26f498e101f7cb3b3095e25231a577f24989a451fb99ff1d221adf3e7b3aeca1

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81b00953fb51c7eed644419f5f5ef6a5_JaffaCakes118.html
Size

213KB
MD5

81b00953fb51c7eed644419f5f5ef6a5
SHA1

2f48482a63d71f9e041905fb56194d1450c59bda
SHA256

26f498e101f7cb3b3095e25231a577f24989a451fb99ff1d221adf3e7b3aeca1
SHA512

337d87678be417e0f68787623831eff46ab7edfedb1a7c29df76e318c216d33574ad34084cdf8fb6c33b83616570361cc17530239541eb15d7359109fae2c46e
SSDEEP

3072:SrNRXifbf4qyfkMY+BES09JXAnyrZalI+YQ:SresPsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A15C9B51-1DF3-11EF-A635-D2EFD46A7D0E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423173637"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1404	2316	iexplore.exe	28
PID 2316 wrote to memory of 1404	2316	iexplore.exe	28
PID 2316 wrote to memory of 1404	2316	iexplore.exe	28
PID 2316 wrote to memory of 1404	2316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81b00953fb51c7eed644419f5f5ef6a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3b6b699458447538a18c5bffa186374

SHA1
7684222d2c534d2b4470dcc613d5d08b7bf3d4ba

SHA256
619a76b2a90238af413ab83b9310f12dc1f1b4699f8977fb6e711f59bce699fd

SHA512
c5f6c18015d0658beb3e31dbefbcd83cf7e1c2c43d3bb0c119a53b3cde567ddd2933de9e55d0455dd481dc8cea499851f35170ef97ef6f31570b95cfe78df5fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca9986c5b1062891f9836ed2db4d2e20

SHA1
8b6c5af4a2efa3fd9c94c236512e018f22f492ec

SHA256
ae8a2d2c86f0b87d5034450517c2e853409fac477cd636df4924310a08a33674

SHA512
3fde6b78493ea86b5a04cd832740132c330e4d91609b82339a7603b626049e8091d3ebe38d8e30b30c2ac95bef263a921040d184f873978ed8b4a11f1fca5f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29b7780e427905a3a63c928d68140804

SHA1
3a95b5536ee0237018e2bf183b51704e0cea46d6

SHA256
cd70b21910aa4b952a83471934a9b224ee00d5204dcac9655ac41dedc7a01033

SHA512
df3fc737965997ed359206fffe7f2cd147f74c975c7f56af035d87c8a557ad47e523c3837d72269ec8caf0adfe561f717cd0a98fcfd46498ac345e0408f5cc9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
174246f6916c5d42d72af73ccd69e779

SHA1
aa6c419a8a0f99fe77dd9efe7e53342a6c8d0228

SHA256
5e0eb229a300a94f5484e2ec4c29a99eab9cd9d605a20c2e4ba7b3cadb718ecb

SHA512
7e955aeb9dd9827d303734ab1de90d9c688ba0b0a869a9becc6510b7dd6ccb091846b1041b15e71dbae6b191deb3ea7959e78605803e321e77fae3ad0e3c8d9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16b4e1b31bf385c3846f10e168925184

SHA1
ac05463fada6c318d67d80d7bf5029a6322c0b18

SHA256
1f9cf62502d4d02b1fa78979eb9859f5a44ca404db48938076ac55318cf13ad7

SHA512
63e3c30209b946d51f6476a124d4cadb548a769612cc9714719ea0855d8fc6b5ebae5ed2fdc685dfd413ed23dfcfaddee0cb2b9f31cd148c58fa7beab52a3664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89f86864eb265ea68dbe658198d6e231

SHA1
081d4e1cb5a7158ff53575ca293c00a136e6fe1a

SHA256
911c8f4c4465949a534954bda2a88db638b7d4df152807a079d1863576d0e916

SHA512
3c577bea875f3555c5016fad94ba07d5b03c585be789b919eaaffce8654287df266c9acb0baee9c5e74eb14865d804e031310ccd7a22cb0a6cfcfd3906567316

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1decf229e025b9ba00b26e2c8bbc799

SHA1
3868cd7fd76d63b5b16352c13b877a2fb90e960e

SHA256
f388bc3608ee383616597005a7bc8b71643848152d535b5c759c7965fd3114dd

SHA512
b1e04ad545f0aae2d81692e6f04b25f35a324964fd0c470cdfb403391828e150295da18e8ee39bab4df33a1905a5427f984e699a62af303e1c40985510bdc111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cc3092c615957b5494b37740f541cf2

SHA1
405d50dcd91a5656cc4d7cbc17d1f056415ff3c9

SHA256
07b17c000fd4ba59afdc0101622b9bf75f4973e96c4c3210ababe9f892030fa3

SHA512
d1892626e7e54028ad2a7b47564bd343d62881cb623d3ad51684d2513f0d7eaec8611000dfad25d9fd5bc91f8b5422dd297a19570d714f76c6831dd07beca4ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f5f47291743b533bafd1786048efe17

SHA1
944998129eca7d0665e2f9da4742c451e630dafc

SHA256
3151b1d0f7ed1c80a1ae39e0d668422107a689d4203b723b61490ce6eba16659

SHA512
71bdc5731d974157365bf008353bfde7189a4a6b57579005aa09efb3c94db1f993d4094958b7c163c578227bae06744ddce85912c3f785b82a6b3a9ddd21f9b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cdcd8c7c121cd202966da2a6fc1fa4d

SHA1
11e8e3d11a3e94e100ff91921abef987f04b453c

SHA256
5bb8fca2ab053d88fd64a727fd4d7819bcb0a56bd748b341b8899adee24bec20

SHA512
46fb7004dfc8715936933b1d79079a06ddc97fc7e50d438c01487339132e88a4153844a3149f1b6904b5fdcdb805b8015dbc8166b5c90f5228c5f57e14f86620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3745fb02e477d0e7b1e020dad0ed92a8

SHA1
2d39db8f52717a2fd0a61fc20a85a868a92458a1

SHA256
4df262904c091e16c3959aeeb81304573c45ba75e08e97cbb1b2955d69ffd3df

SHA512
94e2dbe24afda1ee2070fc9466228b9bb2b7c7e2d360996c5cce6e0c4de88468e1fed2937e78aabbaf81898411d778e8c18c5734175dfb5bd385ff95adc73ae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0b0c88359fb45378a092dac1f8cf601

SHA1
8804288daf0cf7dd09054df8be4e8e72c953b705

SHA256
765b3d99eb2bdf22b8c78ff0acebf29af23f682533d768af68c7cc3870df75ad

SHA512
54199ba6f249c4634dd4153a21757444005fff9087ce394ecdd6d374e073d6b84fd17c8ceac15aeff0b667b71dfc7e34febae15fdac27751057b507c2ae7c465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e52acb9bf236cd82293cd75cfa05353a

SHA1
a7de3729e9390a73a8b8489b9316e186b2bf7520

SHA256
18197864db225b6dfe9d75dfcfe0e97ef418e46230cd06aba4678190ede12c52

SHA512
a183cacf83074f8eb3f97facd401f01d548e3970dde365ce146916ece25fb67979a0369cd0a9d777d7a0efcde0c870a176516cf282f3543d1f2bce0ffc68532c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbeb81f80dccedf62c12ac092584e4a0

SHA1
99f01ac5a18f708a5e3679b856bbb93b0fa92765

SHA256
4dec8ba599e6a10523eff18a07d0f0b1c58cf738b5440d4422bb2cda45d17cee

SHA512
dae25c0e0c5f0907adad13a034d7053c2a80f17826cc34ed8cc0bbdab8e8648b3f9f7a21eacda10459b04aa3dccecc063bf8635c4275e1a463f5ed73a1c3b9f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21CA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit