206258f908f6959a49754be85ff3ea77e86ef2ccde9cb93de5c23a1efa2ac641

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ceba2d7ed4e3c22ae11412830493028_JaffaCakes118.html
Size

23KB
MD5

7ceba2d7ed4e3c22ae11412830493028
SHA1

cb4c9025458e080667aa9f9166cbc0b22e11cf04
SHA256

206258f908f6959a49754be85ff3ea77e86ef2ccde9cb93de5c23a1efa2ac641
SHA512

d38c37783aa29b99d87b13608144265183f663b38d86cdd01ce3c1206e78179403d558f76267db5bbeab6ff646cd0c8937f279e3c1afedeb8f267a04f52fadae
SSDEEP

192:uWj8b5n8/i6nQjxn5Q/6nQiepNnVKnQOkEntycnQTbn9nQpCnQtNwMBJqnYnQ7tC:cQ/7CVZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49438551-1CEF-11EF-805B-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423061820"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1232	iexplore.exe
1232	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2348	1232	iexplore.exe	28
PID 1232 wrote to memory of 2348	1232	iexplore.exe	28
PID 1232 wrote to memory of 2348	1232	iexplore.exe	28
PID 1232 wrote to memory of 2348	1232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ceba2d7ed4e3c22ae11412830493028_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db5d68286f2d50576a8522ae8a7fea09

SHA1
fda33ace8b226a49c2a23a007c19c483ec4f65a2

SHA256
3b87478bf4c4cae4e56ce99acb513cf429979921ad037df3ef441e8e533447ca

SHA512
0cfdfb595b84053511ac5d68f9f30f752a5411c7d1f1ddff2dce6b3d4d5c79bf676ec8af21c003648f3c3eb27a75e099fc0f5b7805e6ba08b68e7311fb5d6bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e1ea72aacedca0c5b89a34a6f70547e

SHA1
d8b01718621eb6f1621ff870d5ee1033f05e09ea

SHA256
caa8edd80d4309aa5c962948161070add6a9964da10dbbc65b29b2b9c4ab2361

SHA512
06a0d0915064ff55414c242a000a8ba8e3fa528b467ce56982b4909bd462c335b70dd95a1e4073b1d16c8f979610f54f18529ae46c9b74acd01389acfbf95299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
196497f6655196adbc00cbf829ef0bb4

SHA1
caa050ec5299bac76e4153f2f5bebb8dc2e2013a

SHA256
8c4b7b743a172d20b3944a2e453874c38f758a17caf4924ce5b0134e8e5a8702

SHA512
27f60ad0d6e4d8af936765cb064e6d05869684eec112c391f899df35e2b68b0e9c107b90789f285359a5df247d7d75c310f6cf782290bc66356f3e3192711dd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
028e58275fda8a38d5de97977463ed57

SHA1
4a5ebc665a14115c9eb19a01aeff6238b41a613b

SHA256
938b1878159edaba6eb6d6df01d1d6779913f15d354577b216dd625f171a033c

SHA512
178cac8e87f5bea01fdefe0939d3b643bff14c97a1fb3f2fab5a3d07fcbcb5ee74a8f6884ba299198af068e947ab7e653c8f91bd87f3bd1704947dcb1979636d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e6bf6dc8eda503393bf1bd8a08dd78b

SHA1
6c6e3669c3f641a402ec7bdc1fe7b8fda871993a

SHA256
4259998bc7ac65080c5f706da3345f8fc793496a15740c09e40b6d8af5458b97

SHA512
5e00837989c294fbbd773ddf2a133785f60bdf4e8af7f81ab70e0d4cec46405524aff4e072a979f1393a666dfebde5aa56c6bbc48c6340e2494772dab346d05f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0cd5dd8a24a15723d16dd0d05750f04

SHA1
0786eb47fc7948f087cf68f6b53ec4ee5b2d4654

SHA256
81fcc9c7b35ade558c91ad3031bc70e43c6d845f8b36338dbacfc53781a5bbd9

SHA512
d1caf2d75fa2155def96c4d3206b7eb86300033f72b4aa139ae8ae402201d12e83c54346bc40beb8d6aef3f8181b6fdf035584894c4ab8e953f6b0593164b492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
343baca0aad5becfe32f48d69bd00e02

SHA1
08d125841924807de8935e14c9d8fa751647cf8c

SHA256
e02daf02c83e6c140d5689c46b86fb6db6b1652e6b290ea7f6a96bf941b20a90

SHA512
8eb2427d677991192c8218138bb48c993e09c0d7a6d383ea158a3045a7ccf99bba1b7a22a9bc09aba3c54e4272b9822ee5cbfbaf5e2e82291145e5d63177a93f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c9262d7c6657c6565ddfe62b2180159

SHA1
5066f09b62bb1db5f1f90fabec98414bb2697c70

SHA256
93a84069ea2e218fbafbd64b4a9226ea327db1f4b9925837086a0a2c14ea79cf

SHA512
971ce4e9bfc9a7fd7872adb4cc7df91b95d51b9b061dbfb93a0b6b86d9e9fcb88ba2f47c603a309836048e86fddd351ba2740268f858712384896be598ff468b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce0a234e81912e67018319392c1567d3

SHA1
8c4bfd9f0cbb759c0d1bd3556a3bf7290a75c241

SHA256
6ccae77d2a2c2c721c67a2202d088bfba6029d6fc899debf30eae91b5bbc89aa

SHA512
dd563d26f4e837e922f2bf78dcb4dfde1edc6efcae0f32fef84cd18ec0ef37b9efef5ab59d3387c494760192e05ce653d37541142c786eb01045349b12eb5706

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1258.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12CB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit