ab82707ef1a191a7f83570e43fc0d263208876632a2543fa7899cd02ba82aefd

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b32b24a199548f6eee6f0f26c5c534a_JaffaCakes118.html
Size

35KB
MD5

7b32b24a199548f6eee6f0f26c5c534a
SHA1

f2183c9849323e02ef72e6fd2a9fbb23295a6baa
SHA256

ab82707ef1a191a7f83570e43fc0d263208876632a2543fa7899cd02ba82aefd
SHA512

b5e9642b22cf1ac4f22e32504ed927c05f07bbeb01901e62e27196cb298757c7f549ba610ff27f167eb441bfea42de305df412ccd3b41b9e236a279bcca6a980
SSDEEP

192:uWft0b5ncf8nQjxn5Q/GnQie9NntCInQOkEntiQnQTbnBnQwXCIlAXeJNt5CCKtN:BQ/zwvl0CjbXJqyWWsNkJICU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60E69541-1C8F-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423020627"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1312	2988	iexplore.exe	28
PID 2988 wrote to memory of 1312	2988	iexplore.exe	28
PID 2988 wrote to memory of 1312	2988	iexplore.exe	28
PID 2988 wrote to memory of 1312	2988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b32b24a199548f6eee6f0f26c5c534a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f77717214447b20d467e2495d6f106da

SHA1
d823b84cd36d1ecff4e84e2de57ecd0ca44456c9

SHA256
9025148ca14673448796a42b743267f4893258905975629ce6097a0143aed3eb

SHA512
e7ea2bb427db475db42f0d899fe7f8c80fc7a134bb5807f70db90d231528859d929645abc3556df1d1305a6f7fd4e06b3de2aef5e63964a545edcc93d300c2d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5378d4c98009e8a5fbe32251e7958a8

SHA1
41e01dbddd78e357e55bed645b32e16d600d6904

SHA256
7ab71073cbe0c915c088a02ff650922348b5b37bd41fc5395766473bb6a326b4

SHA512
9ea84b424f74f1259504fe24159a590fc73f7e05a4ec2c6e903ef2c04f0862657b571e9df587dcbb1769760cd0f112de2f2d754f133de641987a0371a7cfb919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
619f74cdbb5cc50b991269bf54ad1b2e

SHA1
523379847c165e04f184cf50cb67d0c305ecde81

SHA256
7064e1590bdd6e7ef1bf6ca51070242a29a0cc3bb8f2768bbcffa98c40ed48f6

SHA512
7f6f4ca61222ecf4c4cb7a00c7cb091535dac80fd6bb5227fd8176f4303179ec04e7c9f6f4b834d0e21b1030b8b9fb838663257d219d0b1699dc0a03e8e18788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8360a1d2caa3901cc1a2de64c1ed69af

SHA1
c883e742037549de0fc67e7d4aa2ae737fc9c937

SHA256
8490d8f447d75dd7b916b49ff23765a7d689fe3cd70accbcac38e456dee7d61e

SHA512
83cf3845647bda6011e3ae008fc2ba5873ef2f55eb9bac3ceffa0abd6eabe6afc28cebf230e1a25c09f43e60332e0a67bb103c7d884feb0ba84487da0ea1d487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec85dec2c1b7d5a2fabe2b932d33b0aa

SHA1
4104c8e4bf3e923b1dc5f4a6f72b83df6ac94811

SHA256
2442f08e2640edf80194c32c3fb7034addf4c70474bb02fed49206a85da24955

SHA512
6f6b0bae36cc7b2083b76c200fbf5c1e8e6dd4cc47670e2aac748b3118ee844acd3c07abc982160794f73848027dc2b42b4e13e59545b9e4d5703f9b59737567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03e7a122c3b6d8b9e05918d3cdd674a2

SHA1
babc81c40e20f309f7206345125ab03c8ab1161d

SHA256
eb8c9adf2a762ff712f79577bfc694c4cd8fe1772839639b52066aa8bf634b89

SHA512
513dbbae1aeab7cf028fda8bda379be336916033323664ae541acf6e76fe5fc82428282624851f1672ad5ba07c03c9472876954b772eb53cf92d1aa40a11b379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8613c02b545c0f3aa07e6014febfb526

SHA1
8ad8969ca1d1a674e22926bffd9dec71c553af63

SHA256
a8081abfd51bfe31bbabb3bab92a4aada38868e7f898aa2d18670fdf94e9f568

SHA512
fbd664833b7528d20ad660671e9335decd579a7b08fb7c19cf077e0bc18b8638bfe112d7183645b805c8ef4b167d1704fae170edb14e15ece789c6847bac6cd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fe78f124d94365851f3b45fbc622d1c

SHA1
5d52a95103ec3437cc94ed817d43cf113bf36d7a

SHA256
6f139f4f243eacbab34e938c5b2cbcf069f78f0f2442ab3b2f8b2fccca5b2055

SHA512
b6a33618befee931f7c6f48be69e6c6a1a5c5d64f8fee6bdd32570e727341e43a754f6065d03fdd9ec394d4a090d453fdcbcd3a22dfdd5147fee6e49abebf021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a462a7ac4bcd240e9e094b3bfc433274

SHA1
a6f9bc2eb9d46a4cace7c8657fa07e1a81e1b6e7

SHA256
fd218a961e7d7013b99772544da24c28cc10482c4d3dcae41bd071d76517b4d5

SHA512
c9fb10aedf43aca77d0414559ae63ee2ecef3b3054becfe9e09f021823c674d97e836e1d96038110d69c3d8646c68e172b348851b13007d0ea21ca8f97c3cbb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3278.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32E8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit