a78e0e44d45426891419012c0c0c08124691560a332f437a4490a1b0c25724ae

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ba4fb0f21f007284b35d5a4a2ec7e26_JaffaCakes118.html
Size

27KB
MD5

7ba4fb0f21f007284b35d5a4a2ec7e26
SHA1

fe5d2d01d8561dc06395b179fa0d36322b9f48a4
SHA256

a78e0e44d45426891419012c0c0c08124691560a332f437a4490a1b0c25724ae
SHA512

9182a52188c178e8741ad4589919e7e9371e48519520cd2957f8c98931f9a2b1a24bf18c72faec0b6d95a6a6ae416896e82472af0a77cf96e9b68b32d634c3e3
SSDEEP

192:uwXAb5ny+nQjxn5Q/ZnQieMNnunQOkEnt3vnQTbn5nQ9e2Em6uZcSQl7MBsqnYnS:rQ/qXc4clS2p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423031161"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E70B91D1-1CA7-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2592	1888	iexplore.exe	28
PID 1888 wrote to memory of 2592	1888	iexplore.exe	28
PID 1888 wrote to memory of 2592	1888	iexplore.exe	28
PID 1888 wrote to memory of 2592	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ba4fb0f21f007284b35d5a4a2ec7e26_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d400aed05e0a90ed69ca0b68ee987825

SHA1
056dca6d0f15b53777324ac93905c4a38eccdc0b

SHA256
d1ab1407f89686489868df24ce550ffd0448ec6c9960b6a77bf8e6c55e13bdcd

SHA512
a6d3e686b5e70afcfb36479a2e16492b48d02499dbe38d7b3bed08ca163de10b8845723ba4fd2daeefa38f3f6a7f54b62bd272120fb8cee4fad3892ab644a92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
150f9ebcc3a87f06842fec730312bcb9

SHA1
1be3e40803f0469e6ecff73d9ce1b854bca8f320

SHA256
f9ebfd659547dc0c080f8a1f1b84a8bde40ef6c1eacdc0d59ff7e985f557d937

SHA512
2e371427ae8c2d4575ab8d05b91b3123b73a324008f4c728490007932b6ac7f478b011dccbe939a1968e317e3868bfaee368b3a81a8fe9780feb97f2cf5b8b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e15d1b6663e0a8841ed91e8b8124a818

SHA1
0a4f1892bb144db977612133ffb7973a005efa57

SHA256
fea961bd5b4694f586a10061b66c07ef4c91759e934288443feb614fedc6fe75

SHA512
293aca71b6484117daa0561fb6c3b3d9073a52e75b255d7d858b8e77cd039fbf652141c3a1b2eb545fe3fb0728923da68c12e26f3e9aab166f4153a8ed25c9e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9185e53ed7b8102944918608cdbd7a39

SHA1
8a1c3f429bd22f22e7856e5721f688972bb92484

SHA256
ffa59e4fc4df12fd7a81ed44483d7fb45f39508bcc5b49c3a109fb837d45283d

SHA512
16b146fd0853f4d45622c2b96982aef9cb3d004dd627c526f81cc2b1ca1d830a18a38d4ca9cbdfe1156f930b6ff569adc4c595339bc4787fbddd4877952d571f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
322efbe36e88b7a99c9303edbdbeb85e

SHA1
94db67c69e6d801b83fdf279be65098c843191b3

SHA256
7564a002567f72cf7dea69d9c423213339b76508775586a179dc8c7cc11cd0eb

SHA512
ddd2dd8033d6d00c8f3a21c7d728fe827a360e3f3279a70fc6736891eecdf5608758bff1d9005c7a2d6a17d60d60cb4b9d97eebbbaf41fd652786888f4bbc98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b188df7cb8585af1195498b0154c319

SHA1
e9138550c1b162eaac0c45bc84757b56e528aaba

SHA256
15cff28bcaddce83466f1ccbdb03f87ffe8980f79597a8bf1f41bd974e5a3bd9

SHA512
12966c0240bf0f3297c85ac3e9175f5556c100d05e2c42f191de99f249679763da5e087a88848d6add93a3d9da7bb4bdc2d0aa064e4be878214a239040437cec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09dc2458ac9ef9775d073879c99929af

SHA1
d0ec7098426e7daf3e1d7b63f014254790cd7fe0

SHA256
d4abfab4ef2590f04fdfe94b2f7206187a3e59c6c2973a16fc738fc0a118965b

SHA512
74997fa13ff059ff82be63e4f4b8b385a09e57160305d4e7587546ab0800bbe0ea6ec9eaffc45c5e4463211f4c38fbaf12e99a32b41c52d6796f0425e97f9d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
403b7a34057477269bd5555e977d6450

SHA1
cd233da1330cf0f227a87f45e3eb6162c5a51ad8

SHA256
06c3d277407093cf5f87c96ffc5056848fda74a291aa0ca414605d1c5e77d5ab

SHA512
a4b5d11c0a46ce645251c396d0cc9bcde79bf68d674da892aac9ee4bd08af99b2d2ddbf66186b2d4058b82186013fe10462a681bb7cc50e488fef3a64f99976a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e0c567e404ae0a2246a067d2ad73a4a

SHA1
25344ba7c6491ce6101b8ca17d5195001e82fb6f

SHA256
ea253839400b2ecc5e43c98c14a7bb798ec85e8bbead0b40ccf4a46f3e7f257f

SHA512
f2835200aa909fcbadc7391ec017d895f418652d287dba86c0fb030d1df28cd14841f45f11ba39274e9de852c960a04b5f323f2550b5f45e96eb1ff3724c5417

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27FC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28ED.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit