3e5a78a4cd75c2cc2aab7e4d0001c4db0f1a13f5608f62f72018a5ead30bf039

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7519f3b25f01da7c47b8fb01e5630e82_JaffaCakes118.html
Size

27KB
MD5

7519f3b25f01da7c47b8fb01e5630e82
SHA1

afce3854e264cecfa1d02d6b0c3f5b63510628b4
SHA256

3e5a78a4cd75c2cc2aab7e4d0001c4db0f1a13f5608f62f72018a5ead30bf039
SHA512

a5a24f936481c0a998e89acfbe0581c99704a9325d6cbc70a3a61e25d8a1a26003e19214cdb394924666f895232ea4cba87313c28ccce3c6b6b6181ea9dbd7a7
SSDEEP

192:uwzRdySwb5n4KnQjxn5Q/nnQieONnHnQOkEntJFnQTbndnQ9ekym60FC4Ql7MBuF:1Q/hZaeCLSE1fV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422879160"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFFF27A1-1B45-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1932	1688	iexplore.exe	28
PID 1688 wrote to memory of 1932	1688	iexplore.exe	28
PID 1688 wrote to memory of 1932	1688	iexplore.exe	28
PID 1688 wrote to memory of 1932	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7519f3b25f01da7c47b8fb01e5630e82_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b1e12a4f2aa9500252a83b252874596

SHA1
dd3b5d89a6266e168ccd8ffff6c6b45884e79cd9

SHA256
5d5f888ebb21dd9121fe69440f7abeef2923282f20a6693cd1e62fa7b69e86a8

SHA512
775869cdea8e693db530a28e25dc340b534dda7ffa505e796c692819cff98913b54087a1019f9e358fbcedc1b10e3c80b365072fa232be04c7887409ce02b9a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c687696d30f92e396d80b35b8635bbd

SHA1
89c06839f52d12e6575be1042c48d50f4a25b319

SHA256
15bec9d6e9ba954da62c84eca60a13cca888a7d5237f6769dbe5ba8d12c25ca6

SHA512
c6ca33decc0b247f088156c4c075c0931a8d471093ca16383620ccc45a949f9f555043fda4aa6eeec94acb729ca1b6b0bfe7962548d2ef58d16f3ee69dab8c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c29f9458d7d50cc6d91c19264ae9f28f

SHA1
7b98de5fb12fec875ba05f33459764e2edb79ae1

SHA256
632abb32412207abdd0dfe10f91acc2c084b06abb26a675dbd74e5e5742e0c8d

SHA512
c19d11a68b0406005d28e4e020210a0aec0a01a34d514359c2f3c758ab13808090a2964850d62639350c6f5b57c4e567b156a2483aeedf2523f66837ce7611c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1e0fec27b41bbbc75c3596344734168

SHA1
bc1b400d4d2101debd248252a864d7614f2913eb

SHA256
14e111c8125d0a0290afdbf77940c8e4d45196c81e3a5ef23b0823e891d1c048

SHA512
5eab3184deb829e6e771788e14dc4023c60668db2c44ec4af1017ec0739a90713710831f4dfdf618edfc3c1b71708c962bcb6270ce6a9a76281617e2a0396050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ce49ba20604d89063d2bde052356baf

SHA1
651f8939fa65c76874dc7e06736912ce74ed48f9

SHA256
12d668b9c53c4b16371f929d230a2aec0187796e41fb3e76fa97024e12e2df1a

SHA512
6f0673e273bd533fa272197b70a9d605b1b06ea8254cd13c2768396d0c44d4f378c2b6da0b390c1531b0d0c90a9ba7d6ad5a539011da54554e971f2c5ece1a74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2c1b189282f4c0e630be4fa97681f92

SHA1
344f6cbb875e5bb55e78f10bbbb3d8b7b173e252

SHA256
b3f1c9842725c66994a4653a6fc695fe5d06547e243219ccefe6185fd31dc147

SHA512
e31919a2768eed5de1b03e4e30e7c69a91cd790dd2add82fd0e017a32e119009d13d87571beb5af3ccd731fdb3acd5d06dc3407a110eec2c057a12c507465ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
135f7764259681993c8cbbd0d1ab604b

SHA1
86d9f3e3d49f2d95618b62d509d2a1b9ea1726b5

SHA256
bba6c5234c2ffb967e7067e18818cf078a71cfb448b37c055e488fbf08caa9e3

SHA512
9c88b57e0cb371a611924f60017235fd2e48b3a6a380ed725de6961644b5278cf4bb5fef7c49d194579c2d1b5f3a16b6078f47fd0ff7708a3991d14013f7ec81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cc74ef23f5b41ce192c453c073848f0

SHA1
5f2db5523c21ecb133680af59eb985d60cf9650d

SHA256
9b3394926d4d785e59df963c4683c66f1910bb9f272dc42a7ffb0799b6c1a64d

SHA512
a3696318c4ea490dea8df3bad83c53c2c9dfc4960bc56623a84af53f47c0cdd85221510eb2995cf0d6e728907106e752e09e5e5fac6b8706554d14922f4418ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84303b6a75f3cd52ada685f2b83084ef

SHA1
cb3335b6e1271fb1e6e48e390527a26057bab2b9

SHA256
1cddeed31b0b9925f5cf3c3add90151dbee723b5af1f9969bfef58a2ac9beed1

SHA512
3115eab7aea7a8b721c8378201932449d640fce6319b22ed7d97bada3ef0c087a7a7f56153c05cec6fa030d73a41c23aaba3f7f647f91e89f32394ecd8498614

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3258.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32B9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit