2ba9f0e1b453d609a0881e3ac2259c6f03b1342e3bcdaf40fee6581b86a32d2d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87b54f44d37fbc6956a61835e16e4112_JaffaCakes118.html
Size

28KB
MD5

87b54f44d37fbc6956a61835e16e4112
SHA1

3e44b761d22c8619f8ce0c80709f277b725ce1ad
SHA256

2ba9f0e1b453d609a0881e3ac2259c6f03b1342e3bcdaf40fee6581b86a32d2d
SHA512

b62a35d6d6feb629e6f1a3e68f0a69ef52a8eab918a28386ab2096a2742d41a55f94a4247956c0538e4f272d47efdff578e451ab32337d4f65d9adcc57f065c7
SSDEEP

192:uwXcb5nLIhsnQjxn5Q/jnQieCNnwnQOkEntFtnQTbn9nQ9es6m6ehU+p3Ql7MBiB:LQ/sFSqU+8Sa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24ED8ED1-1F6F-11EF-9CEF-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423336637"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2020	2820	iexplore.exe	28
PID 2820 wrote to memory of 2020	2820	iexplore.exe	28
PID 2820 wrote to memory of 2020	2820	iexplore.exe	28
PID 2820 wrote to memory of 2020	2820	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87b54f44d37fbc6956a61835e16e4112_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0074c93227f69e55089f0800c17ede80

SHA1
75d8f2bb52706e219b9d1a5b7cbc0705f7bd7d07

SHA256
fadeff2f8e12b9e7e947c4bc4782942276e4acb3c562cf814b8c7baa4eb1430d

SHA512
fd7c19d7fec17d3317938369bb8dec494a1d40add0f4e7b88d79a70c7e9f5fd3fa75e47000f4c1b180e1b5043ed09456c5ff78b159b495467f409bd9fdd9d8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e908771fe3c63e1347f78d553c93e715

SHA1
9eff9c8859391d516cc716eaea6a3e5d71483290

SHA256
efa26ece3d58d5e372b7da3feae2fb7e9b6445df1ed1107c0f9d8b5de2a0f9ad

SHA512
dd8480d6e3a11ecc8cb68dffa82833d6fee9b90954f2aa566bebd5c0aacb93d039268f4e26d73483251c7548c9bd0498068da145429bfe91a0850b84846c676f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0be5a443de542c9be17ce7668a4a9964

SHA1
e578686b414c4d4b23b7eacde542d793209f83be

SHA256
fd249101780d78c8a0340d783af7d3cb0de64b1f8b31d91f652eaf583836629f

SHA512
22d9618a7929319d6c32d10b783eeb26ac090b6402d05ce53e4ac5c2439c44420a062781bc9b75d1afbdb99fd9c6dfe5d265515a0b12bb4da336bfb3b4ff39ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae7cda34d7a5851a80a29831cbc6d35c

SHA1
027b0047d5fa82f9a0ada6419b757f01ae15d86e

SHA256
67a66daf3cd76be10f44661a377f2489666536f2c1cf5fc756433b6baa2a3726

SHA512
d7093e5fc335dd500b8779bfd93019cbc2192ac2ac244ff192d33049dd328c6245579668be2e8879dded1f1eb17b2054a7c880737a7a56bdecf735ccf2294431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa8f218fae7180a5deff0751051844dd

SHA1
e7c55b844d932eb30c757a480150507341aea607

SHA256
878418f19143dac8df07cdc73ecdf6727ffd892b77b0bd1aac994ffa6ad1bba3

SHA512
bacad0b566dbce739ebd4ceb900efb0ac2eb0490394168e5dfb351dd6ff920625a062cc716a293a354754258bfde7874fbdcc86b159e0c20ef1d8a939f434f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a416c93fd398c4db6e027c6f964d94dd

SHA1
58a36ad492a9fb0f173a8c85af0e7a8ad36bffe2

SHA256
6c49b14b5560f3398a0d3dba6ccd1d49139ad231aec3854345ba678b65f4a277

SHA512
61d70b7ceda6745ca8440b114179472b1c47065a15b3a300c94ba4042e1aff3f7a41f8ab8da2fcb2c3b1e16f03b21817b0b7451c99e43f8f6b5963b87eb0fda2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06c57bce9eac5797edde3ac393a3f939

SHA1
583fcfe541a2e6f1ac72769cfa357452d8323e37

SHA256
82544a3b142189a9082741b0221117eb31704008fa665a910fa97865d7bce722

SHA512
85d4878ff64a9d89fc4ac24b6663b04dbedaebf17eeea24c450d6184a0aba8b00af9baf609368eb1d5dc48dea75ca50a348d3edd296966b553ffb86dd352fdaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00ab0a3d26618c626a000c0b764d6d11

SHA1
83f69e520616fa948726f98c53765449c6c88cdf

SHA256
3dff1873727353544bce8fd9d412d6114d7e970d5c8933408c1ae00fd9191cd6

SHA512
36e45b692381965aa27f620004c1d34b1a5fd6b570ea9f3f5115b4e909483c8c2fcf7cbe7f0e6ee1c3f6191e841055958b50ceecfa534225e1ca10611ee0771c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2252.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2333.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit