2687c15daad3b37f625f82f6864ee25117610bd65dd9db9b72cab6036ac19bcf

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ef4e599af97dad27d30caec0847979b_JaffaCakes118.html
Size

23KB
MD5

7ef4e599af97dad27d30caec0847979b
SHA1

ab491c33bae7450350c5cac12be338df56d0baab
SHA256

2687c15daad3b37f625f82f6864ee25117610bd65dd9db9b72cab6036ac19bcf
SHA512

3bbbdef4a7337d974f9ba33e34c97419b564b05a61826480f207b307a58ce0e1d173d4fdd69dd49708825fe115a4159c558c025f8f63c4751a036f191d2ad766
SSDEEP

192:uWz0b5ncunQjxn5Q/XnQieGNnxnQOkEnt1ZnQTbn5nQ8CnQtMwMBmqnYnQ7tnKYi:NQ/Nwd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1D007F1-1D53-11EF-B20D-42D1C15895C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423104972"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2488	2220	iexplore.exe	28
PID 2220 wrote to memory of 2488	2220	iexplore.exe	28
PID 2220 wrote to memory of 2488	2220	iexplore.exe	28
PID 2220 wrote to memory of 2488	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ef4e599af97dad27d30caec0847979b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d4d03081807f1d13e0b982e61b13285

SHA1
e4238b791cc938142160c0bc167ee400a7dc6945

SHA256
021f80355317a552306c473bd0a47dcf2c7754d6bd0dc8cdad04eb7c725076be

SHA512
2d52ba9d8920362713806e96068c1b7cf523b634a60c8f71d35ab88c705502dc86138179819652a5bba9b56a1a8716439f9f38c277155f1564b0226a7a5517cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e11fa953101803a1b2c12501c6d816dd

SHA1
9f78593e1cf7204ec763d1bc0cea4c85bd080a0f

SHA256
d62109a08b4418ec4fb4678d30dfde6a1d6aab7f6b8c8fa6772c21e3d7b84b76

SHA512
7d4f211cccc41fac90a969202663dea9ff67442b8add12c861670c4a5f73947185adf17b1e06dd6661a333f7fbb68801a9b00b9407d6e81cad4f23196bf55835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc17ea6bc564cd402f044e56299060c6

SHA1
23f9918671d2ae71e9df8124cdc9765910e430f8

SHA256
7f2830bd9a967447ab68b79c78b6143826b929d4026c60f1cb65576e87034845

SHA512
4f03f31cd87137513844a1c31e72fb94c34b8167b18d93b8c1a922339fbdb942d2e2c8f87fd62db6157dce85aa398b2e5d2f2f8f58467fdc0397d3ff09f9da9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d513f5ecc2a27274fb248fcae1dd619

SHA1
76aa94c84662c07e2fbe1a4066ee5b5e28df0400

SHA256
df6589fcc488f699a89d219bb4c335655bf0d953075cd6ccb15c18329c6526cd

SHA512
8208f6cb9bf0dec3e81085811257bda8de8124ccc226be5272e6ce068f62aeda0679c7edac23a3e4bd94a54c7fad10aa01b3d623cacf6ef9c7985adb9c4c15e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c383b8985297e67b6b6bdeb5a224f244

SHA1
3188400f8a85e57561798a863536dccca21e2217

SHA256
c11b489ca4585b952d44c4c0742a7793506324f6a8500fa4669fd9d7bae192ef

SHA512
be929543ec5bb6f43b85936fd88939deddbde4d9622b39707180b23e347efe4200199f59e4a65d2dbb1f24488d7a03984e5570df000f89ce03d241ac12d7bcc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e9b3dcb0c4b506def86fbcf14dc7bff

SHA1
7cca9a03e03f6315d03567abca4ec51de0baef9d

SHA256
1b7c3f1c047dbe297595e18c193d2db5dde39d56fd17d1a252b57cca443e28a9

SHA512
803eac7fc57a497c48394580476544f624a4e01b07478fd31ffb903c9690429f049fa49b482e858acef176b4b4734858b72db8e77bffdcc8051148144893f7ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3261cf3f3dfd02f485a19e5bfec8e7cd

SHA1
04147f83a40bc1b76a9416a92e509a9eef0e761e

SHA256
63950d483cb72ce9147e54618ecfe9a0f56e72174efab6e345b75f1c72910bd2

SHA512
f656ffee95072ffec822a6aa145d50a73290a4c08033ee75144578bc76db6a8b4412d12f675f681bdd6f3d964566f0b5eb87de493588d1c0af771865b7ebf889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14c7be796039a99afa5638b734068643

SHA1
7e7ef74ebf3550271c402272068ec8c3a01bf2a0

SHA256
303bb80bdc260968dde3749ec477863f3e4dc3c4bd1c5227db4e1e67adfb1c3c

SHA512
b34762333f2ff796207f19043796ae3e70b91791872b24eaad4d9ccb98bd3d5b37be228e3bf35ef9e5b3a61f1bb34cf9d44a6963f7b885cae413e0314f7f78cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA30.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB21.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit