7d91f1b39ce048fd8da1407c031acf6996531ee7aaf18acaef75facb0aef490a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86462259336b2ea766c23bb629afc1a0_JaffaCakes118.html
Size

22KB
MD5

86462259336b2ea766c23bb629afc1a0
SHA1

6ec889c4c1fd5c64cff839e4806810bb73820da6
SHA256

7d91f1b39ce048fd8da1407c031acf6996531ee7aaf18acaef75facb0aef490a
SHA512

4d28ae8880c3ce2ea440b4b359ec5f64c8817178af5d1edc3072cd6236e6d30189b2476ec5607d30ae3d2e8622a737ca074f3d396f4a0c45f575c8e7642d1e33
SSDEEP

192:uWn2b5n0mnQjxn5Q/8nQieXNn2lenQOkEntcinQTbnRnQnCnQtvwMB3qnYnQ7tn+:ZQ/glYM4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423301575"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82699971-1F1D-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3068	2168	iexplore.exe	28
PID 2168 wrote to memory of 3068	2168	iexplore.exe	28
PID 2168 wrote to memory of 3068	2168	iexplore.exe	28
PID 2168 wrote to memory of 3068	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86462259336b2ea766c23bb629afc1a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eb85d46cb66baf0a57408ca51ab7416

SHA1
897457712f5a601c3021181338259e984ca12d72

SHA256
8c8acd685367c58642b6273acbd8a301d373f9ed37927797c8745f9c1dd3d261

SHA512
7d751a241e6f43156946bb7fefa7aa4220eaebb224d12ffae779da45bc70d718c61ef0f554710d57ec576850ba801270d3cbbcf4924ca24567133c982407aa72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3edd2c27434113f013853a3f09cb111c

SHA1
cfce0c7d847dbcd13c330f2cfe0c03ae4a5389f4

SHA256
c6362eb5b2b76898cb34f677acccc3510cdb246693586dccab7f1a4200dc2710

SHA512
25bc3a2fb87d8bd262e5bd46ddc80eb7f82ba86ad6972f07d4727ed4a76aeae310182f752c6f73ef78d82960952bf05b111f79aed3e43191cef7522415680795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e4de4b7b477ec843c90667985c45ba4

SHA1
825d989382256fae2717d8ce613a23cca4837fa1

SHA256
973c9104fc2763e575cee5621acfb77136db81a8cc3a3ece1db25dc1a0af0e18

SHA512
981a089bed97301e88ea69d209b7b7d7f380225ffd0a40324e9349f1779abde1032825e077f84fd75c34aa2c6206f1a567ea930128240b30a909cd533028b840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1edc71fb4644c7d015183d3a56e0bda

SHA1
f73c63726eb0449b90603ce4cf8e48fa4412ce74

SHA256
57b6af9996cc7cdac9f21c6850553d3553eca4d204fbe61d0be3f777ddafdeed

SHA512
d6172b80c5b45d6590e820974344e3509ea5542592ed164289101934754ad35f925e17c759734e8c13c5ffc1c7f9f6e3bda6a465179ec740478b20a8454cc618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc2156b242f56911c6ef5b6bf9b6e4c1

SHA1
75ea638160b5400e9e5e546de5851ce9a35de816

SHA256
6811f82a30a246719990e7ad63c987980bb7dfa94624706a839c91282aea60c6

SHA512
a9a6a53f78f23f3a6f986415c33824510f74687199351baad769ebe8e587813ead363e55ede6efdf6c0fe3c9e4d27fa7b77d3254442d2a1bf5fed5340db1c658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b790ace433c91d7e28bf30c4372750c

SHA1
8a894c0e4c899d7ffdd38e85ffbc35d578fef9c6

SHA256
5bf8ae001e0673eaf5c4560f5c9ec35031ba933e834edb174567cec78c5270ea

SHA512
96e21584677780a6a2f0a0aab7e2c90ef787dc1f1cd997a676674f9e9aafa3ea35163fe5d8dc0dfab00b2f0d47481cfb9dd287f59772970e797ecab1fb43504a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5821f11078a8973b43ef062e0759474

SHA1
fcd1c3c0122c7eee70f25eb615cc16732fe97b86

SHA256
dd8126f1ef94b961c1aa8269fb2ec1da221e803da8f45ea6a963e0a900efd88c

SHA512
0f9450a1c5ae278619284e42ba7a54effa7801db7f48e0f26cce6add73d7b8da74875a4dd9d4f62e21169514e3259987054554404ac3fad7a66105d0528a365c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ea2c36127c2d28cc0174fec3038ee0d

SHA1
cae0da85f8c95a63af4649b54262bea3a9e95ca7

SHA256
2d31ac26fe5f6234c75c07c77cadb75de12d2bde5fa636b064182dd1ccb08547

SHA512
86cecc18c1cf6de80cb82f85bc36de3b6dabdcb2e3036ab7a375e345a7937cc1952ac5e0bc96a2acb2c25853c1ec87ed99fa73700b0372469c22bdef82013fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b16a5c1339c01df5cb7f65a743bd758

SHA1
69300e76e1d9e7735c1dc7310b539539c54a6c32

SHA256
71d3f0acad2adaaaa56b113eb2757275a9f5036c33f8df82d4d670068e639686

SHA512
73dea027946933eddf1c5588c735a12aa68699b388aa26d9efd7b7eb0d692d2fe035511500571d461b46581d92268a5460d2e0169c51e491b96c16ac9d82ab87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86e285000b257a34d33be100a6e0fb79

SHA1
653d880a5f65310dcb0ba1f09ca26a7f0580a54e

SHA256
1cf7554eb0bf4fc9614c3b0007c57ecda3703f0795f609466aa6c011e28a0e1b

SHA512
9d7e3eb80ea75af2dd169710e9b314a0e9d67925dd6f1f36aeca77b44915a0421a708cb08d904507b67e37bbe7a222c9406e8134e366be70c578f159ca266ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53f0ae88d8a7f65816af87ae6262ac19

SHA1
6da6dd153c7e44b404513887b4f391d47bc457c6

SHA256
e70af0e378a4c806a9960220fb549aea74eb209cba1c70ea2b17b48ac17c766d

SHA512
697add7fe4aed9ccfa054156ebddcfddab98726282c568f0c03aef06f29d9bdb79772e14576fb40b0e9972574915b84de960e9e65f71f532414f070ccbe3345e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A5D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B2A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B3E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit