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80d0a0a7f17139f0f08c90dc0fbc3051_JaffaCakes118.html
Size

43KB
MD5

80d0a0a7f17139f0f08c90dc0fbc3051
SHA1

777e2e91793b5b081b8b72df77d0740ee4aa46ec
SHA256

bfd2fc3ff8f535b9e5bb85203190745cf45baa4dee4eda536f524b9d151be66a
SHA512

b5cce33d1510771492456bb53021c5b6abbb3fb43c54110889cbbec1d310b3e972d140e7d719f958c46f051d9464f62ba5c6628309cc032aa4618c58caabd112
SSDEEP

768:1I+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGslstGFOs/wOen+:K+vt+0U+v5ikH/iOgOiFnYOv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34CB5771-1DBB-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423149403"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3056	2836	iexplore.exe	28
PID 2836 wrote to memory of 3056	2836	iexplore.exe	28
PID 2836 wrote to memory of 3056	2836	iexplore.exe	28
PID 2836 wrote to memory of 3056	2836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80d0a0a7f17139f0f08c90dc0fbc3051_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de5068d7660166ca1ed2f761c146dc3e

SHA1
0761758ca97ae0b3c884cb83b323c73ab9644884

SHA256
7e002f4679981d1a06311c1a92d131018ca3f89c03683cb7f80eca1e5dad08f2

SHA512
8b46db62594bd4ab174afee86f3945be56d871970b9cdddad1749ec0a87722c13f4cbd62e910eb0c5552a7830a832a320037e004653c0e3c08ed8f599ec0cc19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56c0e454808eff684be74f2b4c4e44b4

SHA1
ad90f147fae3aecc23a22d5cb61b251c63f2dff2

SHA256
81972c2fd762d65bca172414ea1daa0182848c4a91a13071f256808e6623084f

SHA512
051a5390da7508f4358cfa3898b60a8dc9d93b1f5c0a45373f1c9f762cb6bcc58d829803be62ce3ba9f65bedca7f39fc579a73158cc9700fd0f30621f3ba2f3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68d1b9a347aaf04d764248c8a41e2343

SHA1
b6f7d992cb5c158f5231cab482e962f5c57ad859

SHA256
9504f6da2b3e5bf57d9783681dd4f44d7506f26b7a4354f45eff362e62ed2985

SHA512
eb11c642e885fc4c67f4954a54bde1a669817052d56b534e0083a062c6d78c51895bc7c1cefac2ad8908b64e13c475fd35689fb1783e8be857e32885a4ab8665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
358563647f2cde407d3c71d3e556b949

SHA1
3ca406b195b0e4748e7d39d9865c59d44ae201a6

SHA256
80a679bd39ec0f7c020d9445f5ed42dc1286181af3a9a8704c99913dd1f9eebe

SHA512
c57641c22a10feb5b7a6892a39bdbb98c63e988eb9da8364b227d058068ce512439ec7dde97c7de960574aadfe209695d94b5ef1340cbeee2f6a0fa194948927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1a65c80a6c88b0ced9a7148eb44d2d1

SHA1
e0d542c53a6d770907ca27971d5752b0952a55ca

SHA256
73e82ce7f91cd58a98e785a009f064dc59921204a2cf212ed61f8ebf0b1de2dc

SHA512
50a72671435786dc9c9ed7db364a0769cf57accdad54472fd336c4c5c273e1d8b6a0422e3fe4b2290db352a380d9d5e8e9e3ace3105da3e039f26aedf874e722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f961d33de80a88978f9fab6adb47e529

SHA1
53ad6afb18218b50a2eceede983917bbe51e497d

SHA256
8cab9126f78b0b21a5f49dc19e6794ef9b6151deec13ee798743aaff42b88a0f

SHA512
ac7bb8c7bef0fb71d762168daaae9795907a3e0023894b5b202d221507e1442292ce37693f6c3c9602447e04ce2bbb682e93a713b6d32e6949e6a001aac2b561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aad1ec4d79fb29fd34ee53fa62731307

SHA1
f7d2a30cef5aa646a6e55165e5b6e351676da4a0

SHA256
01172eca21fb56c6b9dc80644dff7614a65e70276d5216af530ac30f3387671b

SHA512
79ff2f7e37e28a5cca7c627826afafc2813888582e5998d6ea1e55d8989d081567277bbe8231c44b2b4ea2239711cfe8390b45a08867c6c68fbcbfbe814b7dbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ddbd8be4b382f330c245f7a6b5effba

SHA1
95712495355e9d9d0b357c4f0532b8942d3cba22

SHA256
716afe0800c520200fbda6eb4aea3386e53ee9e83cc64ebd8462024227941ec8

SHA512
ffaff71e46436b1f2071ed9937322fdffaa30c65241b8224185b98cf912673d47fc8d1d861587634f90ca6bc00ae8173b70bdea733571ecbfadd7d8ac37de337

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EF7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2027.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit