07a53bc452b5963985e0fcee49f8527075c5cffe9cd9c4550c75607f5ff94e1a

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 21:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b155fa25857bde5b6d5c819da5d53fb_JaffaCakes118.html
Size

27KB
MD5

6b155fa25857bde5b6d5c819da5d53fb
SHA1

a25bb52a6ce8228d7f24841c02e738c44a855270
SHA256

07a53bc452b5963985e0fcee49f8527075c5cffe9cd9c4550c75607f5ff94e1a
SHA512

649225b24ae273b394b266e30fd828202088b86626346ac49b7fbf237628c182689c7a6c5e9734c281deb46ea8cedce925fed443d98e17adc581dece2f06a8fe
SSDEEP

384:9X/uAhy2pq3jbvGhqofamfQ/kW2sdaARiG2XaIr9SGFZdQdELXxmRoJSCmSAyt6T:sgqTJz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422747182"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B65695E1-1A12-11EF-970D-EE42DE2196AB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3044	2100	iexplore.exe	28
PID 2100 wrote to memory of 3044	2100	iexplore.exe	28
PID 2100 wrote to memory of 3044	2100	iexplore.exe	28
PID 2100 wrote to memory of 3044	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b155fa25857bde5b6d5c819da5d53fb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43e0ebc2d685d6617641ff35f7dc9e05

SHA1
d77e1c2481a28213c6d9302743dabe26638cdde3

SHA256
89445eb41622526b2a53c5084bacc059b0ee1af8b6dccecbfc8a04bb323f65dd

SHA512
f1a287b9c9ef7a5e87d5d0d9f8fde5c3929e3773614f84fd78afb0c14c032f3b60ee3f2cf8407a817f48a899c169049839dac1d8c9ae1a9b7fc4e2ab63aff675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02c5928243bb88be06f5ac61707f352d

SHA1
9eecf93281c989fef01d64008af9a8fda8d75017

SHA256
57b432f909f9faa412c4e0ad376c5dc60c7f6af2f3efbc7f874b8e02ac29be17

SHA512
615051685bf2d4882abc01c2282f92ad2e2b52d51fd0a0f6f66233f2944732f02885a3d43fe84be60b553e3b5ec14366031672de4d534e06e039164d1686be41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c006f9ac418319cb5ad52cd141424911

SHA1
7110754f1082232fce35431b07db060f4416492c

SHA256
6a110d51b7e4ddad88807f1ded2cad7d49de3baba4b5f616218660a70581ee37

SHA512
974fb172762ae5370ea7a2dd4d663ff5a663e733fa1024d7dc4fb280db29d705d9638134f39f7fa948ca838093434fdab387eeaa2e91d7be71e2783aea5fd3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf43038c5c110433da3dc7aa0574c4c

SHA1
817dbdb84ada430c3815c3dbdc8cebe9dea7d296

SHA256
bfcdfdcad33d23dc0beee4a26fc805da613ae012e0ea2dc3dd6c9656fe32b188

SHA512
570c504bf0aefb419ea1ba3e371a2cff39ba5eb3c6e038381a8f24d4ff0dab2977898dd459e812649eeba4ac88ad5d2b62fda30d9184f7afc9f8165387574ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8165e918de538a350443138c2652880b

SHA1
89f7a8a563fab183caebb7330b62c6f3473e1ec3

SHA256
a95fffca11251431f67fe7cda2707661ef26290e9f5d02015fe4aa9c17f6e042

SHA512
3570c667823b20e48e8b580b7826aa5182a8f415f3db8e1b8509908e44c7d0c63b0ac7dfae0975614919a4f5fb328d238daf78a21faf04bab10b1f5e8130d7f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de64ee066ab899ea4cf96cd675486093

SHA1
7963338af9770d1629dc78fb9858432c0d6af910

SHA256
ad27e6f105af37740fc40c2859f5340f14eba07e16e30d46781ee33f8ee56149

SHA512
aadec738749194c627897cb95a12dea8d36407c24e207c56647b88fd9b91b254ce14a0eafeb238ad6e72356d82bed64927a7923d70adfe9834fd61d653ba944a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbc2da65403481536b449e8604f887a2

SHA1
3457056605ee684d83daa4f80ebe0c454585b600

SHA256
e7479b2860e3a8000c7934768907381f866128797617dffa898bd4ab522be3b7

SHA512
4077fbd4c461d27c79679e5dc30ceeda850572b5266b94b7c12d18335529b10a7027a83775f5fb04ae3bb904b705e6fb2c54a303cfb4b680d79bdf0e10238c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0b3dbe8616b7f79357f7bda7e8feab5

SHA1
16496ce60b95bdad070683f81ead9176112e2e96

SHA256
26cd3fcba31672a20cb4e946e32d66ad2f34dab9c878970eede4673ff0358a34

SHA512
effa90ed43f7a37b12b4a4df204da004826e489b19371ffa8dcfbe4c247c8589c94165dd87be7f77252cafb0a25fbf11eded125ae9aee01ec9914c3e0d1a1d12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7163cc135c14c3784809775858df398d

SHA1
c5f5d4a0a5c2f46da324087c7ebf39d8061bb926

SHA256
479e82abeffde8c8db1b51d497a983e1bc7f9b3f7e171a5eebb3d8b74aa3fe73

SHA512
2466a5f30c3a32b7c29bbca57e590d6c5fe99e5bd2f1287a6c362a6403400c483fa1eac59b8a6079bec213d3b1bca49cce8886e0a0849e0ea1a3e17fe578d36b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab79F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar882.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit