651d444547c48caf1dfe49fce151f8857b99e60c29fa7f5c91ef3f34c2cee1a9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84afa62b2f6e64d0d891d3e6f083c44e_JaffaCakes118.html
Size

27KB
MD5

84afa62b2f6e64d0d891d3e6f083c44e
SHA1

11b5f6bd75a6d3e1099f89716d549c7500f877e7
SHA256

651d444547c48caf1dfe49fce151f8857b99e60c29fa7f5c91ef3f34c2cee1a9
SHA512

3596b564bf88a372c0865b0ae603cc8dbcdb789a3fbc8861b89034534c9307978ba7d9eb1ebb70e63e5e29b1bd3299aac0305b6d507e0ebb4b0eae5ba486256e
SSDEEP

192:uwIdbuL6Z+8vb5nhKhzhtM8YMotae9nQjxn5Q/nFNnQierWNn9F7nQOkEnttfGsO:9Q/hZWUSbScnV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423245720"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76368781-1E9B-11EF-B023-6200E4292AD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1580	iexplore.exe
1580	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2580	1580	iexplore.exe	28
PID 1580 wrote to memory of 2580	1580	iexplore.exe	28
PID 1580 wrote to memory of 2580	1580	iexplore.exe	28
PID 1580 wrote to memory of 2580	1580	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84afa62b2f6e64d0d891d3e6f083c44e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89b48c04a16f5dacff8b77d02a7618bb

SHA1
137775e07a7b1bfec6cecf6ba175139ffe9bc5bc

SHA256
e8dc27b45b6cc27faa91d66f6db5e294d5e06f70a6f3dd4e900c9f2092b606ae

SHA512
e938a5f6ddcd0c7ca0b1a7f39c6c25f07917c895d613d3eeeb46eb1099d166f095aa65c1f3da8ec014689ee6a255c21836ee4d8667b448e4d6a442c1bf4b8455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2de6ce66696b6ff95107282afc928e74

SHA1
cb80e3cce14cb2113add2d2a816121bb3653eeb7

SHA256
3b7c13d014ee32e58dde1aed5800db4505b353c67408933ca22ec9d63701f73e

SHA512
5f32ab5d198836a04af69fe30df28bf1d7771103faabde89084b3adf04db1dd1fa8b0d490d0687af4bfea818ce2b2d7dc2e4802afc35cb60c3d3a0f460ca0739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3d9a2fbb07832f26f811087bf5b1094

SHA1
f7e4357e26265db5bda7042662a046aba7660bc9

SHA256
1c0ad534d188346eb715392293d76be90f96bb528c7898bae227945c3e8660b9

SHA512
d242eae89e4a70ff27cbacc13c9312a875ef9fcc19cc90369fe81ae9c9b9756ef06ebf5874cc1eff446707ed5dd8723092f47fd65e17eb0675bd02f5d5392eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d81b3efa3b1841ebbb3127ff7185d718

SHA1
374da3c321673d802246612cd7f683183e2d44f0

SHA256
ad19ba52d9a43551ca7b2d0b06de9518a7dd0de6aa2d085657e3bec184c68555

SHA512
6f9d4b4627f55493b0c14ad8f24892b5758d6a3928ea8e844dd6a1919b284e44dd2ffa57ab9f69f4ca65f115163c02f19d8bf8b01b068310d94dea2787bd372b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dccc384ea8fc16df49b0087dd4433387

SHA1
d596f27e3560d269342f54e9bfc9296a27c89cf7

SHA256
6f26abb4e38a9274d7e5628240f8ed55b5589517c0fffe059732a5a6508cc319

SHA512
ae8a599b6a991991079881b06f92de16da8d0ffe9fe716c7411abfac34548612eee5827709bfa0e45f4bca491b2f60960827b743bf39d8a4943a62d18dc655ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa20bc458dc38975609545adc87e7b7

SHA1
a395e870cb52122485310caffe0d4c1c96cd0224

SHA256
febf75926ac21af026011de23f21766aaada0ab9ec8edff4320d1130d1113fe7

SHA512
519c86353d8570c05ee4393fd4b228b1562c9ff6243ac30c5c3f27c734ea9f673ea1f269b2168795eb1559f331bc7d59554a88bb86748836ec625cfff031e8a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72b0fc3c228187382db267f11c48422a

SHA1
0b8251b02d7f21076ea064b3253f8a2d7a1b60ea

SHA256
215fc905a55acef3c5b912af6df3a564e6c029dc7aa7a8864746c85f890e8108

SHA512
e8a732f5afd550e8c8cac9097e79c34261e5411c2f175baf84f5124d238c9f833d61d774ec205b3bd953c17393bbfe5717578bd312cf2be9ed7576863e33f916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c07273f19d9ca32725ca991f405dc640

SHA1
81c09457e9e7dfa3ccda9832d522f119c86e6eb1

SHA256
18f2c517ba69d574726d4a1819753a8ef6c4fbe46cb4129247799696d38860bc

SHA512
31123793db170a158830ae87358a2f77cadf54bc0ad03dd4146aa7b2d231c8483ef37dd3b5f865ae43807fdd913fcd72df6781bd71679e4c910d2a78b33a7330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78b101a964e452040f67ece6f8bb2fc6

SHA1
6731ab54c7403b71ab2f3bc16600643003171b58

SHA256
e50ccf40a782d812a0fcad4ca3556778fd5d72573af41ce7985551cfafecbbad

SHA512
b68776f9bafb7fcae16def455e1478c8b13548cc988f0f0cab03736fa003cfa225fcec5123b27be1625c031e111412d47f3197ea0bb1f29a458f05b317288c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab140F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14D1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit