3d059f968497747f6e7cac0651beca91f7c56dbb986e185149822e9429dcdae1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81d07ec52ff484bd5ba3fbe420401fe8_JaffaCakes118.html
Size

35KB
MD5

81d07ec52ff484bd5ba3fbe420401fe8
SHA1

2b3d62e994ef08b0f4bd4b023991abc30899703c
SHA256

3d059f968497747f6e7cac0651beca91f7c56dbb986e185149822e9429dcdae1
SHA512

879ac0404823d13d2b86b5d860cc2ce12db9c1936fa2b1d7db707a301cc6d42678b901703d700fd01989a60bbf397b3110971093ffde559f9bc2929c36271ea7
SSDEEP

192:uw/Rb5njmnQjxn5Q/anQieRNn4nQOkEntusnQTbnxnQOgMAcwqYVZcwqYzEfcwq/:HQ/1hNqF9ldJ9bQHbLjdO8/FFxpLY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423176255"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9CAA371-1DF9-11EF-9ED8-52FE85537310} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2508	2700	iexplore.exe	28
PID 2700 wrote to memory of 2508	2700	iexplore.exe	28
PID 2700 wrote to memory of 2508	2700	iexplore.exe	28
PID 2700 wrote to memory of 2508	2700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81d07ec52ff484bd5ba3fbe420401fe8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e1b3993d3ce59a7ade718305750cdfe

SHA1
079896d69fe588d760892c34b1a3ac1e043fdd47

SHA256
f2156f9e82b53ea4a241918f2e05bb54c8ad0f5e9e8ad7346cff1db3d7756986

SHA512
7956d00f1bfd9f84bcbdff042a4fca2617339d49d1ba2153eac00980099761344cf0fcf6e6d74b5adb94c9c66e3930a865e85a8e5d0239d927bd74f5150b89ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23ea1e2dc1809f635f9844083708ef6a

SHA1
a4ec4ab40cc2f95c8e3e92980e1379d73d576c75

SHA256
a4bb8127bb9a468e82610c2bb5e62102894b126626fdf11ea835284e78802100

SHA512
de3809514bcc3d4b687d5526e5e11068f5eb2d3e4f9c6126786844e81ab28f56bdb549bc9a3d638ff46a925c56dd31bcebb67497f410ff32576c52c8d2bddea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3e9de058a6e11d06d9de46959e7024d

SHA1
3f8cbb142d331e8e590d18300447966cf2216cde

SHA256
0d17627e2d20d4d49279fe5bbc8c7eb93fa69098b4051a4282171598eab6b120

SHA512
607510252c85b394310d97c25f366983a49d6a6f07311c2099de3276548f17133b79aeca984a9a144370b8d886925e99b7f5cea6761e4d27396c8408d4da425f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bfbe60b76b05df8607fbd5fa17f402f

SHA1
701431bf5bd223d6b83d0c49b166ca7f3b188aa7

SHA256
464e28a0975b244b1b821299af39abfd5efe0f707feea358f1bdbb9e7c4b3143

SHA512
cd898cda348abe34d9c5be60a85332a8dd8b2cc9e7e57d78d1cd8b9f20ca2b23008916bd01af4d0b6c56c88c99f32d0267728b6d1e8bf4d50d5a2dfac763cae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50d6977d83ce3a10c5d6f633771a38c0

SHA1
f24b23bb774fddcbea28a74e396a60846665c918

SHA256
a5fcf7d10a7ca59dd5c207a413dda7ec13ac94f914a34b278b4352a1e52093ba

SHA512
5ab060efda1ad13160a1db12d46b2ff6c953ab8d3b5e32fe3cf29c4d193a6ee8a178b3c2cc82594ecd982770140e5fd3c0dc41b992540031b1b309a34c4d2191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
198afbc36a91714a020d2bfe3aa2e267

SHA1
177b1689f0b0dbcb9f4c672b4c85513002b7d3dc

SHA256
14a1f5f0fcb42c95dbb3363611491a7b59669aa5d289dec69f942ae06eebaa01

SHA512
3dbb9a1766516c632e1dd8b33ef0c0274dac2b0b9b836aabf4436dfa13b639f7907661697ec58ceab49b4ff2e38568315dd1dbf4a7620a25871a36cb93c40d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4452cf0aae9083413922795be27e4793

SHA1
7009247bf32ce1cd1a54870856b9d3c5dcb7eed8

SHA256
7cced3ebe05802a31cf79b2b6b58e1ca0da441980a884f203735bb981cf26d54

SHA512
97b18a260a257ffdabb40640ea9f22af4db854059f63dbc77a3e00820760b5284c1eafc7291bbc5f53c0024f92be2c6aa214e3ec77a48b0f681579574a066717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ee98bb8b66c8320aa63974b7217e8de

SHA1
570bcbae8eb3927a70baf7be049ed3ea52563850

SHA256
1ef7a6898f7708b638dbcb02d5d55047b7f378b4fecd05365e809de47527b7df

SHA512
49cc3241dbcc3f114c8f91bab3622bbe75956001a591c29563aa7406fc23fa2774758c3c283532c39b0453ffb17b301ea6ce6277049dc4ea34c75582bf799cb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f41f2ef747042320c321aa9b80f82216

SHA1
a577ce1bc5c44afeafd6759bfcbaafc0d3ffdfbf

SHA256
c9e333cbc45118c1eeef62fb1ebe2a5d9db7074fed13a8403e2bc609f24dbe56

SHA512
0008bc561813518375c3f8d9713cbc755abf654fc54b2c8635417b841d6c52f604dcbd079985a9ffe7ea78640cbf481850068089e7e67f5a70c7c0bdd714a9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab254C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar267D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit