c0eef1d8e0e2bf84cb62abd98c0ed064011a8e3a6eccd35ec34d768e9e14c6eb

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85ed44cf7fd2e427065d7e9e5af5f4c1_JaffaCakes118.html
Size

42KB
MD5

85ed44cf7fd2e427065d7e9e5af5f4c1
SHA1

5e7d35137bc10c7ef2afa72a70ab6e863e6b26ca
SHA256

c0eef1d8e0e2bf84cb62abd98c0ed064011a8e3a6eccd35ec34d768e9e14c6eb
SHA512

a33dc3ae6b34d05826c999519572bb1d41a4a907d75c0890e3e2298a8311172c9105785aff5522a123b40433c964a45cd4a0e099ce5f65eb1683aaf7132bee73
SSDEEP

384:nQ/IbxT3Zr8+sN3vN4tX6aocCMhOqdKwZML6hFdKUrxi:MAfQosYo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423290152"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E92DFEA1-1F02-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85ed44cf7fd2e427065d7e9e5af5f4c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53c45f3d4da986f0efdd1f00027e480f

SHA1
1d8d52dbb3d1a4c49b5c53eadf66ad3a1b041546

SHA256
512574676ddb7706105bd0a0ec85d2b410756b61eb01dc6653d215a421bec713

SHA512
6f705e653426ef695227389b393bca033f2657c07f33804565cdb2bc3ea00206eacccd4d6db982b4df75351b696b47e5e2a4d32e42bf97f6ae5711353c899983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25e9f992070930c18c7abfb278ee4f2c

SHA1
8cd59344e582292acfb460919bb7e534bcfe2d9c

SHA256
0c44edc6c9d3245de8f331d73427303f5ff94a112580494dd51e7ec125df5d81

SHA512
c58fe249d351476fb3e036aa9fa8d24710cba5e54d13f11799ec611aaba7d6d51f9c81aea6cb39029504caf3e8b4e480b1faa80649bf0e17609054fae701ccc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83130abc80dd716edc21023e03835836

SHA1
840f9cf7f8249064c34881055e50f5789c03f669

SHA256
0cb0808a48d5a1605fe425b1211e4580ebed64ec4ae57e12ae41a70edff4b105

SHA512
ccdf3b66685bb1e10ee50acb6c23a8b78fe921da69afa67a4af7043cadedfd471391f3769685c0c12317e9302924cb68ca041e387db12090ee11ef2c0f165a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84e3d3d71711ab4ce816266cfa61a057

SHA1
7d2ab1a87318f87f5cc0158af5171871752157fb

SHA256
d3925c2e74e0643fcb78f6b093149366889c8382be033d93271ca85d8e7786a5

SHA512
3f8927f06b43de7e26708a9acc55c7f715b9aebf2356baea75d85378a9f8167c585c81b20f11ed1a923f3b5c610c3f501b29f7665df56c1344027012505c9672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f9b9c9d8d4a8916d9d065adfcf71306

SHA1
4561ef1b03369af0fae9f33ea7c0213eced95435

SHA256
fd0577f9b1587c4f1b91ddd9f521784ffd505e43b1f05119e9d06423aecb56ae

SHA512
be286073838fdb7887457a2812fc4977fbcf1164b7bfb871bbbae67be7814f4658f476ee134ef5206f5bd69ccc2dce314ad9118027325bc9e802ff14aa3f4366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3e2bdc231755bb7882301e246dca3d0

SHA1
89384b88c95e7a5da9baaf8214c75efd7168af65

SHA256
f71cadab02cb93ffbd69b17a890567fd5d8262f8e526433a5388cfa57dc24bb8

SHA512
028e2d3839d4e53edd69ad5bf5685466e4b005eac1ff181b24678938f88b221163da30da11ba5d52cfed1320304c3b6cf4ac2dadf558080d861012708ba60b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98363cdaa379d913c1cbdcfd32c25489

SHA1
9748fcb8b3b71b0372c22ce8025135a2a8217e8f

SHA256
fdedc8496112c7baed565df5ba5549ac23939d1b1ced95014540caf1f721fde8

SHA512
8535959d2a5cd4f2164cd9876592d391e9ec99595407f42cc150e30bc8563361ee8a55cb34ebb9b601c36f52c8fcd83ca2fd569f086b682db28c99e3795e7531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a492cf2ad93b8c0160ee52b63e8b871f

SHA1
4c505b1638be4013370cb6dff48df72a249b76d2

SHA256
b37381c06b4191ad3528434a65e61be4689f97d17490b40f100ff003503c89f7

SHA512
1e9d6ba076c75f9b316055dd92e31da45a4f517fcc0ad7c74ebeae8a9929420401bf52f94a93b72ee35e0932c5c4639803abbd8d31102866a8048cfe7f6d8ea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c694c3dadbbc3cb4171083d300455a9

SHA1
bfe4c581c49bc2ec7bb1c35305fe4900019da7f0

SHA256
928cd3e8a144eff6e5ef408443f2f583d216e301626689bbfe8dac59d2a037d0

SHA512
9e811d15896c1a2c2179d9150c526997757fdfb67175d1592a4781486a11e3c225e0350ee96ae3263952d6c7e89ca5154f387288d9d72128d5bdf301a8596757

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D52.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E2F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit