f99a558069c653ae91473c8d75b528c3cc16aa24d4b9c193c94abefc37359a3f

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81c012c993029b38cdcbceeed0d4975c_JaffaCakes118.html
Size

31KB
MD5

81c012c993029b38cdcbceeed0d4975c
SHA1

7e41dcf8f70a4b4c7451cd482079db4226eb7a21
SHA256

f99a558069c653ae91473c8d75b528c3cc16aa24d4b9c193c94abefc37359a3f
SHA512

1c433319389d9641bbaa2644474b8a2b7b692392875e973116ec599e66993444a1b7a93de24fafc51c5e44d91f81b227652abd013ad0328c6c7a52482e85733b
SSDEEP

192:uw3gb5nzzEluinQjxn5Q/fnQiemNn4nQOkEntxhnQTbndnQmSVxoKOh+Jijq8nzj:YpLQ/pOx+B9nzoBjn4L

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423174812"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DBE6D81-1DF6-11EF-A34E-5E73522EB9B5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2200	2184	iexplore.exe	28
PID 2184 wrote to memory of 2200	2184	iexplore.exe	28
PID 2184 wrote to memory of 2200	2184	iexplore.exe	28
PID 2184 wrote to memory of 2200	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81c012c993029b38cdcbceeed0d4975c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b532cd4e8e0a3a40a4e0e00229f3b18b

SHA1
2ac38e8110e29184ddfa14d7743545e57c39fce0

SHA256
82b4e31c642718b2e1f4ece8517dbde92f990954e43a56d06df5840775d49928

SHA512
150836b197365ab2ef730c1eca97c8c08cf9affcd56e0531f5de39288ac9cd9b59f321fa7f051b88e50ffee126235a9f25a8ebb5393d0f588d12e96bf37b86b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d443485e2a8c65b957f0d3c8c0832f7

SHA1
a6a123a99e79c964c38a13a93111362b3c275e83

SHA256
37bb6c3f1f24c3f6029079000c2d8f7ee50f98848b70a9fb085c1c92eb3a1720

SHA512
c7d53b8244b6874fd79047e86c4f7f950e96c7135a6567ee47ab0ba190bd1bb88437446cec6029e058f7111ad70a63286f093225f36ed5fd00555171282d2e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4145b67c71ab4288bc80a7532e8dd21d

SHA1
5116e0637cd662f3648cea1066c4dbcfe9814ffe

SHA256
c545cd8de36efabda7a87ef8bbbce92d50961655f37e0a3aa2b332c5981978a1

SHA512
ee47ad80914cc9d6191d168f3baff3c81077190ab42bb4a34c3b9b2f8a8e680b460462f4b1e65c918f6427a32a4e46cd5111ea036184aa5cda89dffd08b84af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b17c98cb925d49ea5e95fe0d3203bb52

SHA1
782bf69c1ce0e1e8081f10b8912dd9379e5ea5e9

SHA256
b0b250a4245d2618c9ed72113df4678b51c1fd661056bcb4d74e765bf2cadc36

SHA512
4abd195ae17533006f865343934bca61d4e3b25000e1bed7d35d48bcd2e4aa2fcc592aff240ef57f2a30f6528bfabac9908a2700db637b8f9c31869375a6f184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f900b5a547be9281e35231724132bd7

SHA1
dd6e2c5bec979d51958bcafd28818817d62d98f1

SHA256
ef9ee1cb29913b9cb916767c6cc838b4d493156f29887997bfa3e1ca75dccd5c

SHA512
6e0b10735abdc863d945971daaf16037d8b58e1d800bdd4ebfcaf437030f5f7ed104ca59a80b883381ab52b12eddb82db1fa90f8d573b467427d02d0bb28b989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65f54084a529262cdaaf2f95d6469927

SHA1
cc7d94d7e323e599ceb597705708815402637d8b

SHA256
041e5241295024cfcedcf9700436f917010ce52210467fa5c15888b8acc6e43a

SHA512
41fb11460b73acbc808071cf1836b70768b40f0458ab2a15242956e496b5136462273b508ae4ad3dc83c135c76db16226804e221922a59456bf78308326249bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
154ad2aecbd4c0c09175206b538de1e1

SHA1
7162cbb7c25879b4a17c01961c6450fab22e2b08

SHA256
f94a06113a2bfe3bbc20ef213eb6bdb8e0a2c198618c8ab60779a5abea5316a4

SHA512
e70e5bd55f075263d363bae3a43e16de5409f8772f6c57c34430db22875a95d5a13e7b5f4a8089229d29751611d1ee7e5fe19f40329084f04f440e1ed3d8c2e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
416c94ea774bc0804c4a8860425639f3

SHA1
9eacab72b9f598669cbe8b68db8891a4c59f2941

SHA256
8e407338ca4b1a8865bb838b40ffb2dd74871e7a07e10714a8558963178180b7

SHA512
7529d4243227f7e52f53a9d841313f43951b367af964732f78c2374b7f72093fd8dadf4a0b2a5362449d8aab166ddc3748dd26b01fd2aed3fb3b9025f7d99ddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6314124d1a1ff226995b38dfe9e74aad

SHA1
e5bd125bdb31536d25cdd9af0f8b2fba387e1705

SHA256
56898fb254475760cedcaf64c674496082f7408cf7c1471307f3602ff8f9af54

SHA512
10d5f6f71657b883cfb43c4f4e3fb0c0c3f47422bdaff602622b222124d9b0f97b989b1fab5c8dbf636e5066520043ebf637b9d0efaba76cb0321cc15aed1f78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CEC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E1C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit