d8f6718907b3d3acc99908323a5537d70af8f376dbb24a7d261f455b32306ae8

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81d2eb399fe8636220d77ac80da3613d_JaffaCakes118.html
Size

23KB
MD5

81d2eb399fe8636220d77ac80da3613d
SHA1

cacf1c657b3173fcfe5dfef41771e4f8a7e43913
SHA256

d8f6718907b3d3acc99908323a5537d70af8f376dbb24a7d261f455b32306ae8
SHA512

b32ceb1bc61d87d41ddc960299698dd1eaef3e0df22bafe6012b6be3b4b4a53d8c0891c9e957e8309c1a1fc9a622d1e40136d0fbc63dcc1a9a6a11e2dd5933ed
SSDEEP

192:uWxc23nwb5nQ7eOnQjxn5Q/2nQieK6Nn2N7CnQOkEntoj8nQTbnxnQXCnQtmUwMG:Bc23AQ/oVN7LxiqVl//

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32C426C1-1DFA-11EF-9AB8-560090747152} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423176458"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1996	2272	iexplore.exe	28
PID 2272 wrote to memory of 1996	2272	iexplore.exe	28
PID 2272 wrote to memory of 1996	2272	iexplore.exe	28
PID 2272 wrote to memory of 1996	2272	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81d2eb399fe8636220d77ac80da3613d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c350d599a038cd269bfcf9100d9bc27

SHA1
34610838c6efe48beb673c1b1f1c7cf837137cd6

SHA256
6daea21f711d0d62748806f075cae09c4ee0377b61d1329a72601bd3df7a038e

SHA512
4f7bd668154d077a00e199448ff0bd2e4aa4872b2b6c1a0344a390377192bc70c7da27ea5d7b6c738d415c8924e147d9b3b793e429380d23a13f1c56a5811c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dab5bef1f3f91269b7e9e0a35f69052e

SHA1
9c2319d368921852d506d9498a8c372bd328ac90

SHA256
2978f50b4463da174981263ceb62f04a60f3411fc150d71594616d97ce65f88a

SHA512
075b481cd516fbd21b5be558ea24e1b033b5d35c1bfe2fa78ba005cfbcc6012691f9eed123d43a7bd66f5b7d34036d6f51a514f7b83d9eecf7040cf82c8e054f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc10aca14d05b8558310a9987fccdcf3

SHA1
e550d05453244e73feb43370a28ef951f1fe4d86

SHA256
02c28359c21a622457312761212a1db9938ad071f4a08ad2931deb1558c26e74

SHA512
2d1db81056a251de495f2bff35194feedae989fda2051b0eee5e8d3fa0892f99ec94a0d61c2b45bb07ec5992b8eca15b9b79a5d5d08459c07888b38e73f23c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d719eb6a4849648c5ffc7e29bef7c6e

SHA1
05bbebe4ce3bf6d3de65e8859db919d2d522c413

SHA256
814cd8eb69e021523001509bcc56de01189d2df18db7ac149ae3a750961d69da

SHA512
96e80952b466e31da63e023241f68aef52a5660bc6ae0369779356e8da0ca2dc2726c663841d100d0046a400379abcf53e028d3f05cfa333a8d1afdb98746490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e2670461ff324ead7ad9430718fba30

SHA1
8244d0b3d1acd1c8adeb379e5da01c6e7e851062

SHA256
1d279156e711e896c8df7673c258a918417090bbf3e1ee3c249b25068cafa596

SHA512
f79e7144cdf1ea94f762643aa886595fef293dfd585001e4aa3a4939c07e4dbf53f2abdb2e6214a7346bd781630866afb788e8e6b7b39c6262561505ccd2452a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e978a27c394671ab0c839d772f00a44f

SHA1
bbb2dcee19ca2cd8d4b72c2e88fa8582b3b74b86

SHA256
89c91719fcf4dd6a330c59c685412d6029c28941cb332bf17c784222620c81ca

SHA512
9e80f0a222082903541a633fcc92655e22b37485b6d14352a6c61c3c29445ca355d7a8d3f80bec32f36c3f739698833ee7b290d27efe732596e0d103e071e8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28176864dc18b95dfc1a019aaa6b3458

SHA1
12e2ff57864543e64eb842e1ae2e292a7a9ced44

SHA256
09e1d6a5ad86c6676853697244a07604ab201503af09f7290a4866709a1d5e9b

SHA512
76050c0f9ca7117a166deef4c866589c8dea2cf84851f0a0d3db9bcfa02e49f94f82b23bedcc6b6b3c45ef9788e86279e146afc48642c3f9e8510fb222e2d45a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
263d4ad66badc4f6fd290594eaf65ccf

SHA1
db32afa544843c7bb5e469faae36d0cf49c9f9a1

SHA256
41c263452625942c3ffeed0472975929c0d430fb973565fc1a881b8902eafc79

SHA512
866ecf0f1f4e4d78428b93eaa32f24131bf656c2b5dc3c97874daecf0ef6b8bf834def05da042d6b6222a1c03146fe563a2f018174b63de81e1e240375613081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d27b0c15b8241e2cd293d9d1bd1c8604

SHA1
ca6bfbfb2ca4f35cf52e4701b44ee34fc100dc86

SHA256
7bb67cea377dfb00449d2a504d500a1bcc57ddad6796967b466926d472b29460

SHA512
2c4b2ab7c35d3970e69c908609e66c8f41a8ae9ce4b2e031cb603d4662bfad9c32412d19a9a8d5ab4044148385049719dba868c02fa85951b48c2afead3b9eb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1047.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1177.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit