2b941d68835f6e7d973fb871b531a59328eac936c89182dc5cb978e87cf5a8c7

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d244cc13cd77408234b733e13c1d8ca_JaffaCakes118.html
Size

20KB
MD5

7d244cc13cd77408234b733e13c1d8ca
SHA1

60e398079697b248648db1d6646f57ed2e0d565e
SHA256

2b941d68835f6e7d973fb871b531a59328eac936c89182dc5cb978e87cf5a8c7
SHA512

b02bd16ad4249cba3b6de3880d191c301081b3d8216269e4dede5321b988167eb47b41d9747024866ecbf162426d96f7ff2afd9bef244c1aa9f20fa8e3571a1e
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIk4+zUnjBhCU82qDB8:SIMd0I5nvHnsvCXxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423065183"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DB58D41-1CF7-11EF-ACEB-F6A72C301AFE} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2248	2760	iexplore.exe	28
PID 2760 wrote to memory of 2248	2760	iexplore.exe	28
PID 2760 wrote to memory of 2248	2760	iexplore.exe	28
PID 2760 wrote to memory of 2248	2760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d244cc13cd77408234b733e13c1d8ca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0923aabc0c3179c519bf8e7c91e7f41e

SHA1
15c50987cd1907159d5852f5ad5b2446703970d2

SHA256
57b7bfc42d1382d1d9a3c31bc8717118e8613f14495524460a267e89eddfe27b

SHA512
f371ed1e8b7fc678e7fb4dfc1e737b26ab8a117ca35d65ce5f18898009e89c83415fe8fdab22f41d20d17035dc2232efb94e218b3e00ac2066411f2da15184b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e9a466e32f616d420c9ef245990a3b1

SHA1
dbcab9b6973eb7f54aea07b259ddb67a23a1b29e

SHA256
35dd537482a104660a1840ab60dbe5d20dcd15e12469074ee8453d91672d1198

SHA512
faf71deabf321dc35acfe1ce18925270723fdca84d47aabb4ed749937d125b8546b43a273ac892622d58e6d5d9e59f21af17fe33a9ab69d77c99ea4cde1bc4f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93e88f95014b0aabb06fbf0e4737b96a

SHA1
65d0bc6d7c067e0248c9d5176a6fc5d55ca4b111

SHA256
fce8f549d4ea337d2c28e04cd88a8c57f54f00132289c8fce7e17609d34f08da

SHA512
1458e9cbcd85d0b23e44a1aa36eb008f5c47931d3fd573954bfa3866a8f3459d6f2d2fe3a7ca4e1c52de584a85d265ed81d37b2ceb9f3408ebf3ca06d0ba657d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f312ce97a8c3f5381899b7c7556391c

SHA1
4beeff443943caeb3f3ea27ed387c918f16de134

SHA256
8d12b3aeff755fb2230f18bd7f4a7e4fdb57531cc5ca636968911a7fe4a5e4c0

SHA512
98c0aa3ab7a8ef1f640a944cc7e31c156c1cc636eb43a7fcd99688f6920f25cf24df57bf07add06959b14e9d14f9c4605d0ef533157abf75f3b94f93d03166f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6676785238b9e92b92cf61e8f1f33bd6

SHA1
ca4f6edcb95ac69cffae931adcac28eefd54f7e7

SHA256
1de1b47ddf92f0b379915c9f57ae790e8a9984c8c5198b771b6b99f734ff86ca

SHA512
5e05df943dfc03f1c161ee86981efedfe53e2971f1bccbc74f4bd1a2c3e033bfa8c9f2cc9c98453a44ed798a4ba297960155be59c66d6616cedaafc26a7be4b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3822a4d5ef63e059bd912f25b4f571f4

SHA1
8bb65cd6615c30b4712289302ea99c9199c906f1

SHA256
cc552a8bde238e0c8ec162a91dff0676f1259943fa375da363f33327901f2df2

SHA512
51934eb3f6090f8a59992aaf7eee866b18e662004df24c7de5ac02a96c4ba7eb9fd10d6f7b0b5adf01fb8ab32ad875d15ba3d4ab3f4417d97571fa9931c114c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
035f0bd0d1ce0449eb1d417edfcd2977

SHA1
183be917145d1477c12d6760ff122f61aa04d757

SHA256
33e381992e68e42dec9f371c11d4b0ced9fb1bc519227b50c1c72ad31d206e27

SHA512
c43b5e4e9f0a443f00c90087de619ff767fdc8a498ac6db28523dba9340016cc104865aab09288d3aa10c1dd23bd838d41f3a395e94b802eab55491443fe8815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34025ffb6f00aa13bb693984c09a3e3e

SHA1
32ad069eb906ac7e14eeb4dc6ef541d3b10f833b

SHA256
b02dcc8fe1fa13b7ff39388e5a9fb740ebba1163431d9a0004db3c0926148daa

SHA512
f1b2292a8b3e64411ccc56c2c8cab3167917ca4bc7dc3f96490fc24af3bc38331d7cd340e33470f03d3c901fc8edfc3df8310f363fd3303c2e478815d2a7af83

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB2A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC0B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit