f4c2c5423a440dc4444b4038a0880b440bbfe9d22583468aa0e34817221aed2d

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87917719f4d389a5d2066d2b095c0717_JaffaCakes118.html
Size

23KB
MD5

87917719f4d389a5d2066d2b095c0717
SHA1

07945092ac22b930e180bb29c3a8a7b55ea7f502
SHA256

f4c2c5423a440dc4444b4038a0880b440bbfe9d22583468aa0e34817221aed2d
SHA512

c915085c626066f9a7fe9b1f645bd2b5193a5f1f5e250bb158ab0e305e85c7678ffe29bed3210d28dd874aac62a2412abdb70cdb1f7be62e485a8daaf52733a2
SSDEEP

192:uW7Ub5nEp2SnQjxn5Q/wnQie7NnLnQOkEnt4ynQTbn1nQpCnQtrwMBbqnYnQ7tn5:UQ/ppMX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3181C741-1F67-11EF-A692-6A83D32C515E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423333223"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2124	3036	iexplore.exe	28
PID 3036 wrote to memory of 2124	3036	iexplore.exe	28
PID 3036 wrote to memory of 2124	3036	iexplore.exe	28
PID 3036 wrote to memory of 2124	3036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87917719f4d389a5d2066d2b095c0717_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86aaa184b03368267184bbd380d80250

SHA1
1e2fab677674806bbd31864047c93317db350e37

SHA256
498c2df8260cc96b8df58ce8162d72a238dce6da9e8d349e9183e5a433952c90

SHA512
90da5f03f2890ded49b727c0402f5b307f5dfd6e17912a41a5170496d3da35c5894ac769a8c84877e394f34f893d55466b0a872261366099cfa1b82e4c4a40a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47a03178f61ad58ba5128cf63523e15f

SHA1
23ab2777a1dde257bd3eddcc9e3afa84b49907a5

SHA256
bbe1c4cbe214d5d576621befd133b4c8996480386027e10b00ff2fecfef443c9

SHA512
c6a3c1bf7ec3f14fd9825212ba8c6e84c6ef4f648a397308a8a09a0b96bd61be85fe6d04f8cb55ee680413302181db51039c1a42da57a1686ffd730766763ecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
528a76ae6fee5e6f938716b820a57549

SHA1
03d9dac502176bb70aa548476e9b21b113bf8b20

SHA256
494957be04f8d3062c53f4c1ff7f0874f24a8986c80961c0ed6726793251c338

SHA512
975a3d6961d6a8794806c4237d0147efbe956ebef937694babfd5d011699797cc76447d64a5171aaf525713cb5e6d76ae2ebee3064004b52be10139970d69844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1651c56f2d63d9c056c73d357673253b

SHA1
8d7a0a57a485069405fee030b9ab678df8ed174a

SHA256
b8ee51020c2f35453425747f8c2ace826fff6a5628ffe8b2dc8a72135c5854cb

SHA512
dd6729714b69f0b91cb9471bba9f6933c08950903f61e81f0070fd8b2075c595a6d22ce448cafe855da931082a47ccf7bc4fa60269d5f5aa22d209cece178ef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2b6bbc899d60cfa4903ac05b4abcb19

SHA1
4dce2b66a6220b7d29b7e9ebfc9f3a602c7bd202

SHA256
958873b131445d2f37671bbb62f9871e6afe90837f2087ec30311c6dfd2ac3f9

SHA512
79a800421c14801dc616d855b7175cdfc6d281f31ba368fd0a377608d69df03166a958dc16d769c0c30838fcf104ea55970638e139d1ac275e53c6e747557774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcd79161c532b434154ca59462ca7802

SHA1
65fd5c6856b5e76f7d88ab998f96369077d8bebb

SHA256
aab75685a9766b900459474ad61891f2afb1f39f0f5cac3dfff6e931af0b97a8

SHA512
eb7deaf0501b4d9141453e1a6c35ecd8b59165d0b920a2cbf5c25a44085b4a268ef20177cc955b0b6a68c810054f55edc6bb3b9048c49762434cddbf1957e850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8542f10402af9990f131115be57d634

SHA1
f5d504de9cc8ec007685856d834f6c8f52b9d01e

SHA256
26b71f45ac30c6b79ad4b283c8dfa4d4f92ae802e52874abc2a1c971f7d36aea

SHA512
08ec7315a8ff8fb0f9f563f368eccf7e2909719781dcd9aff6104ddfe5f53c67fb7fcd60362778fd405d42d1c9a10196260fb5d1cd808660ec54accbf41526c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50ee6b4ef6ff4c862dca15dc33cc7e0c

SHA1
6718a0f20890305290f4b1b90bdbc7be3052ceb1

SHA256
a89bb12a29e1f40783ad9ff9c9baeee4c831749c325327079c6c7ed96d4a418f

SHA512
aaa3b5df2390840e5252a966ce337ecdf3f5ed5eb8166b5cb4d2c526d2555ae3b0df75f613ebea721f900a4704968fbaaf4c84fa90ac03bd32f894c7868927af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2134ad44119e1a90a9ea8234e6f7d88

SHA1
89eebb0f9a11091e0d6be4334014602d7af9d436

SHA256
bf496c3e809fcfa9dab8c6a7ea8cce636f294b32985a95e77fcd5358e6a3bed0

SHA512
392950f2ea9f961f42d170b5fffe25819c22861b660fc4e04db01b8dcb2784efc1a0fcbc79a7f4dede8e951f4b59c1851351742cb9bc6c381614fec909b3efb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6EFB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar701C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit