a8bade0a8af6ac9191544749ba02f36aeb2e7b5f8194d679f36bd2dafcd27a29

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85c80a484e0e9757d674c5b164d0037a_JaffaCakes118.html
Size

23KB
MD5

85c80a484e0e9757d674c5b164d0037a
SHA1

b6d3f062a294ebecd4b650a666a367d9841c75a8
SHA256

a8bade0a8af6ac9191544749ba02f36aeb2e7b5f8194d679f36bd2dafcd27a29
SHA512

84aa453da63018b78d904213684789ec03a42709e7687a323eb1a36380d7f3bc51b5ce7a74a941a13b05e3af9641853aacb7aff58efd0217cd6a3ee8411ee0cb
SSDEEP

192:uWjQb5n+2nQjxn5Q/BnQiecNn24BnQOkEntTPnQTbnBnQiCnQtuwMB8qnYnQ7tnv:bQ/c4jGAf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD7E4131-1EF8-11EF-8178-52C7B7C5B073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423285756"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2652	2956	iexplore.exe	28
PID 2956 wrote to memory of 2652	2956	iexplore.exe	28
PID 2956 wrote to memory of 2652	2956	iexplore.exe	28
PID 2956 wrote to memory of 2652	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85c80a484e0e9757d674c5b164d0037a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbc59126a87f0f978bb97f521e73e7ec

SHA1
ca83220adfac2d97350c0da2de0df7cc1e9096c7

SHA256
39ca539fafcf50ca7d0ebba26c92f4ff4e08885e3495210332b6a454301cdda8

SHA512
eb71379f0895824b9c68a0b9d032cca82dc59169f72b9fc9f5ffaa4a03583e696f900998aa0dec7dc3a7ecb1c2c8e19a40deab1ec93bf420883f8c16c7435a07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49c735fae2d23ff29b9005df517ce08c

SHA1
4241129d148ce6ccdc34030414d0f685850a0130

SHA256
4209fe2ffb25081392671a04e9a71d9d3e63610e77339eb2d44b843236e5ebcd

SHA512
3fbad0256fb13940657934bbcc760f241b04df6a9984b3051f54f0cd63e2f4176c4c61a91369be8203e5a4d3c17af7e6d513ba2f4e9a4933f4d0c891f2c82dd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4970b0b39a23a8b58065f56720e569cc

SHA1
17ca54700920f08ca620932cf6b0d5587f025d10

SHA256
def358926f485276d68297e2a7215623f51bacf01af7ba01bc916bde8bd313cd

SHA512
5f7bc72bfdafe6e83101f8fe96c77477aa05bff96ec4ede5b4b8dde07da1609ebc8a2f4ff9d86779780f673a804f38cf9ff4c2a3b8a2cf0eb66501283c696957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da8c72301d95288295d5c3ef586c8ee9

SHA1
a1d37881453e02d11b4151f9a6463f0989ff0413

SHA256
444b01df22d61982356ef4c715b0a97287c4d508ab0d147722e9fd9a9820e132

SHA512
5046455b474c20fd25b1345afe09606a702fc8b195c8d20e0aece0d25d3914a4310500a2e707d81f8228e12ddeeb34b1a93fe29810cb6829551586e65a032ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15cb9559c03d5c615b20d1ea44b58132

SHA1
eb04589f4e08f29c2c0d0a82eb38876c61f11b0a

SHA256
ad51da01291ca1fa75b2b8091f3f4e04da3d9b570d205f71e3c38d83ea4ec589

SHA512
4c07dc32c0f984d007c7ef4e04e651413ce8d30fbe232a222fc2dfa3b9d663c032920c94fde3d9cd729a33235e63cd4fcb4d4b879be50fa088bb856c90a91694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fa4fb79d68562592a4fb044a94b08f7

SHA1
824dd1536a9375bbee40c11ba3e53723aaee2633

SHA256
ecbfc6e6158db75721ecebc1bdf53de2f49e9489fb9572f84aea74c8a7394737

SHA512
bda4afc6af9737beaa03efc90581bc244e8daff08b4e7a0b53fe19593339cc38d0ebcf139d8918c51d9de6ac49e0158518772b63d28621e31387bd49be5faa37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cef6ebac0c963497d236321a22aca11f

SHA1
c7cd3e9a940f351e90dc0b41a652178752959caa

SHA256
1ce0665e21f0d48efe2da9ad01c9e0238924e351ede274b312a4e7051f7742f8

SHA512
c2fb767ad5f4f6911c058b1316a99bf9b998b95665ef425fb993183c0c302ada23a2028944c8ff26d0c37f0f15165cbb486a9edb70df885a9799b2363fd87876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
812cd7ea22faa0e94e32ce5857e44fa0

SHA1
e82870af583998001f4f060bb755193d6c832014

SHA256
0d8e87d8498063ec675ed9b4ed174696095888a8b7ad9c497302e0d3296103ca

SHA512
f480d72db996f1fadff8fca3287382cbf21ac16ba9aa46de5700f84415ec412f93a64e8e5ad73184b733328569779f79adfcaee4add2685f5adcdf4f61cc44cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e66d790725720cfd3f748c405d1c3603

SHA1
e3f67b8ffc24c512aade8cdfcce8f7e74dfc78f0

SHA256
da2548772b155f168405fdf1f448c182f11dd3be30a6985b971dc72b0b2fc4c4

SHA512
ff7b57c592cc274efd54c9c810af8d9da031535033f859ee9a0edde5171c68146d6989c5fc6dde4bf7cb2c147a5bbd15db67ac0b0fd115f6a698812ef66fb8de

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB76.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC49.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit