40ee3d3f50d93d07d9ef19e3efec091a6b4acd3e09c956aa99b8ccd6428b5f5d

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85a04957b713b650e93ce547a306598b_JaffaCakes118.html
Size

36KB
MD5

85a04957b713b650e93ce547a306598b
SHA1

10f1ded120e2ce9fc8aa4d3fae5529fcaed8312e
SHA256

40ee3d3f50d93d07d9ef19e3efec091a6b4acd3e09c956aa99b8ccd6428b5f5d
SHA512

c04c198faac9202a15686fe021d82e60acd41eb795658a27a44c51196b0a8ede02460afac9f857fe757de1d53afe872e6e2ec50e297f190a4ce70c2f4216b4cc
SSDEEP

192:uwvEb5nwl8nQjxn5Q/XnQieWNnknQOkEntNVnQTbnxnQOgXcwqYCcwqY2cwqYQU5:VQ/3Haw5UGaJ689jPPAU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423281633"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14021AD1-1EEF-11EF-825B-FA5112F1BCBF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85a04957b713b650e93ce547a306598b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f07e9c37af6dc50be09e28b0557214ba

SHA1
bb574e196cbf991860fcf3504971174b08884ce3

SHA256
50cbd3cfe09bc0aa4319036a6563353564c8a86b1e6c691bba9c2e6d305e5ca6

SHA512
4e80a2adb8af6b55956fbc165f6f1e993febec4236f1fb81851789f92a435b107b90a68c9251655115d08123a51cae9dfd0346925a259917a3ac1ff148740f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9d2d8e76119f0ec89c21259539aa20d

SHA1
fa4cd4d4c818cefa048f178f44f48f30be44636c

SHA256
2dc6ee4ac5b1ee4e67eb4202d90b9be1fab2149b456c6d3bbdc0a03d019c2e3d

SHA512
6fc4d66d552cd0805ac843f6accad728aae5a0bd2ee62740fb7c7bb9df18a92289b620d7048202654e3770433be459b35dd074460533c149a0aa4afa6177aa0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
478223c0e99f9dd9544003109a7072f5

SHA1
f4dda73ca882c5762e6d64c9b27b39f848f0d3c3

SHA256
3fe9271bcbde9e47863caaada90b73a69bd99e1b0b037405eee684ac5b4730e0

SHA512
faa6285591fd13ace85dd4428be0fe36d5725407e9a103f270ba9630f9f8ba1bfa83d1a80d253ec01795ee060237f17ebab220eb067764add42ae7e1b6458e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
252f8ed1040c0f9b9e4a92b71fdb372a

SHA1
9a1d0d21db714d980d03bd1f8285f20e4c2dcc9b

SHA256
7b196cf408df470cb0641ab5803c069a4f9bb59bb1b1a5a273b6408b3ecd8721

SHA512
3d928d829d8554c1feb80e211798870da9aebf91116fd9a8894b6f3a4b816feb84b44033dd238dfcfad176ee6cc23dbb3b00c249176cc354fd250caf625601e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9ebb40b2767bad0304e92e9a0e6881d

SHA1
d410990b7e3e3684d99bcdd91c6a24de7161b6f9

SHA256
46fa739ab2825de37d563d41a444853a4380714736ce5c6e5b45fe9cf3b313fc

SHA512
8edd655d498b3a34c93321f561157ef8457ab03a578b5db18a7f6a7db8a5f1d4a0e6e80720121f5cd9803da8c175aacd57ecb149ac731627c3d58e24e5e72372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3781a5f467bb2b2d787a37f8a53dbdd8

SHA1
691beea1540a0225fc860d60ce95c5d68dfe1231

SHA256
961ea6ee126371cecc7af8a49f8db02dfd6fd813eb0bde88ce05567f743c7deb

SHA512
4afd7be8c72c8c75f4b2daa284b6a79cb0824e6a8e322e66ea57b714f4a5eaad0e136962daa2f874976c8042edbb8827e655cd064dfb6fbc1f9f855a127eec51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc69e863c863962c80627282ae97357f

SHA1
458e87fb08a9a0c22790b487199ae1fef9477e30

SHA256
4d514909f1145ec8fa0fad6db7d0785a300edf0a635396cf24b3564d22d3c0a9

SHA512
398c2cb243c2ca1326443b3fdf96fc0b788635219ea612e41b44947a767c4403f83297ab52f95b2353809d226f323b19b5bb5bfdd5f5c4c4d1c2fabecc367c12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ed27daff6053769efd589b7e2a81a96

SHA1
1350c0e6949b03433fbd6e7756c7a1ac5a8037c8

SHA256
9f9f1b6900af57427106b44ace41da29da9ff4d549ed33ab33cb04f4b07afd3c

SHA512
c2a8b4c6c0ebe9a2987c8e4664299fbddb3a3957f7001a6a795750630691aee3db065c02f0bab3e48fbdea5f5e5a22c3252eb682bf8aab48979a83262f9cd9ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b78ce3b3eec95d2898a63e98556c66b

SHA1
db699b24eed07188bda58c4d3cfafe97f1c8502f

SHA256
b6fc3ef09bf83948e036493769eb47010f8168374833e8fdb80c94e535749fc5

SHA512
22cc0bc0d3e46b18017b956fbb4361068e19659d4d5cb95e2671d174a63c7c5d4d1d805b9d76ac78d2501cd4503ec85c90849be9e559bbd3827107dc355e1f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A9B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B68.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B8C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit