eecea363345bc7d4eab965f482d03fdb5368a8561ff6e438f28e9d7c787e90c0

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7f2a045ce131a08b69326313c56ecd6e_JaffaCakes118.html
Size

22KB
MD5

7f2a045ce131a08b69326313c56ecd6e
SHA1

d9fc15371c5649294e82840a4863f31fa7a62291
SHA256

eecea363345bc7d4eab965f482d03fdb5368a8561ff6e438f28e9d7c787e90c0
SHA512

a5dd0f8440493a750d8e3a659c8a5f83f3af9e6eef40cfa4d979e1d473d6c5f17bb395e41d7fade19c47200deccbe23e45cb583bb265627af44f41d476012c80
SSDEEP

192:uw/ub5nb2I8nQjxn5Q/CnQiepNnGnQOkEntyAnQTbnpnQ6v06J4RnQNjMBJqnYnz:kQ/Lv06kTn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{715B34A1-1D5F-11EF-B238-4AE872E97954} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423109991"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1896	iexplore.exe
1896	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2944	1896	iexplore.exe	28
PID 1896 wrote to memory of 2944	1896	iexplore.exe	28
PID 1896 wrote to memory of 2944	1896	iexplore.exe	28
PID 1896 wrote to memory of 2944	1896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f2a045ce131a08b69326313c56ecd6e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dc17ec415cc7963cffadae24ef3d638

SHA1
4cd968f6c59e140d4adb5ca0fdb045822115160d

SHA256
facfea1c4ab9626501a446a2c4ed6701169aa609500127d4ac87ad5ee1c98d07

SHA512
41505c0d0dc3b237cc5e37b4b96627e2cdf5bfb902c727c79a631c8f80ab5ce18a8e3f547766f824d82cc5554d2bcc1f734e880ab6c808f865b934cbeb85394a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b87dbc264e649b4ed4edf6061a2556a

SHA1
90849203fb02f788abd64c8f41053fced58d1280

SHA256
f257aa02d8e2d5dc0c1a66b99565196ac389ea0ac79d818789726bf10bc94d2c

SHA512
3b9c5059c5c6501e216c09d95831fafba239776beb557805b5b83d867793a490bc42b598aa76a72b9a854db45905fb1af9481fe9e800de0f72835c34ed18c7f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3a87e4aa83c05a17c08f7210c5f01d7

SHA1
47a72f09b0ee0abe0aa6e0e7cefd8a7001e8979c

SHA256
6a67e5af2e6c1f92b249bdacad729750fb7315f713ca1a3dc95ec424610794e0

SHA512
c88b3f0d6b75d397551c578d90007e4f080bc826fefbd7ae2c9dcb42eb1d6f0c366cc89efbe0023fce136d073f695091435ad1269c9305a3eb443c3e49ec081c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ca70f658f4cfc9d0d66e81db0e5c0a2

SHA1
255eabcdf169b15cbf39e9ba7a5e2cd2e7a261a6

SHA256
f0988786e44388454d7b0a86a8b00a7c680dccfae8541c3a2958bc3200e4a367

SHA512
754ce10bf1a1a72bd3062f549af8fd26de291460d89055e4ff346f1d1c4073719395405a361929981f73fd4d4c5668aa597068d774d429c92de258757b458eff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef6a37d7c56af9f6971d7d5ed2c42627

SHA1
b5d5a005ac4cdb761e7642121ab819f7c197546a

SHA256
ed2b11541b1e8acbbda6d34a34664e9b36208f3e2878ca3219573b173a2bbd46

SHA512
eb10b7c986e6e59b1c99fea94b3205c0e2ebf695704dfbf2e4252e9a464e8aa41bda983039562a87a61a63aac01dbfce3eda814956ac2ec50035094543daf4fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aeaf79aa3cd46de916375985ec0f067

SHA1
a6be6f531111c3467dc49bd406f9cb5640ba680b

SHA256
f481c50ba5418eb010b765fd62fd07c53de7c7221174a67c067a993a1e9f698e

SHA512
ad390cfd5757b99129925898cb349ccc0f4a1adba6d8c4b9147d2a5c045f42de400563d1fd7fd9de5a1aee502d3be35c9be3c39795fcbd9f6d2446aca23b8ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e46439076f2456071dec560da6d38fb

SHA1
71a23351ffb8aca303b0479096786269ab457475

SHA256
db8292bb99dc12814da1e912e792c67f29a17b1c0c366388a06d09d725948db7

SHA512
f9082c67bc263a8548094364f9665aadff4f67741215f1c058733728c9e5cd8462494f9f6acb80001d10b3c4fe2ff07b7fd05f254ab09257726ac4813797d69a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ddb3e563bead315c47aa2337f3d8a6d

SHA1
d74faf313799ff0fb5f3e43adf76d7fa56ade737

SHA256
f772f36f0015dc015cf1bd53994074f80708c95fcdcf90ec5e27a9f67df1c9b8

SHA512
ea54ddcef1f7b2ea57ab3d936fde4cf3837870bde725e13f176dad574f50ebbd58e1d152663d35f5c6592a0a133c200f7a7b07bf04513a54c34a64bca030bbb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c785d4302ff13f21e6510308de5ceffd

SHA1
28b11c09347b959b8e15bf81a6b887a9dd1f023e

SHA256
b7868600a57bf6b42d90eed52cb5150a4e31777e01e7ca17484172390f1cf5db

SHA512
735fdcf3b9deceac7216765500cf81cfafd9741eeccb571ebdcb08083f06565b61bff62c066d5a2f57cfced3ed995bd18f6683646fcb7bf0d061d86325e5f4a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2187.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2268.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit