2a9e970f93e1e37a6f0a2430b039d4217caff0f59fa2c5f89f92599f62e9d37c

Analysis

max time kernel
150s
max time network
138s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83dd9fec5301653c27a18ba888c8e6df_JaffaCakes118.html
Size

127KB
MD5

83dd9fec5301653c27a18ba888c8e6df
SHA1

be0a74dca42987c21a8939e132651933f116db7d
SHA256

2a9e970f93e1e37a6f0a2430b039d4217caff0f59fa2c5f89f92599f62e9d37c
SHA512

f68cb76295fd7588229fb203e7e63fe51b721c8bfadf5a7329a8e96cd4fa53e945fa19c0b5b567a09c28b9f97236e041db29c3474a495a90709abb62a4a62d40
SSDEEP

1536:Sc43ejOZyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:SbesyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423225853"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{351A95D1-1E6D-11EF-A7A3-7A58A1FDD547} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2740	iexplore.exe
2740	iexplore.exe
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28
PID 2740 wrote to memory of 1888	2740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83dd9fec5301653c27a18ba888c8e6df_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d2b45ff94bf808d49e268a1b3af6924

SHA1
617c01039aba05d55854b4a14661e6c30b9082a8

SHA256
b32d8473d77773b297780eed46d8cd4799529ffe85352a50139d13252ead0746

SHA512
9793b48bd0fe0fe89befc8a8bed464b9a71bf8beb6f64b5a1472e41fb23895ac864bc4a76f603ba89d46339ccd9896dca31b6b649a24d5619fc119fe1b45fe71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
638534fa6d31461e091c71f5764dbf5d

SHA1
ac70e51261559ac2f466e686292359a8d8bee321

SHA256
f53fbaf3afae912c4965d9a52ad7fdc3e6c37ec79d94d4028b5cac65b28a330e

SHA512
f59e9c0c7bb71ad4bc5b9de88fad9a13497f613036f64fc4520c403107b5e436fa69de08df168524c06df9e8ed2b652a4454956762f0f8409ed9a450bb02aac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2318912e067c52c825e052c0d4ee131b

SHA1
1295ab0088e52bb796adc70d6f33c8f8a939a4af

SHA256
cbafdf0dac6ae28e9d95a65b72f7862febb10c596d77001b1362a52c9400f02a

SHA512
e340e83071a263e945220ddb509a8c706237afd67d286ff6972f8466d2788d336fc55418aacf99a7b67b72b27e22e900c68dca490032df267576ea4631b4b0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ba27a6556eaed17db64acc6f668a28a

SHA1
c52959bfd1521673a8f7757b7ec556e1c71a970e

SHA256
6c95fc593ef4e52414c5d5b18a943ee1ce023a79e69733fc50b208ad5bcdb835

SHA512
dded6ddc7777c42f83e2ebf1d2d9dfd68e1a2f7ba244b873ec458294af565c4db9ed8db6d53b676b9b40b989bc40cc472390bb1392a94639fd9325ffe30ef4f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e836540e9d98eadd24c801beb4deae39

SHA1
ca0b5ad59810eb72bc40bd893ae652b013412405

SHA256
19fdde700ec75d3d125ac3c11651450db8e1c6f58a46a926c271dfe30392a4fe

SHA512
30b73c7af68562e7d92913457396bcd66f1b650fdb46a9f7d078c23052b255cbcc7397ca22d3e1b66a7a77eccf6ba003d5f5a3f8953104ceaeeeabdd17066eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
585d2b2cf4ec55dad312d220bd14f0da

SHA1
5608e86588e0e20ab30c1215ac552509d9dca0d1

SHA256
fd2de41533800b41bc8af241039a3f9f4a7dc86bb6372311650e4cb4e1b945b5

SHA512
79ab7b9a045f531237b2d218d625bd6d3b1d605a62a8da490dc5d0d482943a4ada9bdf74d389fae503900339b55b0a68860ef12f5e8a3d5fd4ed1a596f972646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2056a1fd29543be3f2310ff8723e8b7

SHA1
8e32be397fda8a543affee59a5294876ea608654

SHA256
24d455a082d90565cf9d2d73a8b577955bc3efd6ba568dc34133d2fff7d419ad

SHA512
778d35fa88949f32667abd83e8c4a33a18d4da5f19a31446801d4a889a7929687d1a388e986632e26aea42dd1fc390a9c5f64be260a2ad20bf5b2207e706a7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fd2d0a343c45f0de08aa0c84d5b56fb

SHA1
0c06a095eac0a68948c3a245b1ea4527ae3e495b

SHA256
932e20df8e75285c2e70e7af32260fef935328b6a37ff477e32f8cebb35f8237

SHA512
cbe090f773f3f9de45580764aee5d4b767d03b249679c8965a5c796507bd9ca35483d9c3c1e52440b7a537046acab4e9abae7daad395871d62e734743b990802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6421c5a860deebbfa01aec7e7f92385a

SHA1
7e2b266c60786a733f35d89bcba1c3769cba44ee

SHA256
0034e94b418e0d98c13147be280aedecd53b7ab9e324a9a9e60c22ea9c8ba892

SHA512
042e13b0eafd3617aff3e1306867cd867fc386a21be6fc077c97e5fc8f4abfdb8461a64ee0c292acebb0ee0d62b17a01e8419e513cdda7aedad741058f4a394a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE5C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit