1f381b161a61c82a2da10f6ac2dab94acdd915222bf8f5069a0fbd458ba02c1c

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

777d63bede0d82760c65f2444aff78c2_JaffaCakes118.html
Size

23KB
MD5

777d63bede0d82760c65f2444aff78c2
SHA1

1c3436ea1b84e3084fae0967094acce0e081f672
SHA256

1f381b161a61c82a2da10f6ac2dab94acdd915222bf8f5069a0fbd458ba02c1c
SHA512

1ae32a28b38e733e4b19d41e49cb2002f1f45c497aab6f9a9b4a2dd6e803900184bd604a0757692e45dbe173468226bd2fc902b3614c3825cc265e783287a40a
SSDEEP

192:uWTEb5nMvCynQjxn5Q/KnQieBNnPnQOkEntqknQTbnNnQ7CnQt9wMBhqnYnQ7tnm:UQ/pzF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422935770"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE32D8F1-1BC9-11EF-931A-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1908	2428	iexplore.exe	28
PID 2428 wrote to memory of 1908	2428	iexplore.exe	28
PID 2428 wrote to memory of 1908	2428	iexplore.exe	28
PID 2428 wrote to memory of 1908	2428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\777d63bede0d82760c65f2444aff78c2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caa02ed488ddf615a717187c62461f48

SHA1
f8276e09dcafa2091948ec51c81080c8042f30d9

SHA256
33c2633f93b2366a5a8c3ba4807b5f091341e628175d408d5aeade21a60d50ab

SHA512
4a6ced8a27d8f2fa873f41d926790869276e4f682cfbcb6ccb811f4a0dd3f3e2bac0d0a23770fe644d4254708831b5291de8af9a57acc907cf9fa03892e700f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97c1e2718adccfbc92de4bb589c6b271

SHA1
01639d7d77206e1691a8d41cc6a57311d0f32d0b

SHA256
6e79758d644d43231773b5718ca7567f20723f47ea5c538f14fe2c14bd06d63e

SHA512
ba8e337aefb001a419c66c346304d431bde26b569f6a787893a97ca15f20a89d9992f4b07d48251dde8baa57a9b01c76d18b2638434d38416eb8e93be3ead516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52031f319be5dea9f548fa47546d1d62

SHA1
f88900490ddb831dcc7bfc659cd47a4275aa2b64

SHA256
36008428fa16b4d6755bfbcad9431c76709743dfedc5bdeaba01431e40dbbe04

SHA512
3975e4f8fb0b2fd6cae99d3fd3afcee6c4dd9300f5e9a52dc1c7b07b07fcd7341e678b950c9399f8eb9b0b58bc2397bd171818f23cd351b4a7b76efc9e6e47b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8040a234b831a71919fc585ba2becdc0

SHA1
28e1843b1ed657e79836a45e3a91c2663eba7e36

SHA256
e6d092cda3279a7c457261ce69b4d19ad2af11f2b28ba13d8d4e915c542a34b9

SHA512
975143e80a7d90eb555b491b1f0f68289a0ffeee1cf5697c1d1264a48532ff385b82db054a9ee73ac8c24f28dd5d9a2eb86d41ff93d1b452f6d0a0467379b4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
024d29acb2f68b060505456456ffb565

SHA1
db457b263d25e320d3d255680de586cf5b189839

SHA256
7cce10d160e1af6f5147616973b008c3b3cf739fe839f18fc246ca0e6ec77e3b

SHA512
1da204cb3db8d6ce4ffa68bfecebd513b24eaa05e7e384c690adbf801090405c24033c1a99d9b125889989872580a8de8dda2ac6b4e253266af1ec54a6ba86ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70450b9558038b9f5d839e0e5cdf3721

SHA1
fe2caaa6ba4d3cc5c290dcf3d0e6900081ece79c

SHA256
32014a56627dd9304a333b34fa0c9df53e06e296672b6262b787d0bdac215e64

SHA512
a676c0a6cb8b6ac77b0797690457c3ec2cf01aa7923f4ca9a3b37ccaf95a307539f1d50393b34d9c23b48d39295497588c180447d78216818c60cba2ae083234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1273f69922c9c9b0f55d880b94f1f27f

SHA1
1d0fbbaa313439fee6f52dd1d92bee914477f019

SHA256
e61eff81fc70fd223c6550b8bdb55d9c383cd58d3eb2074d1f37109d3824f4a3

SHA512
0f50519f502f71b6bc7fa3b20eb5de5ac98b002d0480e9775a892f595050c5781f1cae0fed3d6e1acb9cff76ed9e535f08aead1e77578ddeaf1b7db490186655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e7bafc5c834afc2bdd814166219ffc0

SHA1
032a9dd8ff66810562f4b4ebe9cdf6bcb595d493

SHA256
eaab6dab1755bb7b10a2bde7a17fc6d1a7977ba829ddaf0b32d013529e4b1bfc

SHA512
4a7ac4a9b74673bfaf14a05e6e487274b4c5f6e47be90c5b07c2b7bc810b91ddab8c6c8efd92c896574683cb1883823c92b8683e647078c4ede67ca7086c854a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0141f0c0744e0595a711085a3a88eff5

SHA1
4abad0ad6b625c8ab2aa32d2034e8e485491f295

SHA256
160e9cd5b8f77fca4a0b2101fcfb25c9a93d78e16f841ccd17192edc10c92fff

SHA512
73be15d69abe041a77fa6fe84fc53bd687195dc0223cbf642c573d158547e4046db4e2328a38c9f4a5c59ad0a714e3b6ad0981d00044fcd946afa3fd878186d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C66.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CC9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit