0ee3df505d92ddba9334fe9de06210fcc6ef9167f2dbd4ca27953ff3a240c3de

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

861b05a9b886e33718011f697f2de807_JaffaCakes118.html
Size

34KB
MD5

861b05a9b886e33718011f697f2de807
SHA1

4e0bcab2d103ae7fd6f60abc035f8e191b561a37
SHA256

0ee3df505d92ddba9334fe9de06210fcc6ef9167f2dbd4ca27953ff3a240c3de
SHA512

a9cd29f09d992ec742fbe963ec94d4ab6f02efc2023238f7e6d5420f3254eb603913b0a926d54eec6b808f2011c145059a79dcb32902a4fc3f840e7e2b8f3815
SSDEEP

192:uwDFb5n/qnQjxn5Q/2nQieFNnDnQOkEntS0nQTbnlnQOgHcwqYucwqYecwqYQh6B:vQ/cD6w5h6j9UiNHzLzR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7E60981-1F0F-11EF-A4C2-6AD47596CE83} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423295624"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2800	1640	iexplore.exe	28
PID 1640 wrote to memory of 2800	1640	iexplore.exe	28
PID 1640 wrote to memory of 2800	1640	iexplore.exe	28
PID 1640 wrote to memory of 2800	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\861b05a9b886e33718011f697f2de807_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e21818ed48085f69a6779afd19934780

SHA1
f75389b0eedc78a0d9e2cbffe19aae819cd44347

SHA256
6ad6c2016d4904c3cbf5e2aed2169ca04b051e1dd5c45152394c7cf87ba1a087

SHA512
5def67838ad55440851a3fe318e8ab561c886fe34f9521d5e38a8636c8000b0e5167ed8a952e5cf7576acb897fdaf96a80ce0c9b26936afbad818f991ad459f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18864063350df102b2b58b62123d9897

SHA1
90fc296bc75b30e13e8253c45e0afb4e9f67302a

SHA256
deb38799df3445f04fda130022ac0cefc505f9d658b34d8f37aec1c6ae9e388c

SHA512
98ba3071e2bfc49251faedc773abd30f0364147a22d1792f7a54ea232e07e7f41848c280638b91349a2cf9bb7dc19aa7b1ed5444cd920d55816da34bcb79fa81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2a835d8ab65207eb156028decfe0952

SHA1
f6cb25f5116b6cf690064385e54fd0455ec812c2

SHA256
248aca13fd4829a19a46fa9cc304f5526c6dc600806eafc52886da2207b076b1

SHA512
02d734dfe85f026d8e221efd62bfdf0a677d8e49db47b09924f12759090a5e69e109eb8667df77931f549b0ff44fe5069a9f617cd659dc2ae5d1620899166a90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c8894d2ddadb2e772358504ec206794

SHA1
5d71b51efd02570f9f5ee805735b19b9e7daa2d4

SHA256
977c859ffdac6307d04073719a582457cf9dbaa9d287639c1f0825f1f6b75b42

SHA512
2a3ca4359bc11878b755c62020f0235099a6d51ee82f848bf0e6b0ec0685adf5347ccd81f58471316a055e1bf9af90f86c5ca6bb6230c2195de6b16e7944b040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ec4d90b611019bc5fc033aa7b9e4df7

SHA1
55abc9e3501965ea1123243e25fd55b94c1412b1

SHA256
9bdfae6666f9fd65d01c920dda949aeda6aad5b771a3ca1c78fef2f6578cb383

SHA512
9208f20e0884b854ecc88d708ec618676f3189406ad211df8d00ff1ad0f5e952c0a7ee80ac9d9db583049f82a3d6d24c041b511461f145a600a1396ec5c4b96d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c071824476d79afa729a570d37abee5

SHA1
3b2a660f0235731accd182b2b4ce4fd12b1f26f7

SHA256
0c21f94421a2b3eda336155720313df7bc55ca996ef67c7fc08b98508065e4e2

SHA512
8402d32ff9e43c144dfa91d4a9c47f0b7738bc99f1e6b8b0ddf246d6fd71164abb2f79ceab3b37cfd58c392183555aaae92b774dc286ec6f3a55dc77800120a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
288f069240769d3d0e187df08daa197c

SHA1
d19fb258f5cfcb6410bd06cf9d0a6eb43926a9e5

SHA256
395192077d78d50466005bc693f33d139e6a93054f482e85936d6b70a737609e

SHA512
894dab2c6bd5e4be2eb81afc21eb0066922b0388be730f65ddd63824bbe3207389bb2280705d34cf3d08f6254425139ca826ca13947e63521ccab7350974bb7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7181d8c0f1a8d3fa626748e3e3a5be19

SHA1
39813a14aca0d545de16654771f4076082496fe3

SHA256
85d68efaea82c7afb9df09968cb27be823f2bc6199d75a5c55a8e9deeb351a41

SHA512
009f0533d4b4df029d97c5bbd773f094cebc247af64ee5f118af2870370f9ef691098df713acf0a2d566c0d1f5129411ebebd8f2acbdc9a327d00b4b5f4738a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dedd404b7a51dcef628d5f86621c891

SHA1
a811f37e957c3445aab91ad31f9457f512ca77d1

SHA256
c87f5b35d821fa116f8eac1a1749e83078f87c5182a47cd23902f1d278aff9d0

SHA512
6e2493c8fca2ba929e58b20003cd4788ea50d50698c9ba55a9aa6da0d065497404f5b094fa64de2a62566db3745d315d72ee399a22f9e2e2a78c8e9a02939cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
420c5f5564ef1ca9522db3ebae86f990

SHA1
8d864167ea7cac34728066482889936e68cb6a2b

SHA256
be8ee7981fdd130db6feb727fed42a8a60b9990384a06fd8910db8ffeec57faa

SHA512
bc465b8c9f124d30266fb2f3b1b92f2c6e2d240d5c77216b6b4c1d0ebcc29921dd93173aa38cac7b298ff56994f6c9584669293e412f12022ed0e9e470c5fbfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64abea78bcd00aca8e4c21fcfd6aa1c3

SHA1
06cd92c72ae069317fae3339f41d49b804ed7561

SHA256
7e433b25c69b73ca3a82a4abb871a3d236526a0982ae649412e56d4d4eea959a

SHA512
18bb6b515d02cfbca4ac73ea9e790e47100fd1a2b5540b95c4aa109c186d3699fced9c125b9711fb71fef7b613553d531354696e626a4b00ea02403763db5207

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A08.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A9B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit