4ca78fa2de474e9f4a25f3b2d3b29a19a845977292e8a4b48c52ba059a00143e

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fc276956a03fff1155e357a3c8aa542_JaffaCakes118.html
Size

27KB
MD5

7fc276956a03fff1155e357a3c8aa542
SHA1

024b1fde61feb8699b1f31b2d304cdbad6f70a05
SHA256

4ca78fa2de474e9f4a25f3b2d3b29a19a845977292e8a4b48c52ba059a00143e
SHA512

846edf70d710fbe37e48342a0d4118e7c5588cbfd5ad418adde5240d12fa51417fc89ab586ff2c80afce917a2091e5a6bda294c8690a83bae09a286034e0d842
SSDEEP

192:uw34b5ndWnQjxn5Q/MnQievNnwnQOkEnt0KnQTbnZnQ9eb3m60HFXQl7MBPqnYnF:cQ/iqpEFGSh1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423125269"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0332F071-1D83-11EF-9F3E-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1664	iexplore.exe
1664	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3024	1664	iexplore.exe	28
PID 1664 wrote to memory of 3024	1664	iexplore.exe	28
PID 1664 wrote to memory of 3024	1664	iexplore.exe	28
PID 1664 wrote to memory of 3024	1664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7fc276956a03fff1155e357a3c8aa542_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5b866f52b16f59faabba264f8ecf7dc

SHA1
d004a4ed99b148e1269e2e6015ff25b003762970

SHA256
1b03efd334152d28a0515a902413de57344d32355998a314c6a2c1c12f3d7433

SHA512
8c8f1209f6a5c5b2eac8a007a11340d13e4f62a2e75f7b38beb392b50784ec146a7f0430d1d0d18a9abe076bc22b4a31923a1240b67c180e10a8ac3dccda9ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e174b257c0144ba9cd3bbe9653da5b6

SHA1
e00878381e8cd49c64f02cbb94f01381691e92f0

SHA256
00625b195c9d15251e9f62f466a4c812cd57b720f6e52eb153954f591727a407

SHA512
df7805beff725c92af0e23646cdf1452dd6edca6a38091d3ac76998672ae8626e79e83f50df81049714d433b2c206333ba522ff1c904d7397460ced8cea516f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
935f8933eecfb0273283800bdaca8f94

SHA1
f57ef9bbb84069a1ff314eaaacc811db16339e5f

SHA256
037de1e486d2044cf18d9ed3c8361f27f00022730eb8c5464fed8179a3b53ad7

SHA512
02feb02a20224a6b8e4b0a771d671eee9269f253d5e08b25aacb46b237a95a4401b562e0f7de31349055812a7e4d3e39d0492f9ece74c426f21b37a02a80be5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cacb29dfd6b1f5ae07a387ec8fc60d74

SHA1
34421abac487a4dbf256f716e6ca4efdf6a277b3

SHA256
250645115edfa889aa01a5a04c2d8c011d9585f9cfbb9e04a684ef1fb2f4e03e

SHA512
1b5be6fc5536dc80826ce0b71ca2776e760ff92a42dd4287b8477fd8f2baea7356f365b4fc9101bb8691bfe4d4a46b847eb238f21d98507e1891e611b859ad66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2de926cc1e1f873b57685fa54f0fcd8

SHA1
ed1a1663fa19e2fde54a6be0471cd69c66c3c596

SHA256
35d26a0e60887837c53e2e5b23cfdb211017c327345a8872b99c5ec9c465473e

SHA512
7dbd465b63c638c1282c6a90ae9b80f3061d0c66f04ef8da76f35aaf174a79933800eacb75f8a1f2d2e7fcfea54f7f0d769ef2feface8b43d627b6a7fa33ee21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db54d9d6857eb9d992bf9b8de41916f0

SHA1
d9f8e361f67adf4d220b708b25af2ea4f9099f4d

SHA256
5cf3317c294df817abe1e08615ee5d7f1f7986d7b6254442025ffc280172d198

SHA512
7f361696d255a7a33659f0c9c45db990f5c9af41c8673fb7c8c997fe88df5cde9a6b225788091facdc118e52845c9cd781ae1ca531ddd8e2d725ff131a74e042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9faa711754d4e5434250f226f901aaa

SHA1
5d2285da2594d62da771ca540612d81154ce02d4

SHA256
4a509648b0c4664117b90d57f07b6d9ccf7c263221beb9f833a7866cb944fd9f

SHA512
05aff6676a3632a0c8bf8df5c7b7068ed1ecb7020d9d83f20578de27b45df17c548bbf4c18f474b142418dc2ce8a76a96d027756e06ac73a4f0795e812b4c61a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
566c8dabe7db42fe912a1c9f6c3b02f4

SHA1
e4cb4869c2293867e3331e731f7021737d553484

SHA256
c8d4dbdfaf2c3200e61870bb880480625f0debed5b86c64d225403ca05c2ddbc

SHA512
0508946204381837e4d4fc1f62d220b9ff3fff79ea16e4a6500a23ede2c52ac0d233c065d4a8bd9a5062d32d2cf12f0f55db460afade93690b03b33f65f3d235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1682356fcaea8daabfb9314a3444603b

SHA1
edd9e83d6bd56398a1f93a169f34a41107d36599

SHA256
31659b55a0e98814466664bb2711afcb10a4d473acaeb951fbcc1706cf1d56d7

SHA512
d35acdfd35dcbfd2d0296bb62392b6ac9b8fb98a2727842f86bb65aa1479957b37e850817dc675aa1e3b1f7708c87707ac425561904822403c1b4e618207c114

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8769.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar886B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit