7b7b7bea42e1b1363768b77516dc8b6607b0bb7b3d2fb6dedf77d7f035d4249b

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a28449f0ce682d17173257340207269_JaffaCakes118.html
Size

23KB
MD5

7a28449f0ce682d17173257340207269
SHA1

a41ed1cecb1754865a7f49e179289f06368910d3
SHA256

7b7b7bea42e1b1363768b77516dc8b6607b0bb7b3d2fb6dedf77d7f035d4249b
SHA512

f536a738d958f32ec5990463c611de986fb63b96369b2673747e992a766a5b974e12937c5aa23eee8ab16050b6a8347040690c47a5cc396576199cdad8509ab9
SSDEEP

192:uWjAb5nXanQjxn5Q/enQiedNnnnQOkEntyknQTbnVnQTCnQtpwMB9qnYnQ7tnoYw:mQ/5rr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7719C291-1C5A-11EF-9AB8-560090747152} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422997902"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1996	2276	iexplore.exe	28
PID 2276 wrote to memory of 1996	2276	iexplore.exe	28
PID 2276 wrote to memory of 1996	2276	iexplore.exe	28
PID 2276 wrote to memory of 1996	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a28449f0ce682d17173257340207269_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
802f9c7e9e580e27f9d96569998276c8

SHA1
69e1bff9a307dc73efe789166c9ce264f96968ec

SHA256
f5ba6d952e9cbe59c1b03baa4fbea7bba9fc496849a8d4a226c2b9e16d326c45

SHA512
90827247f8b5a5861ffab26d897bfa18b79aa7b419716ee36b363a02b397c15a19852d700bdaf1a5af89c1c47b513739fcfb9d69b790afb0ee04ba68aad90355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff34ce1f836df5849a0db5a487eb012

SHA1
071d4bb7ddcd34bf948301287b34dc876aea6288

SHA256
760a70e51a3751ab1f5d2bfbc66048a8693fdba60b39e1dabab4f448513346e8

SHA512
1e06a33f4f511c6f2aae7329ee8d92de75c739eb08d563adb8e489c1c247bd63ea6109b8c20c0f9058c61171b390e86332c53762122d4fcabd3d05fbf22581ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d05528c33fe6eb778024940485db6363

SHA1
3ec50bec05f78a2e0f9db9a4dc3665e63e95adb6

SHA256
ccfc1a395749b0fdf33ecdffd995ee85ed48e6d58f32837602d4524fbbaf095f

SHA512
7632fb4e84303b95214bd3abbe41ca84d3bcce530420d60a6c075e00b0b61714afd886ebc77b5ff392d60dcc805b0545dc2939975b0ce49e2223be34313dd91d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c99095aedac0faae81e78db74c90aba4

SHA1
f1049589243305b3b4dc154b357cda7a18651239

SHA256
b6720ce2bad06c2802b5abb301bea5e790e511b13c6eb86900866979654f048e

SHA512
9753e10381b6f6c3178b02819c6dd3991a65fbcc38b9a548b374d1f6fde0760dcd17cfeacb1b9455c40c87d4311d8547d8ca92e09b2974932630f3b702d612b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7d6b975678017060baba587c4a7ddb9

SHA1
b231fee7298257ff34b0cb389df69da674a43781

SHA256
0a1a4f770fb6373a4008544a49cf2d6df9c3fd865ee7bdd01f8d91c3462ce75f

SHA512
787e605e948ec944c1568d6271187bcbe9316f1b782e00766d2dbf8751d8362993363452dc5a89c83fa21bce9040c567cddef1502ba585c2bd6a0e953a2c8e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdcc0c3a76d7c3bc1dc203c539b5e759

SHA1
fe31d39d94bc2483fad96646bb960b1d0ebd082f

SHA256
0697c82df576f4b18e476e9318efc41822e8bb4b1c0c910489ffae56df54b2c4

SHA512
77d14c8b7582b36970a0d9cc03254b6371169ad90a25b75aabcefb6e109361367c0841615a0eb1620a00a5a21284bae169dd127cd66727b71a1cd57f7182af72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b126ea2b4fe33c2386fcf82291b6742

SHA1
a0b3224dd2ffaa808adc7c962a2dba23d9565c4c

SHA256
e633d1bf2401bd9d7ca66b6b151be131a40a51fbb66bf13d9b02eb25345b763b

SHA512
1fa95b88fe31a3b8fdfe3ea3f735858c232ef93e4c24e21cc4c8b6839eed1fa9b06e8da66681d8937fc26bcefa1d912a3ba14b798a659d8cd443f192da556845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4402b0dee799f9acd5392c03d9f6cd1

SHA1
3994be7882ee97ced4e2e444d2c15481618940b3

SHA256
3a0b9a522fb7f986ee297ca41aed5185143fb6ea73a5cb7a5f79089bbf474973

SHA512
7ac7bc43bdb34bf0fd61acc9f40f8722d76a85c7bf629ef6fac833e11421496eab7ff4d340593a1e3c8e48f3c3073a09881d1ebdabd916e5e014824ae604b7ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
484089f7f6ededae6978352c79fbfb20

SHA1
0d5c4d914e6bd9f45b1b555ee61dd7747e09393b

SHA256
e009d2944aad58ede54c2be266c4e752458beff7d01e09fe9646b9353af5460c

SHA512
55f0ab72052bdfe0e06f1c4091c73a700504e10e78b1bd04904c8f4c9c55ff39a9b4bd470b367f523127636d7eb47710f2a70aa388e45deb8db234565f7fef84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11D6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit