72bdd55deb3ac745f63ef9e33564bca11f3b898091fa1265682d80ffe5dd3b98

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ce8d4b9aac929d96bf0a6d1f4629e2a_JaffaCakes118.html
Size

143KB
MD5

7ce8d4b9aac929d96bf0a6d1f4629e2a
SHA1

958e07aa7ab054117519b5a35ebb4f4b43c91452
SHA256

72bdd55deb3ac745f63ef9e33564bca11f3b898091fa1265682d80ffe5dd3b98
SHA512

1aed1ac2cb9d008f80c866685080cb99be4ec51f912170e61815d8a95d40af04b5b833e031c2efa9b07e117d7b22f12482b95f0836df529ca4f73e7e518d8cf7
SSDEEP

3072:SCl0laO6x7dyfkMY+BES09JXAnyrZalI+YQ:SCl0laO6x7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423061698"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{009FC981-1CEF-11EF-AE43-7A4B76010719} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2780	2068	iexplore.exe	28
PID 2068 wrote to memory of 2780	2068	iexplore.exe	28
PID 2068 wrote to memory of 2780	2068	iexplore.exe	28
PID 2068 wrote to memory of 2780	2068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ce8d4b9aac929d96bf0a6d1f4629e2a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd78e5bb980d1fdc8c0af3840bcabc4a

SHA1
1a90899fdee6965cdabfe139eeee885156a77a26

SHA256
160a6c61952ef96c18410d9c25fc80d865eb8e92ecf20e500fc55c602ad8c806

SHA512
23161745c29d6d95578306f8ce8d27b17778858bb08eb7a4a35af3588864d1ee5a8047db788251bf0a249e5f7b8381078b552e9eab8c3ac26c83b6a8035a4767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
080ce48cea36e38af20173f87cbf4c96

SHA1
233744ea09540761e1c76d4f48c25d00e7efac8f

SHA256
94b9340f1bb7a9ce5f48a9a793216b86568e4e970335dac875649fa81a3a4605

SHA512
815545cb734e5f23e13c8cad34ca0daa8354faec170e2ba3cb02cacaca64e3b053771c734402fa7d5b872347eb918258575d542260213afbde9bd9dfea9a4053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2f05800f0da0f27c07a3a76049abcfb

SHA1
2c6c96dd813e4606409bc1872ef6d93b348b3f10

SHA256
6efb671bce05c8d6f685695d91b47d21b4d82bee1bf05f23f13f41ec4d82659c

SHA512
0ea5944d8224d869de0ca6d983af3838fd4e9be809c9064d1e4d70a4cb794fb0e757466149173f56f59bb8e120e03c9fc8bc7329754a167bd627b35f8d7ec885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15d659ec579ca2c522dad8b97447c7aa

SHA1
92e5e78f21dbdda5bbd89be6d68bfed352af1cd1

SHA256
aee1421a0298a2a10391ed1be75161582d7e0ceb16778f9e378c7dee0324badb

SHA512
84727207b56d2b9dbaaaa2f2259dbed7df44f8ec71b2b775dc8a0ae4ba0d8b2cafdb72f063f8d436ff2ccf7065255fd89f7be692c7eab4f56ef2aaceea85a795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebac411634e8c6edfe3d482f79a35fc3

SHA1
58d4eb8a2630343422546b539f3c81cf879210bb

SHA256
05ac3a215be12c9715aef599e536ed049bcf3e19c59dcd662fd0f8a73b0397ce

SHA512
625b3d913625adc1ff8c26de6545f6d02818b780858cf29e7508e32ffb3da40faf96daf62e72741bbe40a04330c4dbb99ade8a33fae6202077393dedd6476886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bbcf4fd9590931bb08b9a114cc5148d

SHA1
6f1ff6f58de68bef2188f11b3d337b5c68d84b1f

SHA256
64b2493d1142665c29281a623fb5649ee62917224970ad009feec08de0795ba1

SHA512
84d4a8c736ee18ea8bb7425583dd5a150d410c869159bfc1f3010d6743bd77bd41da759b6585ef17f62272167d817adf1c324abb28c7fe7c14130d4573df32ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9baabdce36e5f3a81b047d056959702

SHA1
1ab2e68730c3de17acbe625030823db2e32b5683

SHA256
150a446fd9e158f581179886b660afecd48cc2569ed129413aafb0dde6b258fc

SHA512
54c352c0d424ac13585880c1af57dc70bd5f6a884ba7e8211a74d93e9c8a94316f589373b1bb5988b755a2e19144894ca016947a89719c99b3d3a5edad172911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9be4e9d5e7c8d896e944c989d564f8f6

SHA1
3a800762073a09a5bf6a5bcbe8c212ad38c9b8d1

SHA256
2f2e2e5151f7532e3e60c6293ae8d7080624fa674e364408018c24ffd21de011

SHA512
b873d30369d02a41fc2335da04e8e647912d65f5c1e892e044e03d78ce82a3c6a4c4cafcb855f59dd2a6c1419e78e2fe270eb72c05b62f5533fa60ae136d6a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
015a961d3fa766409c55c039ffed2ae8

SHA1
7e2bd3206fed25d6dda6201c6557c93098a34276

SHA256
3aa5b33f95c24c1abdb7c408dccd41eafeaf3eea41f9e3d6702f0021cebea50a

SHA512
74a516fc4a195776d428bebe901216aed9b40b6be21096c9786594856133a2fb813b972d403d40f145db4b4bb7f95d7016b15b7f58191eb889acb98afdcc26eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C97.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CF8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit