0450087ba1f00df83634684c67bc2fc494e6c6c162a50cd3c2ace4b0490d9f01

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b81b8fcb77e86f616e108399f520f230_JaffaCakes118.html
Size

34KB
MD5

b81b8fcb77e86f616e108399f520f230
SHA1

77f6c71047e5a1369a27b3960634cc9a81350b23
SHA256

0450087ba1f00df83634684c67bc2fc494e6c6c162a50cd3c2ace4b0490d9f01
SHA512

f9413fe30a5e9aa743762c6b7324b14baf2b2877c8695eec9ad0b770bb7742788f44eefc6124a5200600d93e67015f4b25aec8f3ea55269616e0f4c813dc5196
SSDEEP

384:nJhSI0JXm6P3LFxhDVJstr1TQ/kqS7C7M+o3gEC+P3w12JhGTRTpzBkOwfdyT9+y:32r12fIpz+s

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{333811F1-2C93-11EF-AF3D-DA219DA76A91} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424781488"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2600	1684	iexplore.exe	28
PID 1684 wrote to memory of 2600	1684	iexplore.exe	28
PID 1684 wrote to memory of 2600	1684	iexplore.exe	28
PID 1684 wrote to memory of 2600	1684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b81b8fcb77e86f616e108399f520f230_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a20eb778eb96c5a13f7deec8f4070a6

SHA1
d831d0efebba1571c53c6a7c70514c27ad5103c3

SHA256
5759aeb343f13f44236654bf3dff369cbd37c9a95f4bd7bff0ad273f2f46f300

SHA512
0efec08409a6574343bd86274dd0e65ee698d4c47510f7700951fe851516ec8c91799730f7c66fa01745af86e990b5c309cff64f4a1c9e11a04f6f7e85bacdd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e9f0ccc4ff2987184b5c99015950b5d

SHA1
c27f3d96e2cb1023aef6b022ea9a875653e9dbdc

SHA256
28bd30e23ec1aab7b7664eb6f7073c834d2c9b2b12cbb4f16335b6f1323546f6

SHA512
1bf95d6cfcb6e8cc9dc08c946e37d7f769fbb1dd22a3a4d9e90ef075636ad55eba1e30065d37b41db2506444744b6f09c23eafaad99ae3f9c2a8e84474ed26f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba88a6cf04465137185e353765dfe86d

SHA1
fc2c10392cc495f44665b64eadb07c5687d70530

SHA256
6db9ea2bc93417e008c10dda2dd22f79c7b67347ea7a9d24f0a591553c69d2d0

SHA512
1715184738cdcc51bebc4cceaed0b21b024e0729cc60428543e8cbe51486d3426e9cc0f14b567aa8d5b509253ec19731519e571e0b8437b4b5498a58e97c0780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c8d58e0aabe25dbaf1654b196c5e6e9

SHA1
3c5229b61002c7d848e32e2b92cd9e6303eaaf24

SHA256
61d00d2f68eaa1bfa73be01baacfadbcce8ee6ac5519974b2f960aa0a9f8d83e

SHA512
616915fb72c321241618cb00c39cfdaaf6c46ebae9acbf9cc4e29ec1ccee4a6b49839b30aa5bd41a3c197acdf5151920e06050bc982c0e1f4fd2e4608e12a939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
939c5006b016681a694bcf9b79b28f14

SHA1
042f010a0b01ec10ad11866b4795adff4fe0b94c

SHA256
8c4ea0550f69a37db063acef12ed20ac304412e7b7965d2230861da9fe324000

SHA512
7d30b1e1bea7c9c8ac52a192fbba790490730def332f42ee2415bf953d7171c63a4f44f43a6b5fc94f60cccda352df306e7ad0e4291a57cfa4ae2fc5b8704681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c236d234935e04eb40fffb78ab70702d

SHA1
e8a9897605175bdfe2646db9a821c439f96c6798

SHA256
9e377b845a519d210c4a5a926d9b96da51921705a531a21b457bd4dfd034848f

SHA512
d7d8ce8bd709d6c5dac6c4a49c28932c0cf43178e9e7351dab7bd1ea8c945b025e9961dfb5706be03ec25fad8a51f5fce9b517f2dca55247ddc9a21b48b17b1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8bb75974f47b1a8431809571dd5c1b8

SHA1
ace28930b4c548165a533af3b8cf5506900f8094

SHA256
65cd463638858dbf5f1c97ff2016a93bcc3bbe6f9338b5af96ba0adeb9adf240

SHA512
66fb252b0284b78f7a0f9b55960d7d6a4f05e36c571eb3ea4dad73f3c16cef77500a445c967f31e65bedce2a64194b6c105c525821f348e759850edaa9a2ad93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7f55f36efa0e1b6e433f996fb637b12

SHA1
42d92d5fea0caa35b61af9e9871b5ecff2a7eca4

SHA256
c1e8bad2d5ac0a6a8eed8c76bafcbafc25d7385fd87a66ba143e431b2fb69507

SHA512
b57790dc017d8f0eada75c56e6dd85ad94be33505c03db048b57a366d2aa29360c5de3526177100f209fccba3401488cae9cab8bb6ca4b1d686a3369ce28133d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b2d775d2aebd791c7d37437271deefc

SHA1
ec0a4303cf147704fec7c2eaee5a0e33c2a63bde

SHA256
d84eab06f0e3042d6b3c2e8f1a74df103083064f852b16dbeb274a9664eed21e

SHA512
aa0500b20db340d707f03ea5a86f1eb4bfad31c5a25c49ff60acbbcd67fdf86c4683d09820038af0b63d919b166916b57cc3dce818cc6bed2fcb291d8445ca9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2849.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar291C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit