775cee5dd8f59ecaa7e1c16d843b7f1c514c3b7e8974615b25d2d74092330e6b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b37f25261d69b67805a29e877caa744_JaffaCakes118.html
Size

30KB
MD5

7b37f25261d69b67805a29e877caa744
SHA1

68937063e7df51a23841024d16530097e3bf48ae
SHA256

775cee5dd8f59ecaa7e1c16d843b7f1c514c3b7e8974615b25d2d74092330e6b
SHA512

18d68a09e9a427357c2030151c4a43b9b63d1bbcd33012caf4530c181c04e81240cea47660e67af69ad0e611d23816c9df6255f9f2d91f256dc5a5075cebe203
SSDEEP

192:uWTkb5n/6+nQjxn5Q/GnQie1NnLnQOkEnt60nQTbntnQuMCjAKDn253gbiYxYJ/l:XvQ/8toQ9xYpyQ3ZbDnOO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83275CB1-1C90-11EF-B587-FED6C5E8D4AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423021115"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2168	2024	iexplore.exe	28
PID 2024 wrote to memory of 2168	2024	iexplore.exe	28
PID 2024 wrote to memory of 2168	2024	iexplore.exe	28
PID 2024 wrote to memory of 2168	2024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b37f25261d69b67805a29e877caa744_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5376488d346d14b6a4464d46c0af70e0

SHA1
8813d9a7fcef6d7b5c3276c35329b956950495f9

SHA256
c995d5cefa68b3aad7da4cf1b8a8ad8edcdadfed106bd37cd026fffe4acc95e0

SHA512
240e493ae123b520884e17972571ffeacd28a5c6589eeef77cbd8636952389f60dc224455e9ad4e179a73dc6b6b927df8563890065b650d1a70ef407a50a0a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f216f2867eb74d4a62d6cfadccd8bbb1

SHA1
091d85345e2252ec78632ebdf76c22e84733950f

SHA256
80f863905fb2100daa0b2a59f642b73fddb3d5f9bcf2902c269b9ca203e59469

SHA512
bb103e73c6c8c756f4930527f16d4afae33ac3947a79fa836451ce272b145deda7be68f4efa38d4b0cc323883eb985458ebd56c4fc4a3c1089580c9bf15cb244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
244a882d2ed5163f3d04de51f9182c5c

SHA1
74793265b32e936537cec19c486e686dac4791ca

SHA256
285dbe5974ef54c41a8b8f3cd4a19256a3edf1d60c47f3dad04ef80c654bb5bf

SHA512
e6d8a73e321e8b9f0bffae5fc192708bbe6b34f090b9eb1f10e2f69190b3fe4d6380bba316baad050df3fd497d2c415235166811899c4b711774accffa4fa265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
932818a3bc23c4308a51b5d0a24d8377

SHA1
843aff734389422a3933a02e31280a2e9d887240

SHA256
14d896d33d0421e3ccb3259871c8c2156aa056a8124d65894bbe389ee1b3b2dd

SHA512
209f2f9aa89cc12245faad55010d02b07496147da31008c4d086447d1498f78074625aabb3694836d3a64e9ccac4fdd39e762d888a1fb8b40695394698c0e585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97a27662dc35e11a411e87b6e30c411b

SHA1
6bc9645ffa27b53f0b7d09ecdb01eedaf3882da8

SHA256
9703f69aa90d3b2bf656d47e781e01d49af52c591f20635abbf24ad8592abc8e

SHA512
e76fb740cec557806e70cf7fe1581e1a6b6a9644567bfed51a5ea37c6ea6221580e9e3b422b6df08bf903197d0df6ac4b43bf1bbadd581d269e9fc4fd198dff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e5d78e44aad9b266924d78509363092

SHA1
d607910e2f4539ea56797e8c18c05c57cdf1ebb2

SHA256
1e6ac4a20a8f8b5b63fc4a51bed6ad2e4856fbee1e3d0bdcb54b34ebd598638f

SHA512
68ecac3a6407a2a6cfe26e1f19fd7116e37903c4157effc6f6b6b0f651feda48a3f13e62c66cdb51d92db6c650ec98740a62951bbd3eba1dedd0d2bb7fa81182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a57ebc06d6041acd1e8db4921fcda483

SHA1
c0ece9485f1e96bd799f6ef333e31a976cba8e5a

SHA256
04b66b0438b2926085b6b784018f75436824547461ce18725dd8941b5f8efe31

SHA512
8eb83e558a97befcbb6567861e0cf8821e418d149737d7e17dc6c7cfb9f126961ee64901f3caac9aedd50a6b7df2cf95de8a545b350f8988aff97d3c65e3c98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64fef1c36f87e3f6172aaf49da042234

SHA1
a545185df0b76574891c82aec02aeb9d0230c79a

SHA256
d06f759a630b54aa213ac7ea9631151e527e13dcd3e88a86877f854930044da9

SHA512
7501c9f15f5e54e5bf8f35eb3dd16b5444905e70f412279494b463cf492fa2ef9cab9f779db5a5ab767d6de036bb92114583c5d9ddd9bfa9d47550dedaeb45fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5753bf0242a5e2cd24e64de672352f19

SHA1
dacd58d9fbccb5d4ffd6f166ee6f5f074f239efe

SHA256
a60b7bceb6a2db3be70afe0bafa6119a074b71990161b6f9a75ec091392021dd

SHA512
636c32d9f63d9a142013aa06d6c3660b2522ea02635f85f8943dc9b983af1f029f7ca4b62a7319217810d198ecc7e40a57be608417d53286d7133b44b55fb5b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3140.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31A0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit