95b986ce330c7e894ebdb1fd4af0b5be7859ea678e942c95c83449bd4e128585

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b0ca6057aa410c1721d1e2df3990a79_JaffaCakes118.html
Size

23KB
MD5

7b0ca6057aa410c1721d1e2df3990a79
SHA1

7c0f59592ade1ca52828c7a948e35c83eea6bb03
SHA256

95b986ce330c7e894ebdb1fd4af0b5be7859ea678e942c95c83449bd4e128585
SHA512

7f75aecb57eea523fb4e0f211f67381a7ec98465d7a9e05418c8cb69513ec6f7ddeda60582c9584320ee409637c1d76ffa603e8f8666603862f9c0d4bb390721
SSDEEP

384:y1TEU4cUa7IhLhFKrq+l40GQ/nqo/CUaNnt5zI/nxgUeEJ0MPQuyC:y1TEU4cUa7IhLhFKrq+l40Lqo/CUaNtk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{752CC631-1C87-11EF-97AC-52C7B7C5B073} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423017226"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1264	iexplore.exe
1264	iexplore.exe
280	IEXPLORE.EXE
280	IEXPLORE.EXE
280	IEXPLORE.EXE
280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 280	1264	iexplore.exe	28
PID 1264 wrote to memory of 280	1264	iexplore.exe	28
PID 1264 wrote to memory of 280	1264	iexplore.exe	28
PID 1264 wrote to memory of 280	1264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b0ca6057aa410c1721d1e2df3990a79_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceff24194d875f834768d395654ae086

SHA1
bc839e7a800602507a63dae1a667fb18f43c8da7

SHA256
a21109f5f037c63e23bdd6114a55de21a6a948dc7b13c132aefbf0721fdda6e4

SHA512
5dc8fb30607501017525c8db42a4c52b7aacf7a51b4cf69e8123a0a31a6a6132b6d3bcc9fd473b72b4eb4b45d8a6ff761e34652616ceedc05aeb4b06961d251c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebf85963e7fc4792165edff02b919df3

SHA1
7bbdddd2aab1c3337d37603a81f14fa1c44d115d

SHA256
a135f4f14dc93e026d846ce2e8fc6f01d14fdb305b12b018cbf58cd385a028c7

SHA512
5805494d1c36ec9124993b7b3e0ab8c94b9c8f2714fa5402d2241bac74ecd811e53cd821e80f5fe21470ce5e6d41cf893091bb4ddedae6a2775e1b7ea76076a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9b36c6a1effe68a91b9d0d684591c64

SHA1
9caad3406a1b8dc80ce40482d1c508565c089530

SHA256
dadbd9067ef07a50f7d8a5c4380b29d834495c6bba249585c4ad3d53c3232442

SHA512
22d60a29240de75d7b8b70e4e2a83add6f525e7a8b5e31c26dea4a207a595cd22b23643d086ecff38bc773c2b6ae4022be16b16a50336e1ce0b1ed45f195bd0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ec4f6458d8b04aaa1e20dc3059363c8

SHA1
29852094596e5c2373e100f41e6ed68f80712623

SHA256
0292b566fab4f869dac9f2704cc8af81468470ad6dcf6534df3dba4060358b57

SHA512
552f45e1f2935e1115ad644e9c3e5c16c365f513f81de7cdb0b0b2c31cc7ed73df3f1d1eb257628942a16b94b22b7f6e435d886e781a2db3048cfaefed0edc8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03f66900afce485965922b15bb57171e

SHA1
d7dbb25e4584b7f5dd3425bba654bf7316adb3a3

SHA256
77f7d54ad00521d67086ac560c60bc80c73b221f73e52979a59e19e6ef6140e8

SHA512
96058ab74b4c27a452e9f6fd932cc0908f2826e135c00c5c9a0b5a5de4e2caaa0c2c99955c8153092d6ef92f9567025846a3329cbf959f20631e3b5da1ff9c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
997cdfa5975ff00763a644ad017e8104

SHA1
c5fd0813e0f9abe8fc432e9a018e934ea73a0b3d

SHA256
cd031dc2fff35932ddd9e2cc8aef73363788c11918e4a754818ff9d8e2f190b5

SHA512
e3cc1b1ee0a955f788a3d8b23387cb2de471f9cb6d623b2ce3d49ad781e33779ea46bb273dfad78e309486d39911b1f7a66ac2bf7a35ccde97879f0b43892bd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df85f9a890bebae120501172585cffc0

SHA1
5fc59281a81eef9d401744de4a4ee94156c8d187

SHA256
24a90328f73866ccdff3d266976e0c3c658274f4977e8025907d8dd6d7bf2f1e

SHA512
46eec9b7ceee613204672dbf6143c70757d534791ac6f0427af75b79694fdfdb8fc9c5a0af825fed16430402713579021e286952ea30a710d84674000854df29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7cbbf66010d6e17e426d72a23ed0ee0

SHA1
40005cce259283e18fa0b0be8866bf26572554d5

SHA256
07f0674eb10467ec7e654e4dc9ded3e109b0855bef1a3626d2c41b1d8ea50222

SHA512
65a6568d72a38b763304c444a9e423ae24622e9c9eeb9a333fdaa5c4a4e9095753571899abb28d30e67fe2766bd225abdb6153ccc75ca6bd3cd5fe1bd31da6dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f318b66fd7a7cc6bc3c0c63c5d39956

SHA1
51c1a921959250f706602ae4f561e50240123cf8

SHA256
87ab97bd031f39cccfb0740858f0fdb10bc97e1f4013d5cc749a0f33bbbb9cc6

SHA512
db221427b84fa9b936cc1442c0d80362900bea95caa707e2e6a5d2369007724b233177ef5a2bd1de4ed923b1a8bb06ed0819b9eb3cb9363e6088d6b531ceddee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1493.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit