43440139a78fbece60c16924a09a5bb2aaa09ce41492b8916724b2996b67dc6e

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86da5f85f47b21f6aec0f1f97e6c7535_JaffaCakes118.html
Size

461KB
MD5

86da5f85f47b21f6aec0f1f97e6c7535
SHA1

be4e0358e7972c4c72de87d2e423a90a1a10c824
SHA256

43440139a78fbece60c16924a09a5bb2aaa09ce41492b8916724b2996b67dc6e
SHA512

012b23bfa951835a417ddc67644792513878f7a92ba8e3b7c7353916847e98964e696f3a005ac3d06a54b5b9f38e652562d5aa8caf9c5f4cb1381eda8db7739b
SSDEEP

6144:ShsMYod+X3oI+YYQRQVsMYod+X3oI+Y+sMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3m5d+X3q5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423317107"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101efc834eb3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB09CC01-1F41-11EF-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008374590fb3c7f044a227eb0498edd3550000000002000000000010660000000100002000000092d3416ab4834d43f298e1d575fa61d8caacf2808a8b77fb1439f822c874cadd000000000e8000000002000020000000e4db7da597a64c864a499287e392418db016da03f1ee2da8dc2385865a4f1fc720000000c76c0811fce82d9229d4d3f783039e72999ff63ff3da3468a55b31e46d01d1bc4000000034cab344550bf9f92b8bc3c7c0adc3971b0b92eb96eddb8477596e5850d1c6199406a23f3e9b4c86d2cd806b1e974bcbaab19a10ea3f04a8bd7501369fc140f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008374590fb3c7f044a227eb0498edd3550000000002000000000010660000000100002000000052e934ffebd35e00d641e4a422d07a9cf92194d25c70142534ab612967253081000000000e800000000200002000000008c6207f35d1c328f6ce5d1856120f53886d73c73012e8417cb71456c1719ce190000000af20159977fc09bcc911f054a26332855d85d525c55800f799c56e00dcfd662cfc205f9728072675f83ae363d07ad07b8ca1bfc61abf7a90c5202291ca8212d0770e7f6782ec00dafe06a2efbab74d0c682e420347635ae40326589d474fa79d8fc6928b2141c057fb84c720c3bb47751abd677545fada88c2dcd275dd3b02e0bca8f3ecefbdb262f9a98ff5c63eeabc400000007facf0356194bf7a3179128ba55d0eef215b88bfb4c46b5040d5f663566d8f638267217b63141de2b0efc033998937c2a39d9b66bbdc46d087ae67a2224e74fc	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2164	1960	iexplore.exe	28
PID 1960 wrote to memory of 2164	1960	iexplore.exe	28
PID 1960 wrote to memory of 2164	1960	iexplore.exe	28
PID 1960 wrote to memory of 2164	1960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86da5f85f47b21f6aec0f1f97e6c7535_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20c42049f7998f98754245fb70b2c2d5

SHA1
3060f0c37eb825dffd24d3a79c3b3360d3869a11

SHA256
0941d3c3fecea86cdf2593b209094831f19856d3a10ba4a7a2de49a30f23e81f

SHA512
dce414a4c8b26cfeb6275fbca645194de4f125ec34dd4f9e26f4507f48620361fa4ebb18ad770139473cbdd3e8785d0c0e6d64ac8bc512bc345c71915cb566ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8895913cf10c8d509ca49c1ed3fa9ab

SHA1
dac1c1adae53980d08ea33f7cda9f5e10addd289

SHA256
d9fa3602e6255c38ab04422712398c52715270ec7eeeab0072935966b7f47864

SHA512
f372ec810aaf1da16f8dfc53df405ba271550b678b209c5445df24d81fc31beb45250b9d9f34f8db4713bfc55872860ec16d41cfb2ea12d1cf393bce8ceb54ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da0f3f15434d26a665ce640a1bf214ea

SHA1
14298577f8c643907f64e54565c16b2707590d14

SHA256
d07dd804ab4003245ac0a3840a763a77e42d9664a9c1c7d8727bb1eefe0a913a

SHA512
aeaa799b50a50b7e8941e494728c5dd795626dd3468c716af97ca44034d14e18479746387c51636db4f859261c17378eceafe5172d6f80ca5f85107acb4dc2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5099264320ae265b44083197b4261754

SHA1
022e39963400a8273e02ce3ac2f8bce4c8e7b49f

SHA256
3d0af5fe4852755b470c7d769275bb76a240b826bd4e4509549b4fd66c505f09

SHA512
b86ee01836dcf0cc0233559ede23a332609de3a8b6129ce719adbae738b20b51ea97a753e4ec991ec46355d9dec716a31d23b1b70c21edfb414d6bbc0499e52c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38c85820a66b2066653db452ae74ac32

SHA1
8c6a72c5d8295c122c6808c80ff6d4817ab5f419

SHA256
8ff5bbb8e1e90d8d296b478c7c7cbda002052087b58a6a55cf65910a7abe1429

SHA512
86db8d3c5fc380787dbe9fe3517f908f3609799e0ee40e9643a0b323d50ef5243031baea2afca78f6571e944a9c967cf7eb2d522038117e8fb840eeb53b88fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6cf5eab14637bf7143b212b05d0b81f

SHA1
7ed749ca0b58b6c7dd5229bf088746c7319ee3dc

SHA256
c6b821c4a42c0a392fb456e1a13836f9a4a060ef92cf35fa5118bd2dea091505

SHA512
08220f42348749eda76e58f293547792bb99cc8de942a6d81f1823a469754826faa6e6c5a4639a278ae9551e3fe8895f5ac2d06450ad21a8f03bf2d1184e50a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3674032b79c9d4385521cf13df22142

SHA1
dc3d8ca7569a53f1f12ffb2d0de439941f462873

SHA256
ab90d48ce94382d886d75aa1d6579b874dcc3783d207f3493b7645c73bbbae78

SHA512
da3c798268b99a7c8ccea067ca90f44dd93adb6c18bcfe88d2b45478244e083d07da73e03293b6195ad79993ebdb6f7fb38161e819858cb5284cfc653228c777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2758320fd809438445162f9c88bb7db

SHA1
83f3f1c68c1292b93dea102f0d8b4d8fc13d9592

SHA256
a94674b73994bfa3eef5ca64746490e5d335f01aaa6a7c8646a667b688dc1548

SHA512
c6099bba529b7371129c56bf07b61cdbe9c576b7b851212567cf49b68ba403a12383189b36989d182da83a80a8c506a0cdb5f0062bb091396f8b6ebb04ce38c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cac1a9c5a2bb2525e0ea1ad2fe75b690

SHA1
fed728860e1808678a8330c944a115c833f97e54

SHA256
9c34e1e7ae90911847a9e59ead40655568dca0373914d9a534f10f19fa736573

SHA512
17ee6b33401e1b14ae7380ff70579a5fbdfcd10ac076d0447b14d11ccb0102967575de934d8bdfbd5ce060b02425b69f17df15455b09d977bd68f708b9d173da

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA3E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB6D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit