fb8d24e1956602c758bee997c4d8e7019831a0d3f23c8432cb4d4c416c04d90b

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b6e7c5936f0066971dd626ed56c7b2e_JaffaCakes118.html
Size

26KB
MD5

7b6e7c5936f0066971dd626ed56c7b2e
SHA1

e43f87c189c2bf0124743957a1ca0be34821ac45
SHA256

fb8d24e1956602c758bee997c4d8e7019831a0d3f23c8432cb4d4c416c04d90b
SHA512

5ec6d497340ded119a5aaa9f218ed820afe90d88392c70999d607705c1bd5eee10fc922af6133c922e547235309c487ac4e43cee6637cd7fc8a7261ad78eb086
SSDEEP

192:1A2qoOOjb5ncYXfTw3AfU7zLnQjLntQ/bnQiePnEnnQOkrnt1GnQTbnanQ6kRo7K:1jqov9Q/am6Au

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BC49D01-1C9D-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423026525"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1340	iexplore.exe
1340	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2260	1340	iexplore.exe	28
PID 1340 wrote to memory of 2260	1340	iexplore.exe	28
PID 1340 wrote to memory of 2260	1340	iexplore.exe	28
PID 1340 wrote to memory of 2260	1340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b6e7c5936f0066971dd626ed56c7b2e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
952f9bfbd834527ddf2bfbd82db72e79

SHA1
6323294d353c40d480ea9eccf6efec5760785958

SHA256
8bca5b9fe586b3c9cc27c09470d2fe6c598d4a3eed41c5b22cd42e18fc1dd13d

SHA512
7691623ee62b050678c9962775ec02f4342cdbd3e3051666a3d9e0f7c8d034d53e39a83b94b616b20c2b43e3f32a66ad794044e08feaffa297955dc2598d9244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bf85d47d078e1fd03c43e5b1c1d487b

SHA1
b2d4c6d599c8368596c760996c06e0bd784e04e6

SHA256
175a3823088b232f0cb6b2f2c465a642c90a038233e9e44d26f71fbf382b60d4

SHA512
e9d9f0ad8bdcb49faa756d8de95a8e268e3052b1225cb9383997df3d8dd888808e57545e5ccfa72b670765fd4d79f9da4166ebe185251166938128a9f6e620f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2522ab44e9635667c073842227683659

SHA1
df8c274fbe91633527386a1b8e83ce0493d35e3a

SHA256
f81371cec1b4ecb68e2a495384f564844f9b4a576ca10eb8b5328a194c7f63ae

SHA512
dcf0ff935b8a67c77835bad0db5413ec7a541689355e8fdf4a718101765b4843c84ee3bbfc079e1b233ba80a8475327acb7362ac925c584ff08a0316927e2baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ad990d3512d98b5e2017e250103bf37

SHA1
ca75f15dcadbe1ff7d6ff699acc4fdc1e90ec388

SHA256
be327c4ad06b5a2120656a37e4cd9da779bcf8c7587aa171d92f3e06b3534d6f

SHA512
c63b8fe72a6a6b2c6c3536795ba9a8f0bfb2487f84b0b9418236058eb2d532ef71ffe4b1717bbaa47c9fba777b6400171ed93c735901dd0d85dc386711e89c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46bf840b34678eabfed11d6d707bdd4b

SHA1
9169d9056b361dbd71a91eb08923c71b6c29265e

SHA256
b437817f451cb6911e003c0616fc93dcb0398b353b0bd535bc1da8d1b9011d40

SHA512
ce4ecc76071e7e70056ad4be0ce574e3f5684c2241f141ba9ee46d4497d1875233ffa93a170ccbe7d8ee6b1b26e23a4d338953ee897d0b2143b7e59bf81f63ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0f5dcaf6238cee97cae39125756a3f

SHA1
b08b1dc3977120ffcd6e5d8b748a180298f52533

SHA256
151977f83674c714bcbcbd6075606a0a4f9723fe2bab6cdceec68fdcad492549

SHA512
05d0c93c65a3ee7a3ac154f10f7afaa102a2de470e8b5b21f3ca42a6cf1e803a5fe7cdeb4210efecc5a3889282bae44e1201bbda5e9d497abefb3b9413082a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
796a66be6a23727b87c9fd8442403081

SHA1
e7ada290e4e5fa980354a7758dbbcbbf5fb0570a

SHA256
6ed20fb3dd87e24dceae218ac6157d5a78b025380612a7218d1b7fba69d2e034

SHA512
7f1abf4eb235d4cd4fee256e53b4e055b0bd8f5faf8fd61c98e8bdb126ff710aa524f5828f7f3eff7bc29aa8d339d2413e0fc98d8c1fc0fcd8f51d4b5a69a6b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a764d244ad2941670dd28a48b2d2139

SHA1
319387b6e43e0548465d322e0fadcda517c20cd6

SHA256
20e7304caf3955fc22fc05a63239d678495ff184b9f938b7878597089fe4ca2f

SHA512
bbd64d20491fa5435c8452e652fb902a167c9c41703f576b9d5e7c6ff855631641d2c62cf6d74e38b7a69fb1c880f3e0da182ed79e56431138cb9e13545379f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7da017b03a07f0d910699373677e206e

SHA1
0725e8421e145ccc76552bd0d063fac83e66d1cc

SHA256
d22db49f9b6980f35365cc19445e9c0410f2358fe42f1380e22e023e104f12ab

SHA512
d2aee6c8c10e55504330da3a2d52cf7e801990301edc3b7590199afb77cd51a02e86e24d6a332e9adbae9a68ea274616e4a3ecfda5c284b808072234b322c4e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8f8385c7d387293720340bdc240a033

SHA1
182dcb4ffb75a6cecf10dd28c0aa964f22818a47

SHA256
6191b9ea59ca7e2f676d3899eb85b6a6702ce7e0cc0c45fb156d1b4687565045

SHA512
203be9b7f730b4d4b72e9848871483ef445ad19ea4298150770394c1e3413b89e21e3d7ada5e4177200a6f07e202818c72cfc245f384ba4235e1c51fb86cf323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d770b8d06abccd8659b6c5717b871e

SHA1
d7ff5d2dba06590db38ea08b52248faa612bc1da

SHA256
3ad26e47a3d980fd015cd7833dc4fbd6e39cb07e9e86fd2441052890ccd6f43f

SHA512
d85c6a7869e53340b13c2fbf674f60c52d716b9e2c50b5c2a22b12d06caccd8668e32604fbe7a790c490c69c47d4a705d702dfa3717dfc63352af9828afc78da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f132b6980ca6b13e9dca0589a17da3cd

SHA1
89492db2e8f433af9fe90a17d59f48bbf50f997c

SHA256
7b0789a232bfb12d55c7b6ff0783a7a4cba250f349bf3576c47199271d637aac

SHA512
904abaa10a4287f635296932791a7e6304282e580187e88bc23b8d4db70e19e5d589b803f9961d657e58354e3ef8eee533f9cc78e6f82fb0a9bae04ffe8a26e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46499da1d52c518e15e031334ddcb0f7

SHA1
a8300d76b518cb7b9a2e83fe189d79fe623b03fa

SHA256
dab7d6d40f689a6944336641a07cf1af29c3f57fd1626744c28948017a5b578e

SHA512
43e577eb164ed6e0149921379f53be792f8cd6ea12a45c81578f3941fcb4187a476e5639439aa26cfe56883b1c5ed58b93fab2ab03cba6afe07bfb32a4e835b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
813c497ae7732b77d84f877aafee498b

SHA1
6a63d821d4edf31d8b06e4cfb37fbf71165335d1

SHA256
3677a1e5006ecec20806f46e4f308e760dcfb08c5a7fe04ab2e84a715c907e2c

SHA512
c05b56f5a709ae3f8542916712e1fc1322331799f3e59c4718caa448ef5cacafcdf5a0c835d8401010df4d7134aad66565c5e7aa887c57368c18d538ceb190ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fe89780b5d1f547d2080f99b776f539

SHA1
022f07741f0ab17a6c5dd3d39ee23c5b2f3ba6f4

SHA256
311521eba5c2a72fd14fc8e50381f3d9d33dff0c25c81330c755398773db49f5

SHA512
457a2e36428d4f57e289d63d9baf2f1465f5e0c45e1f0d021d40c70430cf5999e94701e2a75ab34a8ab454fc378db792513c2d95b4a9b2b14472ae66ac356058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eca96bb4d3b69f5c6184cb3cacc1f153

SHA1
bbe48982fae2e00d7280ebee15d5a24d27e36d72

SHA256
5cd4b1442d52102f6816380eae81075c655f0b733b5028a682682a3af4ae5d65

SHA512
bcbd0c3ace4f55924dbb4cb3e581f1aa4ed337f3298094cd97aefed961c8d15031bb73138e46b26f73059cf4afbd2d5754b9f82ca5294655db71277e00d9fdd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd1d3fdda4e32c81dfa85f2b1ef43ee5

SHA1
dabd1ac5ef558bb7f636d52623f440cd1c6b1d5d

SHA256
3869ae2548bf035c2b8b4485d87b5677d575f9530be522816b49d48f9de8c3b6

SHA512
1ef8fd885efecf70c99edb9aa40cf05d6a82596f8cd5eee2cec5a378f8a5629064564cdbfbdd5f0d10374228569dbb804064894523085efcac0ad9f9f9a3b931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62ea7e16ef4ab65d288b2f2012e2002a

SHA1
e8391d3cbcada2c526eaaf714ad78c860599447b

SHA256
bfdb47eae31e96f96e177fde6c012181bf9bd284c2c48a48bf0437118d5342de

SHA512
27174dfcfe279cde51244c2b77a3b57afddf039f17fc65b38f3606f445c10d4af6b04f1bb9ac7ef8b8436fe953e796f4d901e2d3fa614641022ff050f5cd5909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7eedac66113b50cfed64e2040d9b70d

SHA1
dd1d2836527b929a452835a1f54beb48a41a7ff1

SHA256
2b40a77d2a9f26e36cb36cde6341764c354ab32496abb701620e4a7c1d61b0e4

SHA512
392035c47258c33e613ef2ebd1c8072827581db586bc8ffbd89c7a92556030c7b55a5a1ff38194491e848efe29389b29b3fb5e98c3be76935d5aee1b64324611

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB08.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit