1e2f3ff7f1a7cdd761d5519d1dbfbc2425e54e8af1bd00cc53dbb285f9231e2a

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b7457f8dae2fd7f5485602a556ccc4a_JaffaCakes118.html
Size

25KB
MD5

7b7457f8dae2fd7f5485602a556ccc4a
SHA1

ed8176032235764f8bc89ac441fae8276369911e
SHA256

1e2f3ff7f1a7cdd761d5519d1dbfbc2425e54e8af1bd00cc53dbb285f9231e2a
SHA512

ed359d45ff81085a3aa13833669be051a2a42182864d2ae0924b036ec2b76bf8b934dac01a0bdc78397d998afc94ade8a386de0d3ac6b36620a7bb670b1e8f47
SSDEEP

192:NQFo3veb5n+nQjLntQ/ynQiesngnQOkrntcDnQTbnonQNMC+AEpdEQwuXMQnFnQv:mFof2Q/7QwBS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A2555D1-1C9E-11EF-9201-6EAD7206CC74} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423027034"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1524	iexplore.exe
1524	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2144	1524	iexplore.exe	28
PID 1524 wrote to memory of 2144	1524	iexplore.exe	28
PID 1524 wrote to memory of 2144	1524	iexplore.exe	28
PID 1524 wrote to memory of 2144	1524	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b7457f8dae2fd7f5485602a556ccc4a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1524 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0376abb7e9728d9f2c4ed4bbda802d

SHA1
6ac1e8679d6eb0da5da8e12bfe4e4956a76940d4

SHA256
963dd71acaaf1ec5401f4c87c3157f5de810c61a06869a06fafa6cc0f4f3c4a7

SHA512
38d18d6cd9711887bce2c2d8c6c4dd34e03c4543ee525c12eba7d5a23d54294650f4594040aba89ef1e0bc7f4e7f79d2409bec53816053bae41dd1bd119e8b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96ab7056529b29ab1bf1ff68ad0acf5b

SHA1
d8e75dba421b16c26398bff005721c88a96c7c6f

SHA256
be53d2bfd18365f3e42077da6260739e6c4d719ccf0a030beb3b60efd012579f

SHA512
2b644fe281cc392a8cc12310881cc895d26c48f26f2987a399bb31006a3af3261e2ea675e3653d8ee701679784388e64db3604cf343e65b83e89ffeec1abd3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bab60b90f3df7339ea4a9c15de62e36d

SHA1
3f0468e493b7cdb16076a78b63fe3ce750ab69a4

SHA256
88ac5f62daae2726f266a50b0ad032a3d3f3ddb1c507b0ac797ac12fc17f0361

SHA512
e7e6c458dfd647d606a416f95817bc9675053361693094fc2a61f0871d957fa102d15da8bb8e7e6e8b576d2ccb8fcc2a6a976ae14002dc9a1b4d67ff1764e327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14d6df704b9fcc49c474e76cd7660c00

SHA1
b85acf949bf883d72160a49456db1898fc1b414d

SHA256
d40e63edac565bba693fe1b57e3da0f43ec6f787966b2fd91ce90a50e85b7066

SHA512
277c8cda2c7c4ac23e6a524b6d9f347711358a01ec552781b7600ca55cee2e1ba5ffd989058e7838a689d175408f61baf9bdba37b1d0e27cf192514ef1d9ea69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4c5b4d53a012b027f8dc87bd5274dc9

SHA1
c7caa91f31225a87717739e32af8f66398af2004

SHA256
4b86fb9e2c52e31221a25f2ac85e628e0d562d628d1902f495b9dcfaba921546

SHA512
114970f848148493e368fce6035279827044653f1a10084ba804edea53f5d8965f356ef252a35aaac10f83e2b7d144dff084c1a3ec1abaf9c4b4a601afaf5248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4fb435d8b552a68cfa863b769d38ab

SHA1
2a9d726159df1500fde91a8c42502acf6e5df3f0

SHA256
59ac21036d6be4a7ee4c96fead58c6da38fd73d5cc0d6740ecf2819c3b76daed

SHA512
226941109fa431f9f943fb2af9a24a4c8106d962351039ba02562d7cd43db22b8982af8f20936fc43559771548bd0ef58c30a63d08665b6d1491ec3c1fc6ec3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d18c1b97c5be612d88cc5033da9a6fe

SHA1
a83b08a5cddd4a73eb2d8161aba6554862a70a3e

SHA256
d494c688c860f9b0f7720856cb9c95532b35f4ddc06993f8c7bbd170b1621498

SHA512
f682cc3834ef6e10dc8efbda25a2a5fb97bc6db347723feb93ab21d46b4a96c198852768c24cccf1dab4d89401068933080c246c21dda6aaa19a2cf542d6ac3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9276db187bdc2cd9583aeb66b033bf5f

SHA1
8419996d5103f553f907e9d6ab68559535f64b58

SHA256
3bf53b909f53392d214e5e112b74137520474b686bbb3e7ae041f967da72bed7

SHA512
f6d1b5aa5c61d98edce3ae2510524b873e952c2044a61147d2806d4f0d166b731272326741a11e2dd8261971f05eb6e4e9a4360c33104d95a29039aa3edb57e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03bf2e5f3d4b5a15f15734817342bfdb

SHA1
c33b87065967cdf906e4b179cdf159b1aa6e12c1

SHA256
95627253d0cece872d802148dc10aebb6cbf4fa84f03504b22bdcdeedd5ae2ce

SHA512
b261dfb3763f227a66c9dc61ff9edd2b8a82d27f1a94e378e382007fbd7bdc9b3361f08978e07d281ae944d1a8f689dfbd9af7e733a02334357e0bcc006beeb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D15.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E27.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit