7a6c04da579257f727bcb23d585cad406b98e080fe0b713eb5633959e69dae28

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1fb77a86efff6f4ae334d6a2fa0109ca_JaffaCakes118.html
Size

18KB
MD5

1fb77a86efff6f4ae334d6a2fa0109ca
SHA1

a9ecddecf8abe9b1b3f763211ea6d964cab34c86
SHA256

7a6c04da579257f727bcb23d585cad406b98e080fe0b713eb5633959e69dae28
SHA512

deabae6ec490eea9abbcfe9a4da8943407ba8878862c7a768d0d713af8a59c72e65e02bb0c47a5a7dc448c76bf973b77f78870d0363de36f0e3bf86b1ade2b06
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAUF4lzUnjBhPR82qDB8:SIMd0I5nvHPsvPaxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421224609"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B21D90F1-0C39-11EF-B73D-E693E3B3207D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2928	2156	iexplore.exe	28
PID 2156 wrote to memory of 2928	2156	iexplore.exe	28
PID 2156 wrote to memory of 2928	2156	iexplore.exe	28
PID 2156 wrote to memory of 2928	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fb77a86efff6f4ae334d6a2fa0109ca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c65add862a5238bd23171ed76c955ebb

SHA1
f2213f7f0289a9ccac90b5ec9a0d328372020d9f

SHA256
0f1c3b03d62fdd3b2a4776fc19187f24843a538da263344dc4fcc04a0e54d48c

SHA512
8b239d3b0301df8865934d388ecc49e0c670fef129149826cd6dc32e54c82d1496c4c09213599d787b93e39b45961c7f179d4af7ea59770a7566a99852fa30e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
474a2e3947d94b7fe80a3c2c14d82906

SHA1
56346510d8d3207fa807711877a5216b9cc19af7

SHA256
15408519a9b2803ed942f637383b8b5ad9cf162590cf9845ec7fcc246934fa82

SHA512
d69b5df3a1503fca4edb03609a4808c71990450a25d578a4a4df3611e1f188fce97818c88188040c26cd76fea3c09aecfe498f232db6e20104ddd8b389a1d671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03af8adf8d89599b514018de77469753

SHA1
3f6e0def662b3484fa55d2fd03af1377028968f2

SHA256
b32b34f9419196fbeef6b5d21ee1d2b61eeda33438186e76fe6b7b962e3b03fd

SHA512
33d7525330d6a2032acf20df05c7fa76ab3095ebf68ce17624f81b5389856b278326df8003305fbcb8a7a5cd19765714e1b5b3463b85f17674c0ff9e0ddd9560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5317247eaea871b2220cf0ea857de939

SHA1
e51c4d1c0dda061548cff8eeaeb40fac26967c94

SHA256
3cff2eb9181f189378637311588b08450093bde42687a4dfcd7df1b59da574a4

SHA512
6fb654f9778ea2d589a1cdac83650fffa9a3f1c9d6bb0b6d1114ac688e4cb2ae7c717ca664234655f0a688a8bb7caef71f633dd8abfba2a1b97ffd594eac440a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36592143c331b9ec683d690f574ab709

SHA1
653214ac9b25dfb6a79b5eead9e915ce2603ece8

SHA256
918bb1491b8ff7c9c407be737038fe90cf13ffd1bdd0af4637fdd69a54fc3e0e

SHA512
28c846d48bd14e771dd2893659d8400fe3da42594989823b247465f6e7e328ea32d278d280717b3a79e42eaff912a0bdedb7cda96d7d059e3a6cc6395c85457f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04804cb0ac31b5b7de68b5b11cbe150c

SHA1
a1f1d9fe14d9e9a4bff150646d6d2b9d5de6bab6

SHA256
9e568c69ed0f31ebe7826f1acc328e396180f5bd5612641d3c9b699ad487fc22

SHA512
a30711810613676a3a4ee8b4f40fec4cfa081785e39f9050b6506e80b5a0dca1bfab51ff6ee611070f35aa4a6af2d549341246567d020f44c272892e40b0330e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85ad15fd1e26065ef1df799f5d368195

SHA1
51492d8e67eb17e81c53d4aafdf638e8a117605d

SHA256
1c67d58073460d2ad14c5bf0458c642fd4116332ecd9f90cdb3194de00f991ea

SHA512
56058c1b11e33ea0f15d999bba634789e4eadd6e898700df3e3ae291dd3e5d0ec4fef8e39a632443e3df2b4f14bcf4611d962129bc6b968bc459d76506452e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b57e1c1b5d77ba603052ac1b30e48c03

SHA1
05c53c21dde7e39ef99001fd08eab1882b21a9e0

SHA256
6f60825de7d4ea8b25eed0578743bd55b0908178a7e083e14e8f04d443ec57dd

SHA512
be077cb5fbb038be21fb5761a045fe8b88e7fdd275d8c1ed63edde3b65eb50f8d813ab31e90b50d229540feebc424c639e6e825c51f6042cf8bb0e6db32b9715

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA30.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB02.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit