c95253a593d6f6e91c0450336fcb4c5c482aa3e67303e1d3de35068a75020984

Analysis

max time kernel
149s
max time network
161s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ac4d588018506dcbdb3e4e079e57846_JaffaCakes118.html
Size

145KB
MD5

7ac4d588018506dcbdb3e4e079e57846
SHA1

f2e394a290cd02a46312d77245b2638dcedf4f53
SHA256

c95253a593d6f6e91c0450336fcb4c5c482aa3e67303e1d3de35068a75020984
SHA512

e4b720caeb2f1da6a99518ff9d4a9235554a30633df7fb603d74b24417f5faccb7d929a1715bff4206dac60922f898190e15022cd924b087d359b39e5462a320
SSDEEP

1536:SdfiwddlblIJ7x76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:SvhlWx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423011213"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74BF5721-1C79-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1756	1736	iexplore.exe	28
PID 1736 wrote to memory of 1756	1736	iexplore.exe	28
PID 1736 wrote to memory of 1756	1736	iexplore.exe	28
PID 1736 wrote to memory of 1756	1736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ac4d588018506dcbdb3e4e079e57846_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e70c46456e6c6b975de3844330649f09

SHA1
12ba1dccdbcecbeb00be3badbb107cbba106c67f

SHA256
21bee2f3a9f13228a1cd9cdc0ce949b227f2293af2ec136d56a2d8f045878bdb

SHA512
be354e207e21a99296dcb7c7673782262d3a8feb33470f42b8b4bd08d788799a5c2ccb56ccf3ad2129787c801019b21cc64804fdedc86af1f2aa2c02b4a29a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fde2b2f5cd58ee86e4ccf16d6383f81f

SHA1
fc138e1bf539646544b0e84c0272539a6b87c8bd

SHA256
f85d95443b98496a58df3df7181f5fd71e2939cc5220243ab119147738ba5530

SHA512
7758e5d7d89f24958fa30203c227716e3bf91cfeea27b1ead8db326a9ee0769919323d8fb234b6d4ce4e0d88d6b07f495aa07cf1a8be797a2626dc537376b179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed07460ca27506a47f4e79d2710f5ea4

SHA1
6eb5ca6b6d099a6605ffa7a7075b4d46379f349b

SHA256
deb4e9cc3c248cfbf326a26297d3404395eb63cd73625dc6ca06320184edd890

SHA512
cfd92777a0cbd94a0e16c174fa12379d4318bc6efadc3976a2d5a029b9c6d9881ba48e484adc824ddd931d3ae496e18bd8b3f3fa08537929f03603d53ff380b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9003844000d7cd29158711ec4b9bdf6

SHA1
b43358d6394bb9fbe7188439246add596172de60

SHA256
6db6eb15dce8f7025ae5b2d780174ac980d3d9ebe6e5f9efa1d843b4681c7b16

SHA512
18d45aafb02c1988fadf24c186514bceacbb8e6fa1e6cbb04436e4a31c4a1bb8e135b6d2c36ec09a774989e20df392ef4cfd4c1d881a6a84381d852d455bb167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d4b3f2f4d11ca3da13aca057731ab66

SHA1
213c110556cc4e20adf99846245548ecebc3aa50

SHA256
5df7a64dc414380a384a34af9eca18a9a40908ab041d078dde1178b9a1a62e67

SHA512
32767ce7dc054a1c0a93908b25e16aef9f6d0ea8028f67627cdfa2b93fae6f396170df9043e07640917ff12ade75f2ca00ec8fb4d4ea21b4b86bc5f81c5f4275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6176b262e9833f75f663d8bb078c8a88

SHA1
8feb7728477b675639c1e91cb6e83fb922b37fcf

SHA256
407eaaa2ba701f56a13087e9c1793e4164f6f4d9e1bd8639f2c3a16cc9478fae

SHA512
1e37edfaa9075ca7f56e3d6463493f5abe1e9a404560d001ea890940cdc720bdf2aac27c56290cc549fa0f7bc6d8bf3e6f7091e43ddb0ad8c2add80543dd65b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea055d0404609c783abeac23c76129b9

SHA1
4f0d8c4bcc7b06b007e268248d3c805b0c0c97c3

SHA256
c3dc7cfb25af8947f90a49a1cb043cad1882be1777c283d91066ca7901e34873

SHA512
6ca905cfa2d8a34dfca4b77c7c90b12ecea66f877545cba53059688e87af99d7b4ee68254e2c4f4ceb1f27fcd033b9340521c58548a5e3be73e9fee1f61dcc3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7888cca5a1eccae50c5e707e78b7308f

SHA1
283e7272570fb0d6ac1861ff21ed61c42ace412b

SHA256
23745d64bd9c0c3bd6fb968c082aa23c68905b7362319d852b4ce45a6943e341

SHA512
36d649043f5bcb4b70b5d490c5bb124599f7206b3c7671a29dd1715a3f989c1251184d8aa3f61c08a6f9c866e8dcfc6783b887e98b73520fdc8c3f600755ca37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f0d9b759f9acd59b7bd0fbc3bd35058

SHA1
526dd55058e0de1ea9d7c3d366efc7f4c1b4e5e5

SHA256
dc4ae94a7505c58d9e504153877686ecb007db87a97bffd14889d19cc5686078

SHA512
40a485cb194b1147e4d877224c283dc880631603a23fdcf97d8cfc36c31fad2b8ec776740da3b6fa59324ac83ae4a9b47ec27fcfadec81c2c35509171cfcda56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23e51f4fd0329326176a7b9240d1d20a

SHA1
c75158b401e913a2666c0e775dc2d76b00100e45

SHA256
84ccea2c50067d021001429e23c5064d46bd1d8876c695891a1986d22c0d3536

SHA512
537e5eb0751a6e5c54c9c44a0c4eabcc95f37d5df5c71ebc047971a01e17aef04094188bd968995ae35d32e75d1f19a1dcd65f076d0d071cc63faac9bbd423b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA4C9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA618.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit