4543b18efc26e8372434dba7c30454ca147ac9b2a84946d8223f5e1a8a8d7627

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dd827afda906273dd3a31b07136c0c7_JaffaCakes118.html
Size

21KB
MD5

7dd827afda906273dd3a31b07136c0c7
SHA1

72410ca14b55fb9e6c77afcdc14a9ef14edc881a
SHA256

4543b18efc26e8372434dba7c30454ca147ac9b2a84946d8223f5e1a8a8d7627
SHA512

86c3bfcc0bd8a35887a0cb4c63406a8ec65e5a6e9cdef276ad4a4ebd4ba63ccef3b3876a0e5fe86126ebd8d84b9e1abbdb712c549b225c637d571a9a92565bd1
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAID4pzUnjBh7982qDB8:SIMd0I5nvHlsv7mxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423080612"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A2443B1-1D1B-11EF-AD30-660F20EB2E2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2696	2072	iexplore.exe	28
PID 2072 wrote to memory of 2696	2072	iexplore.exe	28
PID 2072 wrote to memory of 2696	2072	iexplore.exe	28
PID 2072 wrote to memory of 2696	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7dd827afda906273dd3a31b07136c0c7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7fc73498e4fea2d7c7ab7d416abc371

SHA1
9a34e9b39cf56c10558f9c15ca7aa006bbc6d386

SHA256
4b951cce0c3d23ad8ff8f085a90733afd105703bf754bf6e6dbc97d95fd16902

SHA512
c5d4222da3c2dc5330dbcf94fe15464272df292d8ab1e1b780d09ea6201a2138b4e42c345a3af911496aa2b035d1107330d1fe9fb809d2d013485bf1f065eb39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f46e31b697df756ccfac51f98b027752

SHA1
2896672a0d81168cdc1f4ecd7553c6c90a7d6033

SHA256
2faa6c75b821a639cc20b5e0a5d3ba1f9ed1e36e67222df13772a43031419a96

SHA512
7d976fdfb56633e33878aad856fdab55471e9c2b69a153edbace50eaf1b43ed10a476070df0da0fa5ddd89d035dac29842dbe9a07a472afd9180768755361df5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a6f6e120ee7d423c86e91a897964c1c

SHA1
2976ae70494f3b228fa0d16d302dfdc6bc1b8275

SHA256
b1cdae7aab676a28c0c48c77eb3fe57a127be3636e6d507e2fcbf026aae0626d

SHA512
c5f233bab4e1eed5225c50d29b992e45c6a4564f08b870d0077bcaeb5d1e2cfa3b18f22df410c52824a515804d90a7ab341e137a028822dbf5e0b7a04c86a051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef0978922e014a437370c5e6293c4e80

SHA1
4fdcd17f1dbcfff54080d20ad87bfa7d0ad78ea8

SHA256
b27bc0cb9c54d0c57f2c27fc1d1042afabfe1b81706ef239d4cf4e4979d75de7

SHA512
ac4fc5adf92903f851a0d230e8b1d398d0c9288f527133cefa32eb2818c670869489e7553bc69a1d8774d4f717bce9d60e012cdb7bde4b6eba6c852a8873928a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9351901b22be195855dc7988c6e388f2

SHA1
e7f984c8d506a9c594e8fd5e353c574dcf6f55ed

SHA256
bd2fb7123750d1862ad83c91d5207dfbdb83bae69685a9677a0c5e129aa7ca6c

SHA512
224f614eff48813325fd21149e27e84ea436ac05e74aad4ee9d57add74fc6e6335445c8fbf520c3088077d43fb108c59752199a248b9c1a4c296ac110c77e80c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0231f9eddb979aab721e905bd1657e3a

SHA1
4e47020e04666feb2aa3763616b0d947a6a2d305

SHA256
622cf46970ad2ca18aed343bb935a1db345968db087b570bdbf514070880e86c

SHA512
c84ec9e8f0baa8b0f147df82df96a83bac738448842e2f8b645a2c520b919c4d4de551666bea69dca5b14c91a53541856f027486295a3445ccd37d015477d837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
437151f8d28455870bf3702321a90db7

SHA1
294aaeb2c55c8236224157bc9ffd1365c5c8d511

SHA256
061afd478f1859ca5c41c248095192774329b0c05291451f7d9cc96adda4224d

SHA512
019304a6a1929d14cb1d55ecf82ff6bea6faaaf325bc4cab1ee9c86bbe9f50f34f9e550e8069f5bfc98305c7b6beb7f8425e3d543fe8c0704982134b9a11e621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ed895e27552dd93664f4da3ed5745b7

SHA1
7dbc2dc2e3ab30dbe46b037d779378d7d83454e1

SHA256
4e39bcfe99a94d81d6a45090b788079b17dd7a07702b25f708ff7ce9106c6fb3

SHA512
d27cc267a8fd6212d7e1762610bbff67a4825130c120afd2081775e34065ffdb63a501115942a2b667bcf216eb821570c4766a1e9f830d8e95862cb7cbd0f9e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb215b6f00413f422dd6b8bc9df626fc

SHA1
b3d77daacbd9ea6f6456edcca8e1c5e465455a46

SHA256
227cfd26a4bc0ec5d4be81ab9327b7eec70349d549e10b9e508a488b364f72cf

SHA512
a779f882c1a981cd2d820b7126f56f67a541f233f0a60372debc9aeb7244ab63bf76a7352b35985f209eeb415dd39c16473e631d9566d035d51de60e219347f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa118c0bfd1cc8a3f8211e391929f58a

SHA1
e7495ff191ae851b8191569fa4faed9b2a7a6f8e

SHA256
62d3bd0c28dd4d07ed8aec9c45a366dbc3fc3d9b928f7a42652b55295f008eac

SHA512
b664c84bebb5d8bb561a682d6024b988f4f33b0d5b2aa3e66a450bc446d72c45f677cffe02ef9ac7ab5001d030a8e94873a1f29457448a559e59f2d97871a303

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1641.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1722.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit