5dd15c16a4fcfd1edeb28ec5d25ca0cb5b967c7852eb786f68d88510ac6c19a8

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d87a7bbcbd5295a506e8a9e870b9f53_JaffaCakes118.html
Size

20KB
MD5

7d87a7bbcbd5295a506e8a9e870b9f53
SHA1

99433208fd21344a273ba1628e26d210f60ff9dd
SHA256

5dd15c16a4fcfd1edeb28ec5d25ca0cb5b967c7852eb786f68d88510ac6c19a8
SHA512

101df638fed9ad10672f4393b322b2108436d0d6ee2a016500f634304eeafb9d247293cf4097b4e0697975ebaba420a731c269d91a528febe0bfaac856dc9186
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIO4gzUnjBhcm82qDB8:SIMd0I5nO9HrsvclxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B275581-1D0A-11EF-99F9-4E559C6B32B6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423073527"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3004	2420	iexplore.exe	28
PID 2420 wrote to memory of 3004	2420	iexplore.exe	28
PID 2420 wrote to memory of 3004	2420	iexplore.exe	28
PID 2420 wrote to memory of 3004	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d87a7bbcbd5295a506e8a9e870b9f53_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fc89bc5cccbf955b66244e6c64ff900

SHA1
507d778b5904042efbdfd39a1d0762c522f80676

SHA256
9b6143e89a802eba1b79cd7dec2329b6d5287830b5c12bd6b952c7e710835f1d

SHA512
6b5ac0cdd8cd61c812248145e230c4fb89fd9c67b5c4b83edf52f295ca6556aecaaca558acbe67d2a94e45138e6df0b6f09f01eb42cdf7d85e7d6113d551037d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f899b630f242b62245e1b9c017308678

SHA1
2b99267993931592a6f6a0677ecc9387892eed62

SHA256
2ff49fed55dfeed25edf3fcc71bfa7839d224dd8368fac38be9a082e254be3ad

SHA512
240b1d28168866a837a9b88fae7c8e99086137f4f630023d96f12f54b58cedb86f8302ae9de5111e065d7203bbd65266fb30498256ae52fe028c295837ed756b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b21752c0520c2f810d37261fbe91ad21

SHA1
c50738f18362ca513a68725cf817373ad7cb5051

SHA256
1979a83d3f36af1c7d22b72635fdf4dd4d4117e3e514a3314b413a1cc660dead

SHA512
01cb6334c73a352d4fe9d5f698671a0e854ae5111291a884dac0cf288d75ba281ef135cf6924435471d2336ac365033323eac2672c07cca41f9010b3e2b85313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47cd51363baa71ce8f5505ac3d169db5

SHA1
71bd4b38ac0e9a20d3ebd4df7a39f6ad0d5efd97

SHA256
e2b6c611463452fe51d498e63c14100e61b7522748d19eea57fdb652bc17138c

SHA512
6bccc954275a441f28302c35d9a473beb43e5a0b3b65751fda982604bd808b6de9c8fb4ba35f7979f6b44c590d72c23d5e837ec0bf7dfd53c4335f36893d7e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7407ffb67b03891d4bca2bab327a46bd

SHA1
67f5fb5d4e2b34247133bc32afaa057c6b4e31b9

SHA256
bdf8bc77b9821054f0769852492d4cd345864f34988e105a21e26a27c2223cdd

SHA512
8d6bb997097ad2d3cbc8c0cf3b47749bc573a0abc630b8748f6330844cfa76ef123689c563e9983278f77a7ca61dc0b70db203861eb7528dc42ac54472a49563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
725ebf0d03e13fb6c2875d8be9082af0

SHA1
810a0f9d7fc00f034b40f3a661f7d866bf44e2f2

SHA256
ced582c44a3d7751cf2f51f0a0dea7764ebac409db694cfb9a2ff5035c7a0879

SHA512
90685692267a0371327f3b3d6196e601d0cfe25cbd10f78cdc0738b7962bcefc45a9f2a6f6fcd37b0b7a66069d23b85c226ff286f82831356cea5b67bf3e4f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
184452ccf42a18f266bfe2e1a90e677e

SHA1
077238c87f778ce30e5a1e3c38187413a99a1660

SHA256
1f26fc10cfa926dc1b05e2338862bd8016de2202dadf510774630040f9fb1eed

SHA512
75a19612748931f70804d590b501314a54a0020e3f0495dfbc1faeab7e83b7c7a3ce0666f5358a4731e93602cc23eca5ce2cfc1595bef76603bfdde76f43db8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25f765cd95991cdb94093ae278e9261b

SHA1
8c08fdabec348a862098a2221d60c35621755995

SHA256
462684b768c9a3627c63717fed8d9ce2d55caadebe1b1a3986676950561be242

SHA512
aeba00ebfffc219662f3d6d0f68114238bdbf637adf17fa5181b74fc19f645fb325872291ebdd90550bd050def2299723aad02c417a91069a20e4e32455fb6e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeb4ac97f91cc3af9a62134de68460b2

SHA1
dd9b7dcce55391a030b5f57dc7c29e234c465e38

SHA256
07e31d126fe4f6638720a707320b639564e2e62ef38f293ce97ce94d0377db34

SHA512
1f5d2a9dc26412af99696eb7becee82ef2af93aa671e67c85f0e312684293928b1b8d87dc739d797ce1fc5e09e9d15b4e5dcca75256198b95b1b1828dd84705a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF9C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFAF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit