f971ea8a32f94a8314df64bebef30174aa8d789d808e675bf2fbe6a6e61feee0

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78554a5705aa64b7361bf59dcb187d3e_JaffaCakes118.html
Size

26KB
MD5

78554a5705aa64b7361bf59dcb187d3e
SHA1

19c77372a960621f2f06fe3eec23d34d7ce8d63c
SHA256

f971ea8a32f94a8314df64bebef30174aa8d789d808e675bf2fbe6a6e61feee0
SHA512

5114c2195c8ad5bebc67be6d1e08d53e896d6bad3675485999e480494d1cf782f2cd21f7d1e1f83fde9da7ddab5e8d8030d75d202bb53fffc68505515cf7fac2
SSDEEP

192:R5daQzoPc6+dpgUb5noItMqRgtY1cZZnnQjLntQ/IYnQiehLnbSDnQOkrntCwmLc:EwoEpQ/ORXjanAFD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422956338"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFD669F1-1BF9-11EF-9A09-E25BC60B6402} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2540	3008	iexplore.exe	28
PID 3008 wrote to memory of 2540	3008	iexplore.exe	28
PID 3008 wrote to memory of 2540	3008	iexplore.exe	28
PID 3008 wrote to memory of 2540	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78554a5705aa64b7361bf59dcb187d3e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2a7b3772be4247615b116fcb2ea3f5a

SHA1
c0a9ff25dd8535eff16576eebd5230e4c04494ec

SHA256
fb10e4f775238831bcea94afa0eb381e8725bfbfb15074784d80355686abf185

SHA512
2eb57c4a38085f046d8d284ea9d307b11fe8eff4356913ed56a4f5c5301f6b7fac95d0cd499bc2ccb03dae35a3d8f3fb475ab25db8ddb2952b078a42ab711a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5061c34ce24728316aba34b1e6dc01cf

SHA1
1a4f57ffa307c80f2149336d7dff1db1c8cc2afe

SHA256
c48c8b524b3522b26cc0c856ba5ea29367f859fbde93f8b6c3e00111e19e563f

SHA512
d5564fc0007daa2e75e2658e862853de24471025c459d0a5e19ea06911a6b1c7230a99c81be2cfbeba6c7dc3718f1e12c88b5b49381c7ebd2fe1d13b7caedfc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
275c391b6621cfbd4284f7be0d0741aa

SHA1
27db561bd4717049fb1cdf1d105c7b3de5be8d9a

SHA256
00df16cee35852d471d57beaf7fea3df187d0d6991dc60aaf61e6744a77c5a67

SHA512
a60a4e67df7877a6d4defdba212b713f169aa5a949da172d1f338fc568098c40d2d5265b0bdba7aceb6f7f83a65f83b2b2dde2361a8f0462667ac4bb1a7d78de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae1f8a140e7817ef846ffd5d4183fa1d

SHA1
1b0e419d80ebab48b16b8a083a4334ca39f6ff58

SHA256
2a3f29ec3a3f059899e3a0c15dfa90c4347794d8aa3262aa25a7da5cde17d752

SHA512
586714a499f5e44d16f8eac72d149e17a0409c538a120561edbf48d30900097fe07e7ba9dc736d2eec2aac6c967cde042c0381205a5dbf8b13e009401df57461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c664b9585fe96a6e522496c0ebe2387

SHA1
9348dd99ea992f5b9a0a82d54400d9a11acbc210

SHA256
82ed8d07e2e823497ab5bee42fc70007cf7803b26e322af7c5a93024b25cffe1

SHA512
0d6b9467cc6a1fe797619531a892ab5e7ff42c2f0589a6fa05f517ef06d0e2db13a4c36ba27209ae9f4e8ee288a7865fbc14f6f49e9937f97be4e0433ebc2cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc04f57e2d8fc600b6f9ce0cbd2a327

SHA1
eafe5ccd3e6dd8ae3f7cb934dd2d4ae17e47d7e8

SHA256
1a965c3a170756dfeb8c8bd7874491b702e29463e9a2412eb863a2df5ee1682d

SHA512
2a495090688c0e05259b08b1b56e82c293707656cdd5cd6380c944c35d9523465335a15e278b0491812640aa9aa64bc5080796809d444405909a9ee557cf93b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16a8158f8a630948934cea78ccad218c

SHA1
0f661ebf411adceab95479fdcb4f6f077baa4409

SHA256
68d8b2b7ca14de9414b017c6121776fbc2822894c83d7c1a7c24c12524a18abd

SHA512
5834b86b72960cab1e0e331c66c15abd75a5d136fbe01e016b0492d53bdd14308c017d5eac9af7573d0d0772b8714f54f87c6ae258e06b94e437d93ff5c55611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c19dad328d4d83d15812beae4c50761

SHA1
ddd869f2e54a34d911af68cd757e703a836681ff

SHA256
26404637f880b408a3d82e0bbc8262df7e946173a29237b1e44845a2151c3e6a

SHA512
a0329cf9728d8df0ff9b9dc60473b23eae1a7a197bf71d9a3cd4bb50b9e705da3c0800bfbfcdeaa7af2f82729611168576438728d790c6b853ea7a3c5ae9875f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
370e062e36bffee204963c7690fc556e

SHA1
e24e71bf907ed4673e4eb7e69002be359262ac7b

SHA256
67f68233b2167671b647c5a08fa65ace28226f26e77115da3bb1c60b22a03b81

SHA512
c55266bc9f9eda0992471f272d65b2b277aeedd06c70f19677d77018eed28f138c1e65f47f839ee08c92a0578e4aa3f83fd9e8c992450e9bd4571cdfaf80639f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CFF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DFF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit