5d6066aaa74c8e1fedd3756d9d54113657d1aff9ad101d48797033fa5aa83b5a

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7d6fc27f1c4aa78ae0a2dbdc343da693_JaffaCakes118.html
Size

17KB
MD5

7d6fc27f1c4aa78ae0a2dbdc343da693
SHA1

befea94a12dd6d11be0a6b300cf19916c6a33a36
SHA256

5d6066aaa74c8e1fedd3756d9d54113657d1aff9ad101d48797033fa5aa83b5a
SHA512

7eb958853650e49b36a22cf6e99e231746364a273a8a768b2886409e6e3c1a8936bb4e81f0a2354a324315f9ef9de1c54aa2c3d6e0bf5a3e08522d8204172137
SSDEEP

192:4XqI5N7xP8qPqLqGGrqCpHRTcqGZCB8ZJLq/peYhE3BaP95X:i9AGrqCpxWZCB8ZJ0rhuBaP95X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423071501"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D25E8AE1-1D05-11EF-9BF3-52E878ACFAD8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1044	iexplore.exe
1044	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2728	1044	iexplore.exe	28
PID 1044 wrote to memory of 2728	1044	iexplore.exe	28
PID 1044 wrote to memory of 2728	1044	iexplore.exe	28
PID 1044 wrote to memory of 2728	1044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d6fc27f1c4aa78ae0a2dbdc343da693_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6313c4153b2e57cf46b7cca791485eab

SHA1
985bd765557f425c41f1db9c534cfc634af5c910

SHA256
d91cf9f934cf80de7076e300898f834657c875f1d9dcccc5737d74ac33c0bfa5

SHA512
831182b68902ff065e527f253aaa372d870547af3dea6fdab44cbf09af3eaf9ab29652ffb7485b3dbe1f420d20bc4db921ab552e5c8b39d953a2daf423ed98bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1dbd8a90f526083e0e045109cb847a3

SHA1
7a9a2eb1689018f396769add8cf066c0e8f344f8

SHA256
1f6ff30789c0f862e05bcf1560c29ad720507d2425a15caeb371aff4ef906abf

SHA512
0f9041835b04c3882c02a21d9f5f0bf76dfe663e713c7c48e475d924cecd7c1054f2fc1017b1610e58fac82c1dee6030745eb790098ef1d1f002fab7f8861b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b074654baea2677597b09cee4624dac

SHA1
70d77bc257efb8c54d51e85cb05c2b44c6e36611

SHA256
1e6aba91d03142e19c48db2c6ad0843c280cb254e9d1117584e15f94735dc8e4

SHA512
4cc933dc63838765c3c208ab21969306d1cec98bd3813cab8c143d3845eee7403e511b9fe7e8ea6f0ae06341fe56e52373158241571f6c366eec48a5b4ad2e07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c6fd440f6567b2ca39b174f3311bce7

SHA1
d84a73e54ac4d5c51239930808d64da4533f847c

SHA256
500b8afec55478d0a3f40c22e209d71ed2ba7039754e47ccc990c63f96bdfd99

SHA512
1566a04598cd70f01205f6f2fbf9dc62329fad1308193f693d32280d0490e90dbc03c3eef0727b90477e585e255faec3147559fb68508cc163cf2eb53036117f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46b87d775432114be799c9c72561a4ef

SHA1
052cb9b03527e05adc04a537b67444a6852297ef

SHA256
9547fdd94086d9d6cc11a9b6e64d22809dc22bfe2537fe941ed209c9fa5bcaa9

SHA512
0ce5216ee20d12758d6035c1d4fc89d254f0d38a0bcc5b169164e685a709da416b81bef8fe7bb6c5bb51d9eee2417e75b99b09facdfa03a78ba8367762fcbd23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8f546967b64a5e124d23814c8c6c348

SHA1
3a349b5e5d8cad9cbb65318bc45fb31af27a55a3

SHA256
9a19e2f9cc62fd7dec5e8ef9536386b73041a4e1b6e44a72781d64f1e3788a8e

SHA512
a2c6f27c4bcbcfe578dba07dfd5d7f34e6dd5cbc5b5969f924f1bcfcb46b65a27c1ecffdd7a711bf41a066c89560f44bfcbeb3f58f373d3d528ac65159c04de8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad856b6c0cc82dfc892c14475092adae

SHA1
477104403bc9d54b043298b0fa1b978586fdca53

SHA256
71d5db041d669c6d5cca1233d8d3e1677a96ac127bc9515c69f0a5b74de4f8f8

SHA512
584e4311be14da70dc9ba7e09d0eff929239c402a647ef8c8e368d03aab2205c2b711d4a895374d5311f62a917bd27d4a3ac62e1c497adf1194b631078eb932b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0de77ccbf5c12511124d28b4eef24389

SHA1
3e4ea4b2c471b204e28999d4a7577533dfc9b4ea

SHA256
50d10fbad454ca5c76f58ee08549e8278547e75f739168fc379a71f10e0ef932

SHA512
22970c0c8ae77bef76f0f9dae2ac721d9d5d17a330c97942f35e5179cf863b02d2d4455a67d844dcbd9c2c2b8d719c28be3d9f1830973f03eade1df4c6993d24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5581c49598a2232bfc02d6518a9e736

SHA1
08dcebac22a7b8ee508cf496669756c0358f64b6

SHA256
4d7d94dc0562e0740550551413673e27d3f59d5dd2ce6f832e54523d8f5415df

SHA512
6b26c9bf63e958d774e9696818c0cfa29af36ad21f619731a98b95a679c69e6439942101fa1099e267c5ad952bdb67c0354b387679667a82b9511b6a7dc47670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e267127b3f3d898c0f46bad76d013c3c

SHA1
1c1949bb4bcf24c15f4ae5da1e5b86789376d82c

SHA256
e2214d6254cd09beb93f90884c61c599715bccfb64f8a29457c1252b513dfe34

SHA512
3fb37af64c7356f7e08b98fb045ed3fa000f23b83643baf07d7ab899e52f4e218fbe00afcd96fd28735a2508b2a34ef4f9ea6de45f75ef4279d80e9e6c270cb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8072efc4c0229478a73f25a39d244e6

SHA1
b689a8d2c4a607edaaac9ac13aa64a1cf4f59a9b

SHA256
75dfafa8a3755810a32d0ffb0c72d8fac79abf93ae81235a98898057a0593be4

SHA512
5b7cf1e13178c7bf6827902e4a9d30c73ecfb223175aaa66d5ca27c7896da3687b52aa4b8e801ef5e73ee45cddd3606971467c141dc3519f510c85a0cc4b4c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34bae54627f3f223762c7848720cd145

SHA1
8205209a5fe9870d6cf8eac534557f4b720e5038

SHA256
d518c809f565dd8710b5d822a6a802af5041b7d3ab91068c3975aa8defb9a7ac

SHA512
8f4584c76ee9411ab52e74bf13d2ade8df4b0dcee725b30ba18883051dfbe8b148e69c2372d2464954389196a0fa7fb5f74d5148506124c491a54b9144c29d40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab62A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit