4067148b2114a8645e50ee3b9898746b14d30d19c812893b0a4d72e9953cf2c9

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7f26b0555742bf08f985c6527c930269_JaffaCakes118.html
Size

23KB
MD5

7f26b0555742bf08f985c6527c930269
SHA1

852f6e4de5ac22f96abcbbd8fd8fe62231021f5b
SHA256

4067148b2114a8645e50ee3b9898746b14d30d19c812893b0a4d72e9953cf2c9
SHA512

d6946224a6b803b3ba7b9cefda9be6ec53996ce1a4f3a2109bf4178b7bc88087bf79161e73285f2fc9a2c5b291a05336d1edb152292faf67850ce5097613b9e8
SSDEEP

192:uwPNb5nAxTCnQjxn5Q/7nQieaNnVnQOkEntN1nQTbnFnQ6v06J4RnQNjMB6qnYnO:IxPQ/Yv06ko0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423109688"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD6726C1-1D5E-11EF-8962-7678A7DAE141} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2828	iexplore.exe
2828	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2604	2828	iexplore.exe	28
PID 2828 wrote to memory of 2604	2828	iexplore.exe	28
PID 2828 wrote to memory of 2604	2828	iexplore.exe	28
PID 2828 wrote to memory of 2604	2828	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f26b0555742bf08f985c6527c930269_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc3d315a0a298cd74323f1b07fbb1ba8

SHA1
a859e7f4a2e15145f70e7e097280a16a34b94c07

SHA256
40061ec4ad3c3637fb944dae817301857e6e58f3b9eec231d574a47c35022db7

SHA512
9412b5b72930ec4aadcdc348d70d45b1cccd24fe100e140465a4055c2bbfdfe9127db9959cef9dc1ba50d8473a7d5d64d70e4a949f87b82a0f2ddfe6cf00a11d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
433b3373729a9a9579b758a96807d2ab

SHA1
6f01cf32b91aba8aa8184d2960d51ff1896ba856

SHA256
4582a9aa9655ff7ecc8d448d9f726588b7d39d62fc79b3d06b99560fc26d0cb0

SHA512
dcd586981e41097c90583ce97f6dbad7489dc8101f4c12529b2dc63b239cb12ef7dc55b561654ca8c1f24067d4cc39385b72bd9cda84a19b98dfefa33066a134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04b486df8c793457836fed1b21b5083a

SHA1
134a18d07cb1e3811e2bbcd6fa94a1f41918460e

SHA256
7fd9ab9df65f97b24e4d96592204b9e7e41115244709e4cc1f4eb0a3dcb8ee55

SHA512
071c7da7207cc528588ff73c265f3e4fbdbd962399f4dae822d3da53bbf7b8576136b4fce0944cb3717af3a977a4582c70172d5476ab293691152f16f10eb536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0acabf30e4e7e82c4859d279cd4b7c57

SHA1
4b5f80b6516764732dfa5a51b57448598accf5af

SHA256
3d5eadea54b55c62fe18877f375f4a1849f22b3c8b9273ce31bd08ae20841c96

SHA512
f4c3e793333e76fad85d1ac78f0266710b8a6143d335553c7ecd9d20800b13ca5dad040e1543892238a20513afce6df974bbe508bfc546b2a8fb0eceaed80553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5be2842dc5a93c993c6e8c62e771adaf

SHA1
7874dae082647853753212f4bcdd3fb3f1e5f0e4

SHA256
e5b3db3a92007cb7374504038238b1ee479148ff361a0219a91f5a5b6f7f0c75

SHA512
41cb58f330a751c72645ada9992ea443322dc994e9a0d023f8cced93eb2f0f3bd14bdd611708b36d3a35eab3baf0a8de379c4b21ec94eb93105d806a999d69e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bb1d8420bf89e8c117a91221f58acbf

SHA1
9e97cd9d5bb5481499e9462ae8f44bd57d911212

SHA256
e2d89a7b532f2f25ee09333728f86c1ee0e5deae249898f27c47507b73dc7d03

SHA512
00035c84ae166132aaf385b2682e2c8f133f1d32edee35bff359f01dbc8e578f73b2a79e26324f17defd5c663bb5317b55ef71ba6ddaabc8ea8b0c3bd26bea6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b9dd6db323c683e6c31038baea1ed5e

SHA1
b0cb1db91e825c3ca31399bf5c17ffea8e0cc02e

SHA256
b991aebf716e0d285487fdd36b10f229a7b990195f5ca0c5aca3a5b6ba932f62

SHA512
0d10e81bcf4e5ee57e374df247c64d381ef508992bf948a141efd8d05092a5c6e64e078e519382be7f60c58ce0f01ef5626089430d9707f87ad19b4114ef367e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9c6d2e60d44034b78d54e0298c3fa44

SHA1
dc0b89c1c8ece7e976ff5f7551efa0d42f1fe273

SHA256
dc25b941c52615c4710da7f694572c85d4ab734d436d47b86d5468ab36f15801

SHA512
cd7e8971e5113bad6900ca6179944f86f6de0771308d361fbc3163314b906a77338b2ae547656582a2c53ad12e8c47a6eba2240c33dc329efde993fede8be247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a01c9aad5e43137cc139b739a4b42a82

SHA1
1b4c894631f6d1b80e3b067bef49759186eb95db

SHA256
caeba258eec2bd7f091a7a9e388a3f0a4c13cbcc0eca134a94cab26eb81342b2

SHA512
f592fe95905ade135fe251032ebf5ebe1c9cac5236be4cae2733c0e35d484b489311faad9e03074ec2a81252e49e11b890c4111bd180ebd4993637f270706eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9114bf0d6803467d78a9b5654a87b5b

SHA1
4cdff29759e1f8c48d55352158bcf148d8d283be

SHA256
25c4621924624f2767b88b7feff648b08c8b045d61f76c9a35f0c28f31b8075a

SHA512
9b4ac99c9be4cc128d88eaa4ffe949b8b3c11566973d0d83011731ac6f3403a6c55a5537f9fc92078214a48fd766c370505565bb1e65cb14a50a86068d040d99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f9a423a986982b565cdd79465624d4d

SHA1
8585581fe4d5a4045daf747de224a93ef88f810e

SHA256
3bbed3dae71e5ac37bd554ec5ec837668254671afc96b25e0a8f36a86d699c8e

SHA512
5ea4e4b7ccd522b92d948aabaa5022ef563cd4ef01179736888e50cc3c2fb0807a916b0bc3585369d3a5e0642caa1a5424e6ec7f635daf76a76157a7eca2df7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DE6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E89.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit