0d8641329fc0050b3ff2a2c95c451bc023ebac434423da6d71e8955359589346

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81615010886149f1ea8804672e796e1e_JaffaCakes118.html
Size

36KB
MD5

81615010886149f1ea8804672e796e1e
SHA1

0bc0425fdf93fea6f9125976d106a1dbec9ed1b6
SHA256

0d8641329fc0050b3ff2a2c95c451bc023ebac434423da6d71e8955359589346
SHA512

ff88a8b75ef6802d061d0328fdc50cc9f5b02abfe4e4bf961c30defa18020d00a827602f77033104f39beea46e2a027feda98b419b22fe0cb14546415be63c52
SSDEEP

768:IbzgI7gCyUCZfAFNmlY+KUnjPWB9bfu2Nldk2:IbzgI7gCy/ZoFQlY+KUnjPWB9bfu2NlF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CD77691-1DE4-11EF-B04F-52AF0AAB4D51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423167186"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1844	iexplore.exe
1844	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2980	1844	iexplore.exe	28
PID 1844 wrote to memory of 2980	1844	iexplore.exe	28
PID 1844 wrote to memory of 2980	1844	iexplore.exe	28
PID 1844 wrote to memory of 2980	1844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81615010886149f1ea8804672e796e1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
828ee47cca15b61b5a6e564ae425beab

SHA1
87e77b0ccdc9c6ebeaee554134e60268aa5c981a

SHA256
1d7ec02c8de69ebff03f147d504edbac5f1e686e2a13af251824ad8c10b711f8

SHA512
52384f52c7efb4dd6f1e01afbf97059974ee55b70009ec70a4f2c5acf0ee855c4199bd1048e16fed55ed39b7049980e17ac382cf060bee4f67c738769976fc5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba20d76e832e8aa977f18c04ca8bb16a

SHA1
cd7a3f061fbdca13337d4af94440df3358a9d2e3

SHA256
37b66a06612c6ef314b5a73a86678e05a953d78100a5b7e7dcb7ee583455bc65

SHA512
92fd96555d9b426c3eeae781f8b794b576f39d002380ce1f5fb63aac0b5992b6845007ceb94856457fae70548bd30c56773b78c34f572af79fc242b2034fca61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8e1451e23f830b33367e79315d23ca0

SHA1
efdb12457358d723d6531b8bcbb066ef1dfa61b6

SHA256
dae1d7fba2dd7227d2b988a47217c9018367e6d53533209bcdb04368913f10db

SHA512
0ea36c08d86acd41e47d40fbe397c9a754fa117e061e6d784f55f99673f196a83369c035d9145f37641e495bf7cbc3243ac1f15303e36ed3af8abb51871ccbd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1efcd14ac9c5384db6bb64f2fd745f17

SHA1
9e4d0c9ac1e0d8d0c993daec20deeb9769cb8807

SHA256
5666dea2b06a73e543702bd1d10c91d65add59aff4d217df610a0c5a8caa6347

SHA512
a32fccf6d69660ec4f8412e338e16d93546af66b5585612e0956009be76d048a86b79df28d1d6c8016aa6eda836628110d6159d0a0f2d1ad14d9330a0b3caf0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c5254ce4097465306e503dab104c393

SHA1
a730f6f606683b644b64f0db1aefea8748628d9b

SHA256
1308d6d8c4c5ef2ca69ed8599354ab6227a6bccebe7b2b1768dd8a1e18c60fe4

SHA512
41cd148367451fe57d1fd8a04154e922411460356e49c78e6a326f21150007d5f4f8e750a91c93167a77af6a94e1113dbc4db17733b86e13818e87412ae6ca2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1360f2f127f3c9d193d5600ebf70df5c

SHA1
c85e841d5675eba158a08568803da19f3f60b451

SHA256
9a9bf780d8cd3d777f5d2c306e3208250fd14c43cc345d7ec05449c92311f8d8

SHA512
77007a53cfc5d04c8db3fcd1e6c0a2452514e2e56acc2d7ae48e80801f8e914947335801d57515ea7de9bfd3c6ba1b54a9b91552e9bcad104d2b82716138b0e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
775404b1f963d3cd55e0b0ef337ce740

SHA1
5a019d1e3211b5c184a6b1b768c1aa521c73ff72

SHA256
c8a2a4f0d741fb2e2388642ee41e6da5d57efa58a30b2dc9a56c2903827d5246

SHA512
7dd4bc284c50f07a4cdf2903f157969f0893d7a2d50145be2cc67ec4c5a186feb6e4aebe4b8016957c709692a7cbd17e0c3d8bd6239b8623daac80bcd002d214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd05e9e12813af537a83eba439d95c97

SHA1
92ae9c4f2ca376b46c7379a9b317fcb50718abdc

SHA256
fbcaa184de3584b055fd125642abe103ca113a9d2b3ec01d3d8664e870bcdb7d

SHA512
3374e59c0031f811ac4998f964e1e19f180290e2e17fb38853cb909b541cf5e86d8595a347fecea8ba74f153f6ceb0c29eaa08eb548e01fafef19c82a4fea775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
810004d2a12149b2ce807c6216b0df89

SHA1
9f7156a27120f10b6cf94a4ae7e3f1b08a88267e

SHA256
f4120aacdfdeed788d64cbca594469b924bf7c812eee78d3e00ca4be041220d5

SHA512
e91307915e320c39e1640c68dcd58427684f5e83dec996f1a46e1e43e30647ce00fae59470a73b634db88afe86f4f95f40977905b41c7f371aced059bc0f9486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
684f77011a5e54d1c8e365ad4a57b03d

SHA1
07765daefba97d368fc9d8af1ac02e489145f5fc

SHA256
3b5ae80fb4ef5f9904a4447cc7c5f78c3ad0b98e222d65dd17c78ed6099dd104

SHA512
a869c33d6e4f39675e57ad8d71fec3463aeb3708dc4bd27c42aef2636baa904afa749f65a1ae04dffc3727c9551f76f1e193374748d0c3d4217bbb0fff1cde91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CA7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D59.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit