7b074d5536ecae5b4e17734b076174a3b826628c6364f4e57874076368ca87c2

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81ebb8cdbf0c41372a7b6521aaf384e7_JaffaCakes118.html
Size

20KB
MD5

81ebb8cdbf0c41372a7b6521aaf384e7
SHA1

0808c917d7acf423b15d72afa4a16393b746a14c
SHA256

7b074d5536ecae5b4e17734b076174a3b826628c6364f4e57874076368ca87c2
SHA512

610c4132228ba9f351b358517d97db864566693d62f71e5b774b2141834b3227b8944094f2b0102f4e4295882f3bae211d58be2e77f0370aa2a79f0a98e8e536
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIi4wzUnjBhMW82qDB8:SIMd0I5nO9HPsvMVxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423178597"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E5D7F01-1DFF-11EF-B27D-6A387CD8C53E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1940	2716	iexplore.exe	28
PID 2716 wrote to memory of 1940	2716	iexplore.exe	28
PID 2716 wrote to memory of 1940	2716	iexplore.exe	28
PID 2716 wrote to memory of 1940	2716	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81ebb8cdbf0c41372a7b6521aaf384e7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d895197fc321ea8440275474e4ebf02

SHA1
74dc4aeb3982c0bf16cf2191452c99e099f59dc0

SHA256
e0ab5c2d846411601ee9f2b141d2edb3eb9969183357aa3ba4fc39c06dff8a5e

SHA512
25ff3e999f5c1d640117c9738dcab1ce2e11fe3f0afd7ecb627201d2844440731d25ba2bc98c64f8322ae59f7118110182d79d0e2e6e5cb283f7234468adbd36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd83214fa3884c6f2c544e59cd81247d

SHA1
4d1c6b04b6327556c5fd52ee95061c1d1406c497

SHA256
f9871cc2ed0182d7067f686524cbfd79970047bf137860383e132b0fb357f946

SHA512
308450e8b61602e69dffa5effb7a194502d715956510cfe0ac2527585067c0b8ebc5acf0aee547a8577998bc3d4f041a724432b3c66c5a27a34eb1e0bf5cea10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2077495d46752b68bf06b48bf5738840

SHA1
acfaa569e7f1f60bf0a489fbc4e0dcbffaa0742f

SHA256
b7c5ffbb60cf2ac69d48f40009664b9e240b9e5f09cabb98f7371b4f102cc958

SHA512
fab8a5eb89195b78a8534987e1f63d5ba395e66fb1bb6659ab10ada72d1eaa655e75e1fde16215a005805d6394b7a8c493a2d9226c5f23de7d637e98b103c71e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea7eba80cab1466d42ebfe4440095306

SHA1
669d0c86a8abc5703d607b9f8e84d6a8c6f92838

SHA256
1f799d9e6af69bafd202b895c986f7128fe0cd9639fad354c35ec35058c72573

SHA512
95a23c2029e9f4df64565d27d3b717b131e335e92adea811cfbfc855a16e682256a6e5f136c0d3a4e6ce507e57293e8eea5628731c04bcaba97186f6733bf7ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
874989c8d3f64309ebaf4466cafaa089

SHA1
eb85be5a2224e9044e2a5a290e8a1c360de6a716

SHA256
d8c834f2c33bc573354c12f7027250d71cb493b4569d5d74015da56e9d913ba9

SHA512
09db861795d99d11dd3f9c1cbeaf882be204bede4c2cc0f00afcce889a5b9a99eb320ab74f24a4404eae89585a4cef2fd1ddf59b3ffaa7a478bb29160a9164ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4dd7a0250d7a8c65355631c77e28ec5

SHA1
282b9c345f800002c18a4887185c92aebb2fa7d9

SHA256
6be7a37c8bac49e17088ce4ccf84f340b7b8ad58da47ec265cbe4e357a298985

SHA512
1d133eeb2a65b5e09b173c90872173c62bb5ac05cf15462f25a774108a59df38d3d7a3e821b8925b4cfd260b6eef4d94125088a8d6bf7b319d1ec2c43a5d5225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4415da47be781469a1b8105b4e7837eb

SHA1
b590011866b67f189b3c91b96e6aa6e75a81b275

SHA256
420b9e94951c9182251512eef5c6726ef5a64598db10462e35ecf349649cc030

SHA512
70763a10a53d47e0780b4773cd7c974ab7bb2e37512e9635e3590a80ed0a727ccaf2bf6a10ba71689c193b3c8377c589459bcb7de7a0573ce6509a8f8fdeb9e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2500730a618dd8a29f17c6533af5eea

SHA1
e6aeebc2fcfbfe876233a64692f5f155d8ec1870

SHA256
9c112a0c73eb98b67870a8572c643105581439a2f138d8db8320250190105a1d

SHA512
284345ad5a59cdc109e490bb67cb59902d3e25daa7b5ceaad5e1c02ea30bd3d57b27a2229e7c6a6f833a040b54ae759e9c798f3644bf0e59dbd227904844e2c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdf57419439a08f80a82e3abaa5f2c98

SHA1
df18ba58eea4248c546346726ceec6a6410c04f9

SHA256
fa1554becfa0518d41bd27ff853286544927c7a5c6eac0da8540edbccd837fe2

SHA512
22246626ea63b3c7bf3e3bb57c82d0961c928e4b53da4a50a78fc39adf5873842244d6c0837060fd90c566515da3a2ce5e83b73b7ba35984b1667cc96749de2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a5044ae20cf82d3e3b9ae9dbb6a89a1

SHA1
79644d41d31fd55264f70e4a622e52f044e04f33

SHA256
82fb8dea26413ba2cf9fa895682c271435fbedfaf9ed226eeab508e92206aad4

SHA512
1b26de811c9b089a8c163b6af627ca4e8dcc414309177a39f75c1d639c53361659f373ad81dfcb32fe8a578a93e620d36b02d9e604a2a85e452d2e94e30993f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1641.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16D4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit