5805b5f8ab475c53677acba7869f7f9d9c4ee8216bb1ed2cc89f12973ceb9f6d

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78457206f193cef63d4dafe0cae20883_JaffaCakes118.html
Size

27KB
MD5

78457206f193cef63d4dafe0cae20883
SHA1

c99d4853b0503ae03909a909748ef5ab5dea2cc9
SHA256

5805b5f8ab475c53677acba7869f7f9d9c4ee8216bb1ed2cc89f12973ceb9f6d
SHA512

58a0b50303df8422e2696c7c0a81dd303c6569a614e463be0e47f370b0e02299b2932efc55870d59fd1a4d1816e05ad9c2b81928c724495e3ea798507c832b73
SSDEEP

192:uw7cb5nYXj2nQjxn5Q/1nQieoNnAnQOkEntDXnQTbnBnQ9eeUm6uV8OQl7MBIqnb:7XLQ/ETsE8pSqNCH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422954938"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E9C23B1-1BF6-11EF-B937-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2780	1720	iexplore.exe	28
PID 1720 wrote to memory of 2780	1720	iexplore.exe	28
PID 1720 wrote to memory of 2780	1720	iexplore.exe	28
PID 1720 wrote to memory of 2780	1720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78457206f193cef63d4dafe0cae20883_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
238f4f23c1c7a0645af27e70667196c8

SHA1
b61679b9a47f149ae7e71e94de8a5ee651aa43a3

SHA256
a22946a3975f4a11777a859bdcdeecf9a951d7a3a4a6985dc7aa6404c9cb6862

SHA512
4a0ca66411c011e29deb0e57e241a45f2cf99306b8ae7f800e33cc173c01eb2f66709a2ef52d06dc7e5a2008a6b3c2e13a8ba653b223229ec7c896693520db82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc4c74a63aedfe4d15ddb07a4338ab64

SHA1
a279b0508e077cb588b95b42bfc0c64e569926ce

SHA256
2df62fa2d3cc162c9ecb6e1483ea9b044170629c170a839d5a358ec401bea658

SHA512
9c2771423925a170746b47c0cfabb9d802fbf8a3f2e82da18b674766a8b406ff83f5e368eec515d7ed230d5cdba046a0df3978fd8d9a57e982f4a35eda47815c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1957ef4621ba04ef27327ffc0fc8023e

SHA1
5841410d5b4046671bd2abe6ebafdf3d7b27eb7c

SHA256
37e99591b9e8c49363d15dd46507615919cf74988ab4775fc988b053dd384f3c

SHA512
4c1f6337fa9be7ca479b78c7619c35d66d1232cefba9ec822ba72c495593bfcd4a813f0f670fea9bc9e284b401f1618336660bc9058415f395dcb765b6cc6cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e97d51f36c5530b96de3701da351bf

SHA1
76820acf8bd24052d08d0a49b1f5b125c45e5bb4

SHA256
549b50601bb88b6d940607f0bcae2864f01025570ca1f7880323e74d5f3011ba

SHA512
c39e9f54febe1c2c70f6582cb096d958991d192dac84ecfad9f0dbf990154f3dd0ea504c5964e52aede1f7e78ce310756420ba50980b9007530a08af6f9e2756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68d0cd9977a86ef08d31f4cd2c233a56

SHA1
dc6f272b589eb3c00f06a933f171379b8b300676

SHA256
83e9bf1ce3a1c3fb84a289f5375ea9bfa60379427138435e0a051748029a92d9

SHA512
f13584bf32a16f9e9dffbaea77ff9f6246f9d89e1a3c30115d8221649f8f42cda29e7623e78b2d903355931c84d200c928f2644a1786c6e4e93008ed951bde22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8f90b2d28b2511293386c3f5ec8a05c

SHA1
ba631993460f3d9482c51c4869a492ba1562ca37

SHA256
e4f8337fd5720ae868d2689c904050e6e73ca05680988da9e623deb9f52b592d

SHA512
203bb4036c97a56ae11414148a8c81dbf5e104055e982abf36068b59c465ce463c0b2acd9f5d46153794778477ce932758a4eea0d33e51bc66fa0f7379ecf1a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
823b9ac2d666b51626e0b3dbdaa91a19

SHA1
b9d5850bc3161820201afc554ae43aff414989cf

SHA256
d6024ada6253990254cb9a96bdc534ae4a83ef4e232d224c08dcd079eab77769

SHA512
687c173734839639da54a971990acf43ca75fa573c3645cbabad25adf35134e9cc1e2ee96cf9ba706295ce368f0f76e5e60653605c49767e0f7d94cc9b940a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32d6d01ab8af270632fe7088a3b33f7c

SHA1
eb77002be5c14992e9d548489d70560ddd9f3e65

SHA256
e2b34272032aec306e04a707180c41c10255f2bd012c9c812bce07711a5cd776

SHA512
bfd2366afe8552a7bfbfb153eb7c33b2b07e6ce6562a146a3f4fa0ccba62e48219d7220a9371550d522a2515550969c6c29ae1f1959d2bdcbd2bed5b6070404b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a001123bb1bdefe314dd087ce7c9895c

SHA1
8ae29bd2929c035e78fed6c0977ee17a21f26303

SHA256
b310f4fd5da2fa9433d1f5818afe68d013c99b58c59fb5c2c1f923a79fbc70d1

SHA512
9b02394424133a430cc3aa190f16047dde4c3686afb213ed8506a161d275058b2fd58008e33e4e9e1068bb0a19c5f14eaab665f7e163693e4d3f6a8f9667d26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB97.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC78.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit