d78b84d35c25026b93de35ba0c6bb63d22017020c4a208e0b0a297b6cdf72202

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bf992c967c7d3daedd615432689de3a_JaffaCakes118.html
Size

23KB
MD5

7bf992c967c7d3daedd615432689de3a
SHA1

4b7b0a955a972315e8bb328b139f184e82aaeb2c
SHA256

d78b84d35c25026b93de35ba0c6bb63d22017020c4a208e0b0a297b6cdf72202
SHA512

a7b3095c723a07cf60f9d852d75c6c787bc9d0b55d264f1740eb50882807b90b958fea1804ce7c68fe7f29dd72e081cae4b590f5eb140cfd681cdd63749d0959
SSDEEP

192:uwvhb5n/OnQjxn5Q/+nQie1NnHnQOkEntuknQTbnpnQIGLnLnQtFqMBVqnYnQ7td:TQ/GGu3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2001B121-1CB9-11EF-97AC-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423038558"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3052	2340	iexplore.exe	28
PID 2340 wrote to memory of 3052	2340	iexplore.exe	28
PID 2340 wrote to memory of 3052	2340	iexplore.exe	28
PID 2340 wrote to memory of 3052	2340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bf992c967c7d3daedd615432689de3a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1020028439ed2c8e3788ae5124cf165

SHA1
8b72133a054f127e584f23169fb63ab7e4557c47

SHA256
74bb877d10b231c831b932b785c153b63ba39922823aa489a10b9eba4c8b3a93

SHA512
31dbc759a233fae02c63b9f1a2fe36139aa8986d705ac622de451b73fcb74945a01abc0ef3365b1ecb08ce05651a6fa0092f97b047e11505c0c22e933e19d0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d3b031e747b699e58fb495f8c58b443

SHA1
803b0fcc4f157fdf4a809bc8c71cc13541aed167

SHA256
d9f6df14456480449395e313c3e0c2aa80c327150383a53101623a2a4ea8ee68

SHA512
4a4e631cecc9c9798c629d3672dcbb17f4ccf8a86d90072e0e223d7c4396a4e5a80dc452d6a9666aebb6521f8e237a79b17dda942376ac911c4db274817000ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1352dbf83f63f03419c8fb31f77b276

SHA1
b508d039f614c0dc3a36289aa9079562a31cf2a9

SHA256
0073f4961e5a66181acc7f2c1aeee9a76cd7002c0d013241a13e447d4a03daeb

SHA512
533a8fa1c1232766bc87eb2567e423d84b57062a4c287918c19a372447819c5bd4e3c24038ea15276a7f0d3c830937b09c1f4f9309620bac3267c9c09f237d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef3c3bb38bc78714b1154e523f8f1c45

SHA1
d1614219408f757d3eb546a7c55f8081118dfc0d

SHA256
a901d5395bb9e87313515101919b81ded3c93aa31d8d10f8db2995a8f0b911c9

SHA512
8f7f12283661163393df7b8f6170bca4c83cd75354b73add0094bbc724ddd5bd8360b376795db610f74aff27ca05eaad7671e8a22713c166fe7e8bcbfbf6f169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f25f609389aac7c58458da8c396f8010

SHA1
a06a794beee0c78be4fe2c6e1dae014e2350c35f

SHA256
470dec7d899fc60dd5d235639dd0c55159898eb9ef46c6af46e11bacd9d8de06

SHA512
0bd457b79343b8a624700376ddad0ef39b424428a08ba47c83e9fe0b63cfa216f8db8d9dec8aa6c114530c18b38b43b65331e97908fa1ddbd7c7c67fdd3e4061

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa68da669e3a523784ead5954b50d048

SHA1
2b501bcde6826ee60a0dbc8aaad085181c3a94b0

SHA256
03b7120f93843a2d6d9ed0f5b513ab6174e53e027484666ba12d294d04c00180

SHA512
a94a72c18425fa3023cea044053f4ef0b0fc654383313a6385dd6125279d1f16c3117f3ed8b9c23043d27ba273c1f5f41400c7bcad8c6c85a31adf568690cf2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
360af9540e023f17e78c452653770b24

SHA1
64e71f9f24cee55640c28a366290dcdda1dc8f16

SHA256
2ae3ddc664dc98e2478371a68d21bf423b72f4c5772b3d603d4b9f618ffac07c

SHA512
325c584c35dd8a4db06695140225d88b0b8f6ef5da82fc5ada404ec6f784b8e61cb6905c08831b54d6f867cdd2442176ff18ae214d2b6ebba9f25623e49195cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d02c8ec665fc90eebbb445b4e5861cd

SHA1
a2463b9d5cefd399845b8c730acc803ac9400fe4

SHA256
9ad88c032088cb6dab16a434327b82686205000457e9b99d741c2e13585d5ee6

SHA512
1a871ba3a75fe327791615ba01277725573504480346667ad751290316336c6d832f9683a1636ee11da8119345330b823aba3e0a8865cfe89f238f70c6eff623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fabfbfd144f0362624e5d7e888cfcf5c

SHA1
061a8ef7fec0a6a93bb384dd14bba4f6daa24340

SHA256
12dbb0fabc36bb62b529bd6a81d1d10fae8967f1d0bc66863877ff3154e061c2

SHA512
8393bb640062853f1e4f425725864bc3887dc59e56f7fcc6a597b4690b412e4aa6f1b53919074b3eb864262257e3cb32ef1a13f49fa618b4c1fc89f07dfad024

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab122A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar131D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit