5dd0420d3e9ac97952c5e840d5bc487d889041993a33b49de70091f9c6638267

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 05:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7bd2a537e428ffb564ab164b7a917bbd_JaffaCakes118.html
Size

22KB
MD5

7bd2a537e428ffb564ab164b7a917bbd
SHA1

0a599357da2cc90a32a356acb2678626eca052c8
SHA256

5dd0420d3e9ac97952c5e840d5bc487d889041993a33b49de70091f9c6638267
SHA512

547843266bd180969d8dc4e3ec1db4bf6d4ba7dc7bc300571c109156e96f90a234ba396b85c5703f19abe61e4ddadd51297bd66440392584b737fa237ffef7b4
SSDEEP

192:uwzBb5nKhnQjxn5Q/lnQieYNnwnQOkEntPjnQTbnxnQmSTxQGfY75xHMB4qnYnQy:RQ/FAx3NQ9KE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423035105"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15DF7591-1CB1-11EF-9A72-56DE4A60B18F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2744	2468	iexplore.exe	28
PID 2468 wrote to memory of 2744	2468	iexplore.exe	28
PID 2468 wrote to memory of 2744	2468	iexplore.exe	28
PID 2468 wrote to memory of 2744	2468	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bd2a537e428ffb564ab164b7a917bbd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e745585133bc2d24f24abc1f1b7a0b08

SHA1
682b06c21a1fdf0db9ef10484dd0b770c5a2007c

SHA256
02a00eb02e63b5c21c6a74da4cc7ac04902f6a92be74c5f7c9fa5bf72f38eb7c

SHA512
c77080b32b1f572ba202accee6db9e904ed83ca72b0b19b1250bff41079f6a5f42e7c99f67c69023f69cc91079fdf7a5fd04e53dc351f6286714349d9d206fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd23e86c853b6e4d1a641d744cec1e01

SHA1
4a3f7891815982e00ab2d03340f57e00c89d648d

SHA256
5ddbcaef19ab602f36ce7eea1068cb4d11462d9f84abdaf60247d6c85ecc39d8

SHA512
bf22e93d29914b7c90587b4deafb7710e52a22b06079ff9dfd6af04776ec101283250e79c398012d6bd593190cae01d093a2b445ac4ff2b4ab22ce1f396fff38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6078acb91889958802fd8d739406ac9e

SHA1
d21c75cae6ff0d143ea26674bed2fc97463a9400

SHA256
f733b917eb23eb542c555335e5e5be9cc52e45acbbd9f1b2a68fe9b4c52a583d

SHA512
e299eeebc1ce8d68c3685bae422351c0c62ba5e59490341d984f722b1583a4fd7d6ee61f5f96bda9a2a4f278fe0add6168e20ffd3bb57f457a3b6f0e66132f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2194398e3f49bd8b5bf56ec5850874ae

SHA1
a99218726f4e93b684b0dad44a31556861c4656f

SHA256
cb8544b2827892ce81ed289e83662287bd97b23f76195b624eee5f4163e6d2e3

SHA512
fdca309fd2ccd3e0677d3317283173211cd8b554706fb0564652f082beec6c8e9c4e2ec019c35f59591bc25d0905e4110ae3bc28c7e847d9c42ca2d13e803e05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60af025a6dac023b678c17f4291d797e

SHA1
ce02d58e0d3261583f3bf81ab37bbbf3fe414d45

SHA256
8e0f73afaf0f82fb1bd03f2a172ef362f7600d04577c8d41b5ef2748a4d52382

SHA512
1fb2ee7356fea373621633c38868f6421edd6bc79b7775d7fa088b92678429fe38cfef9a0632c3261274a245e81db8dfce5f5aa5f4e161297bb8ec934acc448f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04fe2f5d247e3a10664711c263eb02d3

SHA1
8efe30f2396736d569b64870f03f46c677f35239

SHA256
25f7d3fc43be3aab27bfdf277abc0bd11c43f832e403cb8e370c5a233fc157ee

SHA512
240f5ff863fe4648605852054270f854ba9f2df59813b89a5a48b0ed96eb3bab99ca62aa840225a641860b79e130a6c8406b081a21f3b3197ebab4784e09077f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9dc5b5638e80b55f79cca53c1d54afa

SHA1
f637f96c8d3ebf1e8d511d5c9e2e65820f4d5031

SHA256
bb2b74f1278daf9bffe58aa151954f07e4b9ff23e825ee22c66ae8bcdb2d89b4

SHA512
a53f22683cb9125312b0517a78b4815317ade76d27afe8b70449240cd64d85c3877ea5375372118ef639c45e374fd571aeb2843d8ad1181442f6a12c52f6b616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7af19934f366817abc39d294b595bce

SHA1
7d1cbc561b4f8eb5eff8aad5eeb2801f3a643f9b

SHA256
4268abdebda0c2d9b3468411e93e232aa194d579466148f007c69e626e05383a

SHA512
f000ee56acf94840d201de05904f6e8d9527726fbcdd4da75b3e73177b738886348916c7445d1b5719bd016bf134980d94e11e364c6ca4e1b41c8239ad5bbeac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb52f77d79748cec472305e5eed59d7

SHA1
a7b28481c7043c896aef040034137b17a11509e5

SHA256
045ec45e7f10da390397f8ce11a855605dd21877dfc6d427b9fc28fd90dd0ca6

SHA512
985e5bc959e6ff6630f00b18cf670bee9222f3c6adb7a36bd8a9427dcded3b1ebb8458c18cf448f7d619ca9dc86737effe0c3a9f851f3822a151ad11edc61cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1142.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11FF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1213.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit