7fb430a9635d2148a711923b277bc1b154a5b5d9915c4c56cf18d6e5811a094c

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f0aae8553e44a7fc495db0c8b8522b1_JaffaCakes118.html
Size

19KB
MD5

5f0aae8553e44a7fc495db0c8b8522b1
SHA1

0edc6c1e8bc820e08cf2f84af13a80f4798ca627
SHA256

7fb430a9635d2148a711923b277bc1b154a5b5d9915c4c56cf18d6e5811a094c
SHA512

2f234b4d7dc57e49816e820532c5506bb04b13f823f7ef2a6fc90829e5c51b527f2c96ca1f6f501906bee8a285f3a1f2566f94764ce84e0d5fe63d2c62d6c6c3
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIO4ozUnjBhcG82qDB8:SIMd0I5nvHrsvcFxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71A3F6D1-16A3-11EF-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422369541"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1308	iexplore.exe
1308	iexplore.exe
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2032	1308	iexplore.exe	28
PID 1308 wrote to memory of 2032	1308	iexplore.exe	28
PID 1308 wrote to memory of 2032	1308	iexplore.exe	28
PID 1308 wrote to memory of 2032	1308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f0aae8553e44a7fc495db0c8b8522b1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fc322b60dfc68c82462e960ae6647c2

SHA1
d0ef4397791e60a36ab6ad1f05d63c7280075eb1

SHA256
946b076bba9793dbddc79d7a9f44f3c95d971d849ff5544951bf5be07e9f3ce8

SHA512
4aa330dce21b86533334a37826857a4717f9bf8f4cf465bf15e0ab078135f90e8fe262e7cc82018849a5aeb47a3c206b23ad6a419f758d1fd18a4c2364aca0b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfdb29587c14d84bfecd22f48a8d5ced

SHA1
4c5b1680d3c1379c1e60608298087f58b717991f

SHA256
cab2ba4db794eb8eebf13c6dc96717b48cd40c100f0418b216ca80076193b303

SHA512
785490acd3e7ea3bd4e2a07e7c293100a190dec79e9a1286b68e7fb0f010fed622bb79760d33dc312bb825519e8c770021d05dbc395c26132144ac35819ba2d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d706ff6edccb1b8d489655cea1dc56de

SHA1
84fe4358520a237dfd1a7dcaf6fabdae360e6095

SHA256
8b6cedfe47ade72bb3f367093a92523f9412401023048c9b04245bffea479e35

SHA512
ac62419ad60e7b5d27c35c1b9559642f4a6cbe9c1ce6880f4f459ebbb66a7cb33a9c15a3b95a3212a7f7fc56d7f4cbfcf087738fc85fa997a9ac29584fc52374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
647b2a33a2b001c070ef1253cca248a9

SHA1
6731a291da9920e75743db36dedba00736f2b434

SHA256
417a9620cf66b20a681f2ef7f06afd783a0c58ecf5ffafcd3fdaca90d7d1a8c9

SHA512
c3a5e95d32cc8008fd3eaa25a621e4c3e8e82b5e8a0fec7abf35cdb72ab3a325d427c2f218ca7a2572e51927a2e96c4abb63906768f93d428792d07dbe7e5e64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25ef1f3dbac66f99cf68644a407f0e7f

SHA1
94e2a91f598437d6d202500e13150ec07fd6ae93

SHA256
164d3c0cde89b8471ba88a8a911e6d69e23cb935448e4c815749e15c4573d5d1

SHA512
e89466e6774605b29708bb545bba96a660186a14583ee5b0800ba915b059aab39414860612976f6c2846c6e15a668fb7f90d106d3de027afd62bb286a341eb5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7249a17a7c7e6a44da9a46bfbdaaa8f

SHA1
0bf6a58289d6db034c3daad5608d1cac07a17b9e

SHA256
32967635f1f0456f57221e59a7db5153d70b2ffcbde87730fedab58013164d28

SHA512
0842b6e3ffc9e5d159538c385f04e4aed0127dd152656a20275532340aeb43fe09fcb4cb270949cdbe80e92bebe7046bc5388fcfc5482ddb472dde4e4eee3385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0476646c4ea2d52bbda9f537561f6cc

SHA1
be3986fbcfb231d38e112a460da2f1bb6ff33ef2

SHA256
5215bf612d8430b39110e37fb9071c43a84efbb2d5e7ed833aea800448c24d24

SHA512
89c30c9b1b6d301aa4fabe3396742380ad585a8591d33123678884a2677b574903e44890c1fb72d17b31633d595f03d2d862037ebafce4d606d5043067c5ad45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb9c3824f92b520001253e5af489d2f7

SHA1
0152545d68fc0841228a412d78444ca907c1059a

SHA256
215bb6dd6a821c12fd3634dfbc3fcc6b82a3c1576f77e156be8d7a5498cade16

SHA512
2c5f4b837dadc829e8bb28e48210c80405ea1fedd9597351edecdac39957f165586d41a5da828f7685909299b6cfcab4193f13b54d64c24177cdeb1f85546b5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8AF3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8BF4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit