9d75c31aaa884a265f3922e394b5e79de242e442a7ed5853cf031c4d8f3a5770

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80b19f56b1fe0f42749e5a387727a8dd_JaffaCakes118.html
Size

42KB
MD5

80b19f56b1fe0f42749e5a387727a8dd
SHA1

74db331c533491504c5bb20e2c6325cf3acb59d9
SHA256

9d75c31aaa884a265f3922e394b5e79de242e442a7ed5853cf031c4d8f3a5770
SHA512

c32f4eed07eb24fac12590b96449ec06b15424483ad4ae253853053a65d37fe4acf4ea3ffe090254db0ca6ebbd10d3d7d3e6dc92244b0085a547fc421306418a
SSDEEP

768:Tm4m/mdmcmDmjmZmFmIm3mSmBQ1XmHd1Mmkmom7mAmpmUmjmUmrmLmjm6mJpX:TxQSjucEMXubcQ1Xed1MbFe/Ujkt0co4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423146665"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4175B51-1DB4-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1300	iexplore.exe
1300	iexplore.exe
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1784	1300	iexplore.exe	28
PID 1300 wrote to memory of 1784	1300	iexplore.exe	28
PID 1300 wrote to memory of 1784	1300	iexplore.exe	28
PID 1300 wrote to memory of 1784	1300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80b19f56b1fe0f42749e5a387727a8dd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0567998322b96745708191334269817

SHA1
2ac1472bd349d27feea8e8d7661964ac764c7c50

SHA256
3924eaad088c1e99c87484f5608d5f677b035bccc8e517797dbe7451026b8b42

SHA512
8e5a56d9bda0973918015a1f0097a5483e05108bb5a4fd104abe944b0983d772cdc0ad6a1d863a0182b19ef38cf21001e5c5af623b1bba073fec91f0a4e70d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
311418c3fbfaee7bbe4b13dfde01dce8

SHA1
0818e850b2b036ebf868ae350cc1df5b4b874924

SHA256
8c84c93c088ef08ba8c5000058f99373628f39d0144f3010e0cb07d24d438319

SHA512
b0ea9bd3dd7dede389c02d09a375d613f2b7cc0471453cb909af96bed4bee7e01194161f95c12b1b2e7c8a0e95e515c4633ee16133f218cd8ce126e26bd62031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0122af3ba838e3860df3427492e3671

SHA1
dfb8086ed9455763a72c68029d6dc83e1bd69f4e

SHA256
dbe939b10b25b48c4a247c86c0e0c7ed0dcf883ecd7c53aa7548fd52989b4cc9

SHA512
f3289e15578b7d5f2c53fee3b57aad626e25ea303e859ce866caa6af71a5189fb65e855a7c62d0d4e4e2e98b14e4e61c6d4e0d7bbc79b24e248e8f9cb633b293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f23afe2ac1479340749fa60cd0964c3

SHA1
3cb291ef8603e97f66368dd7276eb5f56cf8f1f9

SHA256
5de9977f1442f7ce2e486cba5a8116bf99fd4c8ea58b4c73dc2a247cf970b300

SHA512
d0dfc77749a2eb41e37217a8c1930908627fd47cef87cdc698dd56eb7019bd9c352ea68331d80037480bf93d6d5faaebf75a860b7cc7dfcc30364005e76cc9ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16dbe3603313a6672c1d0c9bdcf96d53

SHA1
7aab28c9dda9642e097791105d1bdff17a150658

SHA256
9a6f61d363166a31d7678b5e33e24bbc419b6fe7fc9cb65a13cd0e2f22732518

SHA512
989732a0c27aaf671a9e8a0858cf481092e6a39dd744ccdbe5a2ab204ef9a015bae10c4d7e39642e9f6a165389af7df046b031c9c98e2f9bd9377f24a17188cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3631e57f0ae9b16d0e204de03692c760

SHA1
44542fd90d1602b6cf3715fb29b4422c90282da2

SHA256
ed8bce52930758e889edc7dbd50f9ca2b8d87f1e80c05d7068d295a59919f508

SHA512
a4208cfadf6f9cb6a63d4ada19370e180f44ac8ce1bdd3246d23b238756ab1a97eb2e73cce5dfbc8b39c4dad8d3f043f54a99a9632485ee9b5c2aec3a03519cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1e71d6542d376cef6a52b279b8bd2e7

SHA1
4d0a70c59c7adbbfdb0f4b75d32a9a22c56a74fe

SHA256
5a7531118dbdfd864777ec7775556637b057f377fecef1ed1c85d2ca1c3d9866

SHA512
84e37a6288789b87817e56ccfab079a233db71e26499156b2d00860529d32b339c0c81e11a232a2d6da6a00b829bbf741ed648e9bca6118029bdd66b67d369de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b8906344ac811acd6f3f470d92255ed

SHA1
735461cece89c1e3e3705aa3cddc3a9384b6d370

SHA256
32bd13af55a94e3a2978094494a7f6c059debc27016458d0a7ce855296b0d404

SHA512
71126b17a8c1b8ee71e33e66744f83a48f4b43a627977c8ac1ece699016742e253ee19d9d9259c7d5f8fe6ae6d6feed3a680c3048361fd59c61110e93a78d785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18c0794a92c4d9fb3b24318b4d638162

SHA1
337fe3c7be3a68ae2c325639e93a8ceebff6a27e

SHA256
f379e3a9cfa6866f75a770f1edbdc5308276b60fad98e974345f6809ce6bb91d

SHA512
4719258022e8e864a60c1645342f45a91bf594c2ae563be4e5a27104d89f02e05372dc5511f6e350cc6da6d913caed05c53121e6ce170cfd8079577a55e917c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E2D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8FDA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit