b3822d3807317f351ada94c836a9c0f4d845d31214bea47a2481097d0a8290c4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75bed71b70ad038c2a56232d4829f0f0_JaffaCakes118.html
Size

27KB
MD5

75bed71b70ad038c2a56232d4829f0f0
SHA1

560dcaf00e4079b41ecf6344e64eda9d15bdc615
SHA256

b3822d3807317f351ada94c836a9c0f4d845d31214bea47a2481097d0a8290c4
SHA512

05710754aa284a08e6f2f731be92a2e78a852248e02f316571b417d2f6eb893dcc003dbddfe9725b2f7ac3ceb18fb67f22fad8cd004758000d9aec8426ae37ae
SSDEEP

192:uqgyv/nb5nytM2nQjxn5Q/4nQieTNn2rcnQOkEntUinQTbn9nQPCLtJVevo7Nt+d:ng6Q/wrOIgc5VA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422894602"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F41E3881-1B69-11EF-B195-DEECE6B0C1A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1608	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1608	iexplore.exe
1608	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3056	1608	iexplore.exe	28
PID 1608 wrote to memory of 3056	1608	iexplore.exe	28
PID 1608 wrote to memory of 3056	1608	iexplore.exe	28
PID 1608 wrote to memory of 3056	1608	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75bed71b70ad038c2a56232d4829f0f0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8527621e932f346f85192bacf808ffed

SHA1
3b4b2d3cca086e17dea6362dc3d27bf6c3a5c035

SHA256
c674c590c116198ccfef115c95f4e0808e7c8d9a7406a996725c9be1c65be846

SHA512
60d958d1c1bd5d4bbeb7f394cdab3cad06e777fe864ff94ea93f27199eaad187c0657aed9929f1e364dca7f81bf6fc9c724887f552731384b2b1508f72b3a86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99430bc84c48c52f63473241a5ad7d04

SHA1
a0884125310aea50c075cff10d21a6723485c7e3

SHA256
12ac13b6940493dbaad87569a2293806242738fb4cdc26f64cf5412d0f3d3b71

SHA512
051825925028d2c353f93ed2c103d87b4a979a30e7fb800819bc33c68ff69d4b745875616c3f669420fccbc83d1e3c8aa7bbd4762ffb0d83abcb4f5de263f7bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21888343dc54453271395f6dceb07621

SHA1
96f38d490110b9bb0a5e1db9fdc2d682786eab8b

SHA256
6ad913cc134833757afa029586232f89f0e94ad79881bf58f34ca8bddc4c3c69

SHA512
680427ec0f5bc55542da7c063852ea7612801e249bb5d2313ad07b0e95b54d9dc7de3462012a8108377a0138973d455a5bb04fa5cb9956e7b63a3e2d26f2e797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dba3099c098ada5ac5f76f0eca832e90

SHA1
99f24c1af0cc94645388ffe56d94c4f1d2b7affb

SHA256
906b6ff758a6c05062f421c132868ede8edd53153b205bfedbdd3e3c9a05692d

SHA512
4acb835cd78a6912aad4bb3934ba9ba370849c232cac74d50bf542a9f3ee15d46f76fe96f8050e8786aebc44d8ba16ed2a0c90dc0af01ad8248f4c27e22cd6f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3e7e56d05dea7d047f510aff73d82b

SHA1
a9d0ec28dd294053cf6861ea5221dad3f472b9f0

SHA256
624469f05345ca66f75d0cd2e4e4ecfc27b995e93f6a40e32bf8a32c1d70d497

SHA512
fb38250239ba51fde3ace08cf04b43bbe13eb2e57bc41eb66e394447a16df54ac1af7df098910e77064cd2c32fc9bc75d4edc7545843f7b33c4519fa77a2e774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8958be7a34594e88f852485a7271ee0a

SHA1
b70787f4416d39fc506dd6588b208fd0fcba8759

SHA256
616d46ced9b7d013e798c3877e316d4156793bf7ae073c881e251182f03c82e9

SHA512
4435dbd7ee7f05f77581662199910f017aba5a11c20d9bde6064eb1e1ae3abe2d8ad234c7ef64a9cde32a8efa239e961262eeb29de7253d4fffa7dac36ecf463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfb03f4cf056affdb78f755f17f16236

SHA1
b554673f69a629958e2c76816bef1fc3d458bd8e

SHA256
d69159db02cd142c70cbfdf1d4d8c868a1985648c944fcdfc1ec7c5c03b253cb

SHA512
0e26735b66a87c84f84395602c1b99dbffa965dff5ba6fe38e338243b401b5afa63ece18f2870d03b0dae526d36887bfd6a00e6233f9682d44c38b5289327bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
448f282fd3ddec156b0740c9ffb2402c

SHA1
54ce6593a9a8d9a1bcbfeeb668fda1bfe28310ad

SHA256
dd6307d4c421bbd4d36cb1dc3f0cfa4a346ab37ed315481262c2f4974c78642f

SHA512
c4122942eec49a4805f5b2048a6937940c93bca18429a374c8de1ae6b1dffa65c380f88397921160aaf869d28011204ec5006a063cbc1641daeaaa6e79863ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12ad5a1f1fdb386d2177b47f4eb8b61a

SHA1
facc07bf3fadc6c52b9e3b1305693d76ecfd0d71

SHA256
caabe470af496571cf2501fd386ac1f882852bf0b4e9983f695b74023e56ce75

SHA512
5e6f2df47f1f0db081902dd1e6a75a2ce2e8b5766119f0abfaadce5db45602bc879f23297f1790814183a3e4852fefb1441a831911a0a0c1ece256e8dcb339c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2271.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22C2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit