422bc038e5d029b043f8dd9a6fb5e258aa031ae3eb3bbad4db0e2115f21d0ba9

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

85d9b29d9c538bad87827a7801defa7a_JaffaCakes118.html
Size

29KB
MD5

85d9b29d9c538bad87827a7801defa7a
SHA1

79f824d390edfc55f6ac7d011ae1b10a1651703a
SHA256

422bc038e5d029b043f8dd9a6fb5e258aa031ae3eb3bbad4db0e2115f21d0ba9
SHA512

a14303d0a8ef62d7df063ed5e2b83c9b6c2b446aadbe0149117bc3f610bb326062452b99ab995e4e4d416e5d30573b45246544e43935b5658a7d6fc738616d91
SSDEEP

192:uW3Ob5nKRnQjxn5Q/pnQie0NnOnQOkEntbDnQTbnxnQkMCrAxrNh8u6ziOS3D6Ip:8Q/ZR4Nuzid6RF+Ou

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423287769"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D563281-1EFD-11EF-882F-5E44E0CFDD1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2848	2784	iexplore.exe	28
PID 2784 wrote to memory of 2848	2784	iexplore.exe	28
PID 2784 wrote to memory of 2848	2784	iexplore.exe	28
PID 2784 wrote to memory of 2848	2784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85d9b29d9c538bad87827a7801defa7a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
84d06d5fc43782cac6caa65fddbeb10b

SHA1
696aaa0fba68eba1c09029b6c161ff02c179a1c6

SHA256
881d80bc48424d1c63b7159a85da76c2d93b885a46c1eb8c0faff814ee62dc59

SHA512
02097cd5372260d001e79670a9ac1137dfd94cf47607057e6a929cd5dca9e210ca6295112064e988abee44d43db932624bba3cd69a265997c077f5d6105cd5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
356ceebbc93bf58df6b670756c48cf22

SHA1
eb1c4386e1135c66c79d50040ae7daaa5db4d8d8

SHA256
7c7297fdeaaaaff8da3b1eada0dfb966c575109ff350bf7145d3c63eace7c464

SHA512
5f9a26149eb6ce55a41341038e6cf643ff140ebbccb4cb10ab8f13a88221ef9b0be1d0f0c34d29516ed2e235cebac181c5afce215891740d319fe93ba4f60a72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e81f3ed02a4ce60c73f689aae74bfe49

SHA1
e8fc8b0b0c33224176374678dafdff2f047a57ac

SHA256
c0c8e0a06d31a0b67a320d2824aa2a497232f9c38925590dd82dcbd24d151cec

SHA512
50f9cde87f78f264e31ea54dc803ea7cb3687ccd14c585eb571a255bd7c76dac7535890f5b1ff0de0e026fed81605f1776c4f61adf3160f66856e71a5040a7ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98bac329c4ace75e4405a59963962a34

SHA1
cf9a84515d3bc9de04fc15c778aeb33221430829

SHA256
013d84e58f48ece932efdef37098c823e87b6e8d775a891ae37a19329e0bd28b

SHA512
0f4ba7f4ef1afefb38016cc1377691475192e45ee8a9cb7579b50d7d4072f07361eb715818c43324f16c92cf15c4a311e56f337e79d1de94a7687dee8289bf1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b301051a0864f6a954c4b9689af547a

SHA1
529a0e865d7d53710fb89b533649918d7d7a39e0

SHA256
7e065fb93efb4d12047b3bfb02f440890f967d4794deb76c560406de7bf7d1cf

SHA512
090de92091d4a95a64b2aa4980b091cfca7fb825dcd34644142869f69f3930dfcb7d661b42cf4ce42f63235625cdce1238d6e09ce3e6f5825869e3680e618cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2408439ea50626754492808c16b63570

SHA1
52ab77c54350156a8533211cab66b799545ab545

SHA256
1d97f39900feb40d2bf83afce28675332431a5f81193bda8bc7bb57ba725e56a

SHA512
fe849fe06cbc4e467b0a8cc7ebe1d311f62ab87e1e688749f0cb3018eade17dbe8787b6a64213df74e4f04e3744249b8258cd4432413da545d9a1b298e217d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
487d4c5688c6c79cda4e1922219fbc75

SHA1
48cb61978e460741c4e44caec9f70c4ef97bbe2c

SHA256
622bea23a5bdd58ecde0eda454327c6a670ec2a7d5e48433d6f40225c7b61fd0

SHA512
74d5be139980e3d4fa34116d6b5e4ed513666aaed7bb19b268d5161832eea4b913ff4c8742adf6a0028436eda2463355d7cb4637a2a662de047a1bbf3dd5b4a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bd205e666ba03dd82481f9875504494

SHA1
4ffd8e975208f774164dbb581ca091e3e433504f

SHA256
98624ee11cf5d64346e35b0f25e8e50e908774afcfb97f4c105cb01a24b96575

SHA512
6dd75b392d924be2898515095887c1f0f04c93cdb6f0fb91dfc52dfa972cfd53c66c79c66abe2df1fce77960547c8e10012355b6a620dc96ec5fe9dc53042d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4774736fc5afbc7ba4be4d2563e2f92

SHA1
b1364b6611eefa039d9f6019f154dc80927a6451

SHA256
01f821e7af22e035d9cb5efc6f92835d6625137fe0d7f2fc7de3274e8194e1cf

SHA512
294a7429e79cd0f8cbf6f2d6c0d3f92760ba4097f48b0a75f2d2abf043c1436d5715972b40ec767d085f1c375086cfd4c283613b93fe80421e11014f6eae2844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e44bd9d725cb573d1eb9d18f833f77b

SHA1
f9a25924dafd68eef56eea03175dc94c77c4b54a

SHA256
8db28b14f4ed59f84bfc2d04d8d31486d03fc88e9b9c0614f4742b2d3b3ebc8f

SHA512
9b75d635f7cf62fcce187418ee322e5cf595fabb43d89f7d2ff79cde6f54111155d2f39ee09e206885f8c40b17727337182976854a9a7e3bbad9713159973f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
56a6da5dc8c4cee2eb0a77a0a6c249a7

SHA1
c850f35e83ab89dfc875766967b259e07f589b13

SHA256
691dde073aae8b6e12a451d299ea8192103f98801cfdc425c5306d43e0278ce7

SHA512
1f3235376fad41f843e3417a4d6307aeb2ad6f4efcb3482c43328aac896cafcd0e417b867a4bf65dbb097f20dc0ac733cd47274e67341ab93fb7ca5eecd81e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar85F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit