2f2f8a5c2920601cf700cdb31c03b7b429458bbc98c9e5ac7d5056f982592693

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

855a2433240eb2414c3cacf4663bc38a_JaffaCakes118.html
Size

23KB
MD5

855a2433240eb2414c3cacf4663bc38a
SHA1

eabd2c9e9f439b6b1f43de81786ab81a8aab3ad0
SHA256

2f2f8a5c2920601cf700cdb31c03b7b429458bbc98c9e5ac7d5056f982592693
SHA512

dadf9a620ec6dae1255357174e12aefb40dbe3b2149faffc72c819c64fbef72b6cbdc4665b851996cc9701d5b796dafa1ff6c6247ebfb2fff39a641a4312b1a7
SSDEEP

192:uwD9b5nbKnQjxn5Q/qnQiehNnrnQOkEntiMnQTbntnQIGLnLnQtBqMBBqnYnQ7t3:7Q/2GWX4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423275264"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FC33CD1-1EE0-11EF-9E38-E60682B688C9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2540	2864	iexplore.exe	28
PID 2864 wrote to memory of 2540	2864	iexplore.exe	28
PID 2864 wrote to memory of 2540	2864	iexplore.exe	28
PID 2864 wrote to memory of 2540	2864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\855a2433240eb2414c3cacf4663bc38a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9771c9d951b856f9e6ee060109c620b2

SHA1
ad00d4adf775f93bae926b1aa2f651811513b0ae

SHA256
3db5899e614ad2c5833b297668acde0261218937e55e309affc681d49f440958

SHA512
c2a7318b3b0b9d3ee3ee0daa89d7b648bde829338a2a53c4ef9ecc710f7b8e14372caea95d0b5e61f60b07d9aa1c1abd2a0741a448ff9a25c687f4937f343fc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78f4875d7e533b5008c6059d5844824a

SHA1
a7b3fb6a3a91591676409aa4a28474fa481d0a55

SHA256
3021ddc499d93dc541bd5bba38dbd97f90a05a85816d610804f9ff3cf4013be3

SHA512
84dcd60d8b46cfb770af613873123a82f15d43a0fd6daf4c128c3095acfd360a2e4e5fa34a6d4a91a3159a7327b4d65ff53cdb6c8f5b0232711af01bcbec7270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a58a55352bafcf3eeee1352328ee059

SHA1
655c78d6b7d632b6bd34f9267eb26c8cb01a667c

SHA256
9fbb4ea2567abcdba471ff965e2bb375e733e8b3cd0fe5c150df980458d75f65

SHA512
37c442f58f469a6ee8797dd2864857deaa76822a9a8398a06f27e2d29d1f5566c072112efb7dca8bb00e99b3a5ef80b613df11215bbcf3b083ff131cda13339c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75ed7436b09e8c2b58f059838dd03988

SHA1
5275205c65a5e37b7a611f97ba750d364f86dcd9

SHA256
febb3df26133e3fd9e58d6f4dee05664e5ccfc369d1a5d9566fd795bfb9d026c

SHA512
0396066e6b7af387c527c3b0eff13ccc8cb6d01ac3748357af67b4c2f73040ca09b2e8e736fd3a5b19a7fd50b3066f071e710f993c32f086a1d282c76868d99a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf3cf7cf9b7f035a303373d9b08a7b55

SHA1
8e7e6d163d99efde88d6002f964872029e091d96

SHA256
eb30225927997968ca99a48db0cdbe6222efcdfa23dc1647937a0c9da567bd17

SHA512
5a8e44fdf4938c6d63962ad5944a2abdfdb802e19c35e6b05bd9587e67e04b74b0adc68839fea7bd06be859ce62b47f4aae29ab1b4f6a804fff0aae41cc67c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6967a8ab3b09af4fe71ce54f7e2cbfc

SHA1
c449e4b12ff4dd8f40a348b8f87d39d81c0a71d2

SHA256
a69e3d813d88c21be0f8435f66d20a0a287e07754b689d6892ca51d8cac67113

SHA512
a7c8f61a755c7acdc3a80633771fdf085de52f3872dc393566d19d99c2ce0d48bf782da8d74465c5978951dd421292b92ffbe926466ea838bc8249c2da23910e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17dc0d7d5de98a4d8f9699492839063e

SHA1
ab100cb15c0dcaac29b244ed982dc51d83c415c5

SHA256
147e4683c0f9cccbb86c2a3a92c386cc799213bbaf50a1ab6f557bc4acada2bf

SHA512
50c9c7bd0b29c5934379e78e5050aa39de881fb44d50156e48b2eca9dafc6f6a844639affd7993fd73f9951c4f7ffe323702a5d5d6efd6ba209218e14a02f0f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e2e614af14d49dc0c6e7d4852187ab3

SHA1
2d167bd852261c7a41f5a689fa3f746d4cc896ff

SHA256
a01843ec3892a69694e7d4b2198670d48e70837c740093426fe1f95cfff00d78

SHA512
6fc857a0606077453651909d281e40eeaf8c1391ee9b289a8e97872b2385a16c842b8b326039381a796f8bf75f034871ce32f9ba45b9a7a7940b0b158febc3bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73b24113afa5a4b6ba7e4f53e6f19950

SHA1
d196f6ead3f39f73ebe0ab9f94a0f8e7b6b04cf4

SHA256
21afe3710f4dc4faeb7956a0775154762b9f74ee825a682c70eb7f3927e117cf

SHA512
090618f2df19564e4d6b855c5d9291913857cfcc1d6c3990938506bb60c33865856bc6b68e921731bb11c03849000e543498c3ceb73ef75d4c897a2b1ff606fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab227F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2371.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit