f7fe8f58a33fd61b1e7727752466248e27d92dd01e1502e39c7ef459324b0095

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fb90e04c2a799f3d83cf1b972f75516_JaffaCakes118.html
Size

23KB
MD5

7fb90e04c2a799f3d83cf1b972f75516
SHA1

8b805ac1c762f6240aa77edf06949c2ccff62ef6
SHA256

f7fe8f58a33fd61b1e7727752466248e27d92dd01e1502e39c7ef459324b0095
SHA512

c00607275240f3c5208ba3573b9d16bb104d1f2839f7998da9f45f10fd4644a0627943cdaabdf227ba666d15370fc8d1b8fcd0e93003443909490d7aa8d67eab
SSDEEP

192:uWvwb5nfE10nQjxn5Q/jnQieCNn28PnQOkEntxhnQTbnhnQgCnQtgwMBiqnYnQ7w:rQ/c8NxG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A472C71-1D81-11EF-A7EB-E60682B688C9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423124422"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2520	2300	iexplore.exe	28
PID 2300 wrote to memory of 2520	2300	iexplore.exe	28
PID 2300 wrote to memory of 2520	2300	iexplore.exe	28
PID 2300 wrote to memory of 2520	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7fb90e04c2a799f3d83cf1b972f75516_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c06ec5ca8ae4f1685ddc5334616d4bb7

SHA1
743e519d301b897f883bd5c67bfa5cf6471b9b19

SHA256
c34c995024fddbde79764a029bc50a9efe733221ef562f9d16e25c4b854f69cf

SHA512
f86e21ed96a767573497d09d3ca5fb02bf62633eaa20810117369c887a31e9d35246f1703baa14026d0c048df86b88ee45b76d4694d9fdbc12b287daaf61ffc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aef64dd8dc20142763d9f38eba2076a6

SHA1
88dd4c80e574f0dcd9f3b7394f6480ea00db6888

SHA256
8cb4b474c55e3b45623c2ebcf285ee6a82fcc37a75d996aea8289b15b466a770

SHA512
2479f781da237da32d2197866f445c493d795d16beaeb00f9cf8e0eedf1936a634c3e395e2caaf133e8aa984ad99da96c94de588578e454828f0bcad3f1f8714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2149f606849037595a14fba229b92053

SHA1
f4377aa653ecd047a0c597539e043a18161981f5

SHA256
e276a64282d6a1d485e7ad7dd5967dea78e344b4d9a16753820b37a754ccf1b5

SHA512
c884ebf8a292ca3183008c06a9c7d76cfd58590734243c2e986fec6a8b28bc6a3865e2e8ee99837d1f6010afa4a20e16f168e507c6c7843e2b8515e3da3e85aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16cf07f24ee9e0920f6e41f6f86c35ee

SHA1
b3a3b7648bc173b58298a97e716dfb1a3b3266f6

SHA256
cc7916c4238fe22843de73e3f3d7a5609b3714ca0139560713a35ea01682ce20

SHA512
6e55969c6c029f158c4ea9d5b9ce8cba129a28df409df34e28d74ed0b854ee778a93a3fc05b665cae8c08a476e153264b6dbaa9ca131f78c286db08745dc18eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66225d9b54ec4e73ef3368b35b352cc3

SHA1
19c402b271a97c98fda3d937b0a335e669386aac

SHA256
aca6b4710c7f6b26f96990084288a7c99bcc745d97b54a16ed22c62ad196f925

SHA512
993e018821fe922a5637a1348be30c3f4a737652b969e35aa0ad75af3394b4d5f547680dbc805d0b2ae060eaf2b1e47c8aad77033e7a996a397f565cf39aea2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e588edaa65b79a56fe1bf96e097e67c1

SHA1
d0f19ef9b17b00506b74a80ab652a9955d4e6485

SHA256
c954b0774b15f95aca01b2da380a17805c1bf740092ea9c5dd1de37b023a97b5

SHA512
3133936b0d64fe9436e34a8ac818b1fa5960dfd7cb57a24d441db1d8bed35a599ba714f565b902e60007ea9af65a1fd8772c23812a4339b630cc505d5f70ea6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ba65161c7a43a0667aec04eddce4064

SHA1
ab34c131684026d2bf2e6db748e4a1c934e4b775

SHA256
5de66963e941de814a9710409fa935cb49537a9e367752c11e243f7541704cc1

SHA512
0f06626ed0173abb96e93be354228c089ceb11ca34fc22edc43e53c17db023c28596b00bb0bddba16d1565a4a98d3d1d805e76415947f082939890c03956c0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51865f20192f9c008455ef14d0ce79f2

SHA1
caac535d04250bd9ed28a7921105676faba712aa

SHA256
fa72bdb514a3a61914dda33ff4413c03631d4eb6c135a4f8524cfba4598b16fe

SHA512
7cd5d1b39eae82e107996e7556a9e849df56d2975ee74d1137256d37cee9e6e22a53d927fd97d70ae159c074417ff1c07bdf8d7bd8a4018cffb12870833e8188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f6121862b1da7f00c3e6bf0e7ba888c

SHA1
0f88d5b66083329e945fb033b424c1b3fada402d

SHA256
2819fb32e3b3f30dbb55f78dcc3a918e4a38207c2ced495146c52064e8e1085b

SHA512
68d0ac2a4aaa536f8e7a785e15ed16a2ad29798c7c4df4f5abf50d877821423d5bdf49a6ba00664fcf35f1994e010d24369ecd838ff336a304811dfc977ffdb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9195.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar92E6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit