3a7051ef834a04bac638b27086b6f3e23417ad4dbe430e131d4fc5c21202f4b2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82f7002eb6507fea9178865371142850_JaffaCakes118.html
Size

31KB
MD5

82f7002eb6507fea9178865371142850
SHA1

7f4e2e728119b84b682c3cf86ac1398f117e102f
SHA256

3a7051ef834a04bac638b27086b6f3e23417ad4dbe430e131d4fc5c21202f4b2
SHA512

a80d18bb360acade52935a1ab566bd7fb223d5df645870e11ea4637e555fd8de9d90eb9c6665480589bcb57d586e630ea4101917d50e4cdcf2cbc20f0f17e539
SSDEEP

192:uWP9Ob5nAZnQjxn5Q/fnQiemNn22HnQOkEnttVnQTbnhnQFMCOQAFRyFLqDxcYLY:l2Q/U2zcQMyFuVpLkZQiKJqCQhOu3Z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97121041-1E38-11EF-A01B-4AADDC6219DF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423203255"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2980	2272	iexplore.exe	28
PID 2272 wrote to memory of 2980	2272	iexplore.exe	28
PID 2272 wrote to memory of 2980	2272	iexplore.exe	28
PID 2272 wrote to memory of 2980	2272	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82f7002eb6507fea9178865371142850_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34ec5f972a5cc8e7a41f350972207b12

SHA1
beeb9add5a165dc89d8c0c7b03c0b1e8c027861d

SHA256
f14b2f30c7e2be8f5a4fbe4a50207c427d72453051f8fc19818efe9652ca3a97

SHA512
471731958406f67fb4941a7585a477cdcecf676745afcac1d8116e6192d52fde94648990904f41f1745eb1a4960f817ed18b909e7a36d096c60e2af61ef43c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51e62e2a129313da5a0159e6a82c7d7e

SHA1
ee6866488af0d4c7247d23d8a66dc76a51e71e5b

SHA256
26e7fcb1104a049e6c70ff893050807df874fd6d8ed3f2affe0f06ca7423a0a7

SHA512
d5274bf1f9530bb10b4b87b40bf5142e0539ce5670aa601b529c4f6ca8c554ce7617b5d486582004e2fc80b2617c5d074fdba41fd5a7a84cef830ef6c1778916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb3e61707ab6e4b52329f625f21eb925

SHA1
3bb8bedd98e42862a41e1ef952ad6d5c749f0d0a

SHA256
52786eeb0380d1842aa3ff917e11bcace9fdda25fe3d390f75a89b400e614b5c

SHA512
e84599d7b3d0db01f7210e49195c2e64731b02772c20b0b9ae5aac4b5771906da8db16be827d67c19f900195dc63c1ff292c7d6b86479df8fd6e38c3124c89f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a74e4efa84dca4bfae045e15048951ab

SHA1
a0374e5833df5e2446fe133e45f08e1efcadc0b3

SHA256
c445197455fb5535fea36a4c20dd19aeffa6a1aed75385d49e4fe59a1ce9ccc8

SHA512
485905f58684bd6430bce9e9e0d20203437cb891b192301a5b6de4decf3b3770dc002038d9e86bb309fb39a789d57321baf1849be6029ddf92b23c1b6fa60279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10bf2ecd1d1248ad7b09c34571b8e193

SHA1
658dacb49f661f2599ee613930c72b8a575dafe3

SHA256
99563f1a81ca246fefae4fb9c896bc86c9abccbbbd1083504d740d36691712cc

SHA512
977198963505444f588bf85ec754c2214b36158feeeff93e58ca74794041c570163417a191b8222b2e04d4c704f126156d7b78c0555f4dfdca368a4c8f02a6b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3d4599ac773b1ca7344be0298360a8c

SHA1
1be973863b53fb4c27445bb10dae8f6568355104

SHA256
ca8e093e56382b7d057d5caa80082018706734f72d5f192d1ae90c7a14f3fdb0

SHA512
e519468747473594755f1371b0b923823269af8b6887b81ea4223ec12c78fc552f51d34d7dbc8679038f3ed1559cc10696f523d08aaa467f6e7533c9718e13a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86c8e7f380f0a27c518e12e12d0f56b0

SHA1
ace1b2a9d11525f54305dcc44d11942e9ae1acf9

SHA256
3e3e4c202a09367fb9b08a10c7632d318844b9fa3efb79ea1107298d5a336d0d

SHA512
6f47fc15c31c04b0bea075e14412306de9f062380d62b39852d65816a219895567865d0d5cf8ec63197c59ddf42b733767c0d08fd92106738e7ecf6dd5154c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da6e665f08e9a9c34ccb4aaecb49ab37

SHA1
422da039d34a20e3482ba963c1c03259a58e6d71

SHA256
c67fa495a990feb3d09d1431b3f672987138e816e0f6be0740a9933b39465726

SHA512
45a19000c6d60a6a1c5f4d71099b094261169d1cf9a2ed9e0911307b89b957668470692fe2bfeb6d289e5858014f9b68a3c1805bbe21edc7eb8e19ddbfad4900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5a27d70df2c103f31211d0af23a6ce4

SHA1
aab2296fd5c508997994fcfec6a9f21ae0d40bee

SHA256
705484b5ef3937f21074dcf556d7c18bd2833d24edb540a57d45be07f2ec1212

SHA512
3ae12028623ebb50ae654e9b4bfd51aa99cc128ae2fd1d9d52fbe9163c1ffbe4011fb3f4759c64a832e4135edb5724e2987b78c623235cb5bb8b425e77bbe633

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAD3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit