e19bc965f623b72b51844a4c7cd2707efe2e9fbf9901423fea251f6028760f9d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b4aff2f930d126fd1fcbf0156862f1e_JaffaCakes118.html
Size

23KB
MD5

7b4aff2f930d126fd1fcbf0156862f1e
SHA1

793c7679ee45077947b4c9e2ceab0ff3324163e4
SHA256

e19bc965f623b72b51844a4c7cd2707efe2e9fbf9901423fea251f6028760f9d
SHA512

4bb085ecc3e00c6ef7fb70714f08c8adc420636d278f08e35f8d8eef97cb7f035059406dbce1df691d424e17bfe41ca02fb3afa5d82e2ce6d793426227ceb552
SSDEEP

384:d/X8S1IUtQfjrHk1Qq3AE/Q/u0q7jASl561yIJaQ0K04FkyN8y0Kq:d/X8S1IUtQfjrHk1Qq3AE90q7jASl56w

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F0E6CA1-1C94-11EF-8E71-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423022826"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
384	iexplore.exe
384	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 2492	384	iexplore.exe	28
PID 384 wrote to memory of 2492	384	iexplore.exe	28
PID 384 wrote to memory of 2492	384	iexplore.exe	28
PID 384 wrote to memory of 2492	384	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b4aff2f930d126fd1fcbf0156862f1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db3aafe7ffea9eb653b4a2c285b3c7c3

SHA1
80500acc8ae96802b96cece0e819fbf36f57fdfc

SHA256
b769f3e9780b67ba9feb68296c332dfc042551c9f6944f894645d38c7e2c023b

SHA512
e15b14ceebff9b752e74d6b48276480d0c65124fe6059d38174315815b8ec5aa3c6dd61a2a48fe8ec2b20810563fb02f1a723566bee7e1033416c63da5ad9700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57edc3385887097100db8dafa0405402

SHA1
eb1a8f63a7ccf1031031b661e1368166734ea6a2

SHA256
023f970d5a79557b4284fe069ba7c4662ab9c438337a0cda6b84e438bb3a3639

SHA512
7331a1fda1e0596f46740e78d4cd2d81e60b7b2ea9cf65e4f28263bba7ac1a56aec1aa6548b4f3e2e2a7028a19b1ab49b5cf710cada4640dfec9024ccf57eb46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fcf3dc67f12e68cb4ecf4d804272f0b

SHA1
a233c3dc826a8f17220a46b8543ba790f3ba5271

SHA256
34bd66abfc1a724e8f5e6099dfa86a261a24887c7d1de61b29dd32c9b9f58e6b

SHA512
e8ab6ca4c2ef9f26375c49010979b6d68770962a56a1a810ff8b63983abdf6cc96db4b916a749409dcfefe76b5f737cf4bc34e2781bf9da0ab04885334043a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c3847c106bff2c20c6ac92d295ae6ef

SHA1
700ad7f202b86c17e3a66c75c1f1ca7923b0cd3d

SHA256
f4bd982f32bebc7e3f2baca0fe460f78356a2e481a17cc9e1665ff6d5cbf35d1

SHA512
33a44e419860270566a827485d3040085f0daa9e83051a4609183f4d120f2e01f00652d92941c97bda18f76df8b7a3bfcb6f9577abe0e546deda7a249f61ff07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd34e538505bf00951a37c35c4b9f97c

SHA1
940c36b10de19f171dde96531566f23e9ce2f712

SHA256
0038dfa4de2933e7570aeaaa3b41e19c6680e3e826e61fa8ada0f847db771f1e

SHA512
2f3e779cc7faa156eec6fe3f628ee455c548041bd2ea800974a10fdf5629d39f1c91ba95714bb3b5caf4bf53cbe74f5d5ec8f912a9cdf8e3f73102e2fa562563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f08a1fbd48bc8ea7e38e41afae22fce0

SHA1
5f99ad674db3a474a394e75aacf16ccc55973349

SHA256
ae03d508b1560eab525169ce8300bcb260dcbebef287979cc7b922901279e847

SHA512
0372aa095f9d6b1ec99d6506a7230aa036bd6b193073ae4550737e32ecc7f3e343a5f45ad6b950db2b13caad07e7eae472f5fd15e4488a7a7f65402dd2f08720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39da11ddeba1b83a871c359c30e91cdf

SHA1
6bae2278b1a0e27644ff591cac00b8c81b49076b

SHA256
e9005632241abce06c17dd3c3465b2e63e03a54669ffae5fb733a1ad773ba168

SHA512
a74c9d3fea9a81dc1dafa0782f214874ab937721ada502dffe871256b38571fd4122bb710473f3a9f2a790a3f1826d25ebe72f8e0ec8af4d57c61ced7174ce9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7687976f816e2a12c3602bca662977c

SHA1
37dd2581262fbd2301b831ca9534a9462df12fe9

SHA256
e4432093ef7bdbed6c46c885e4719df96d2aa468c90df9dd3ccbc5bd2ecb9b0e

SHA512
23437fc1cd2eaae086d48e2be2c50030983ccbe0cb75de9966b71f99f0ff6d05fb1ddc01c13c71792381947ac26d3a663faaa8e86fb7571867a608c18a36914e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68285cd5eb9d2e7471bc6b99c55fff01

SHA1
1750e3cea750af2ecfeeee7dfe0eb078f201e74a

SHA256
01bf5ddc3bb4b5f390cc2ed37321f3df8b115584abf81383b7b82486a12e4b22

SHA512
0e889eb60193fa52bb2b656218c7fd2c5de5add111fb3f0ce756266b6a49403eca0fca825658be801d0894cd2c3e7f70ce7043d549cc5cfed9f324243d4495bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit