4ad3cc3d60fa053b0a2c396cee293e0d95f69eff0d9e80e10bb4c99ae29fe5f1

Analysis

max time kernel
138s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

81dc0c04e00c715561a9ac453bf684c0_JaffaCakes118.html
Size

155KB
MD5

81dc0c04e00c715561a9ac453bf684c0
SHA1

542853a4719a51fae94baaa2e5209804a1d6c7a0
SHA256

4ad3cc3d60fa053b0a2c396cee293e0d95f69eff0d9e80e10bb4c99ae29fe5f1
SHA512

87b298a30b395cbe86e50d8117a20ffbd9cb53ce0478c55ba99955aa8557fa6d24f07e9a81e6e81159762abe86e7836e79b868c29c262b4e8e6118a3a5abfb9e
SSDEEP

1536:S6ujEmlc30yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:S6ujECyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423177330"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A91EA21-1DFC-11EF-B0DE-E64BF8A7A69F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1780	iexplore.exe
1780	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2748	1780	iexplore.exe	28
PID 1780 wrote to memory of 2748	1780	iexplore.exe	28
PID 1780 wrote to memory of 2748	1780	iexplore.exe	28
PID 1780 wrote to memory of 2748	1780	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81dc0c04e00c715561a9ac453bf684c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68424269223c11a79dc8a6fcde042094

SHA1
1cddb244735e3cf5e73463a3dd36295444807efb

SHA256
73f0155ae861088ee615b774a6acdcb7ef1d5729a6e2cfd5c57a3fb92b4e29c3

SHA512
1cd0f92a72505b6d59b0cf66ca285e6c98c6e377b4978d91fbcb88a338af68621c21d09451e7e240148c4cb2646f30e266235c5f7e7f6f5b8a586c4f5103c295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a25b711f40913afacf1d70ce496804d

SHA1
e838c7b641e1ae3aa77871e349d49b83d03cc56d

SHA256
8791b11f0f59e211d17491d33121fb6a4ea6fbafe55235ff08674eaad8c541ca

SHA512
2478b7bafc0bf79c77c8417d20d524c0d0a2692bcda75bb676a30131351fc23bb95315748f588da5ea3c6faae0efb8f412964cecc387b6c2093eded25f466050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ff912ecdf49ce8ae8e79268cfb02b8d

SHA1
7d8185aea0a58e36b22dca79ea1bde7a8bb677d8

SHA256
15d5925768a873c7dda97a8629da2b4ca9eff479bc1b7c4d02e1a4b29415470d

SHA512
c26ad9527cf64a222ac44b39bce5c13ca8b389039552d41ef0527000fbc5b626273c1ae87da8598d0f560bbd1743459ed9fbb9f0770ec9fc46d86b92c60e4d83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0dab983f540396924145033cb30a1ff

SHA1
9955a0aac3d08c6374689d1d4564288a6b133989

SHA256
1df02d734aa72f2c2f2fe103d99083dec80879303eb775e64a1768c2c8d754da

SHA512
19b663b6ecf60a84d08c9830e2fc798a5ad1c914b2c6c4a13d4d5243a214a1ac1a97eb4fb27901b2fa2cdb825347d69a5ee59ff1b65c76b6f3c37a85e25961ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ab5c461fee9a5edefbd526a1af63a1b

SHA1
2b71375aa546c0aec1141cd914486b622c8fdda8

SHA256
dfc54cd22a31cf4f06df8fabfe3e5d748c07fc1081fd238b9ce1901248d77a22

SHA512
0c8750571f6f95d9c2822c65fc741629e6c242164088ce31773d542c0e12466c5bf1ad3809cf8f5a7b75fab0576b59082038b55a2328f26c07e935012cb9ecbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dd67e6230ce5c55b2b3496bf6535d3d

SHA1
1e8053363b3b06d812addc251af53c1f496eebee

SHA256
42cc44150041d6931bb81f349ec9568c751c9a5bb6427c9cc2b673d675476363

SHA512
41f310f38288e1818332e49e61866b538e22e3bb2ab92c838fd8334fae9f27038a72585f8758f2d42dc5802a303db0b40925b630a50392a8526859016fbcc64c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dab436e52c899c0f5c4bf0fa474ca9d

SHA1
b8ef0b35fb6e8eac747f42fd5301b4d3d2f7d031

SHA256
7d66625876cf6eb9993412ed742dfaad3426e0ffe03c6c149d1efbf61d1e466f

SHA512
3054eb76d7785440ca69b16cda8dbf2fb99bba614a756980ecfb7c0afcde3961c966616ed112312ec8dbf21b4300b0f31fcfc8b5faeec61acc023cfccc8ace6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dce92129acc19ec19828f7d41f4c226

SHA1
2dd350840b46755490e944b6961801ad4aca4088

SHA256
d60e5ad36ded632e23b9b5a517b6ac8a0b0c4f264a010f1363be9f8a02f708be

SHA512
cf1cea07c64c5d8d3bc565adccd70255292ed186d2d0566e0a9084472345ca260d7486929e5c4d94f491e9b3039c97f6487fbee4823fc0894a55111ca5e0fe3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f56acb488e3c55c80bcb79419aebfe2

SHA1
0a386ca49e5c50789e3b3d5f0b9c84525c036c78

SHA256
7284bf553ead5180a0995eda8b268679535e15e6b685fb93ab6f87225354ce29

SHA512
29b04912d7d04f676ea628c0834e4557074967bca91a1aa5c1297fe2083c7b7ee5007f1ff05534e0a9ee0f6a446ab62be7ebf754b0d5e5979e0cd8df475a0d2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18CE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1983.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit