7bc142fa6663d25efaf5591fcf42e2d53b305759fd2d0355509db5440c4ff420

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aaddc600c46b11755394d0fa9ea4bea1_JaffaCakes118.html
Size

27KB
MD5

aaddc600c46b11755394d0fa9ea4bea1
SHA1

af93df59d0d7c87a2e236fa88659280e8dc2081e
SHA256

7bc142fa6663d25efaf5591fcf42e2d53b305759fd2d0355509db5440c4ff420
SHA512

c95d860e132351b61f0a6916f255f774cfe69070db11ade7ba66a7d91cb9487b801a8cf665e6be831b72c806da10fbae0f4634079d4fd6038e9bf71b104a7be0
SSDEEP

384:5IGPf8nNWrcecoN2lJAb/6Q/2Nc4z/FIXUrXLX0yrraQZpZf4eArYf61v/Sy76Lr:aF3gle

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424547250"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D27AFFD1-2A71-11EF-8547-E6D98B7EB028} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2156	2172	iexplore.exe	28
PID 2172 wrote to memory of 2156	2172	iexplore.exe	28
PID 2172 wrote to memory of 2156	2172	iexplore.exe	28
PID 2172 wrote to memory of 2156	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aaddc600c46b11755394d0fa9ea4bea1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
492cb3133c20d43133069c757d8b121a

SHA1
c1ee1ea73050935f7e8c7fd6eb9a5a0933a63131

SHA256
9e750bba452b6694dcb659e0513b82620c7bad7ff8101fbb822bcb176d8d9e9d

SHA512
d8e4300c59b4276aa34e43ab19f5734c9c26bee97b4189255af9b67c1ee1336449816f88621fb31fe1d978a0bd1112fe12e0947dd9d12325d5797c549120346b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a276d9ded60f9752cb71d70bba21ea39

SHA1
26fc3396923a7aacb5cdb009adb8c7075b78d4e5

SHA256
f6b6b2e240bc257dc0285c3f5446c02013064e72b633a900df70fbad12a97ffe

SHA512
53ecd6484fd23431c2e31afeb011de9ad403413acb026389e31263d39826e802c5d2b740644e1647463744792da3232a85e1f47b03a464c1e8f373aaa1c35b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
539ac41ae2e1cf9c873275130d8e9854

SHA1
6a3d1f8433db5263ffab76f5bba73e54bc67d943

SHA256
3624ba41beef68bdf9ba63e8977c6bbe15b8feb98eb53ef016464efd45d07cd3

SHA512
78d73ad0c1077d99eace765d779911714eba80ce9452fb3be001b63a1e66f6742c6ea617373b35b28b1fc845dd3d878e8bb24389d0dab0ba222bee2ad01ea43e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8533a466f526f616060f73865eb2f4c5

SHA1
4892bc280911d005a760ff6421231796dd281196

SHA256
b0b263abaa29d6ccb84a999df4b1acbb41ae69b577feb49151c9150c7b61e1e0

SHA512
9610fdff4729cbc5146263a17022a694c64b17ffd40413fe846262d6f1d27dd60efc337764b26cc8dd8cf222b8955cfdeaf6917ff6a81829e676d6f6289666d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a549bdd86658d62a28d8a54bc504fb9a

SHA1
474ad758e94411cc8fc483aecfb1635fab5de720

SHA256
d733c958dd6f0d19c8e3f2afb3734c3efd7307619c0a0ac0c86373f0fb110b5e

SHA512
9baf66097cf633a1692dee50e2d00ed67bf12f5f545641823ee977599ded885dc7285f70a90ea992814b86ee74c7a1ee68bd5f79e16573d988712d5704b0a91e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2097942978a8229bcf786858fe5730fb

SHA1
bc3893efe340cf805422b7d3e7ec103a227f558b

SHA256
88700b3f1046c6ccbbee743e7cec537bf20bff1857120a66db3949b5e08aa7b0

SHA512
ab5bb4116bb6641d804689f713c66d39e63dd975925539422c9b6b5261077d50b880727f53b900e03493d789eeb3f95f76acb2505b07e3dd5eab2b3b7d058002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df4c4c9530b8438e3b7cc8f0f15750f4

SHA1
4d870adf7353b4f0b49fadedf8c95af967f35119

SHA256
e6bb954a34cca9e04d694c2f58376cb96499a561fe54954a4204daeb630c7aad

SHA512
cccf44d2ecf2c1e9dd2877e7c312e3e0c77ee0eb14b5e6614bbae93717f8ac242f3ea33f01e4d065d43879e78f72c4c21388c5fb406f6c48f28c63d01acfeaf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0120d7c243450d59dda9261ff07db4a

SHA1
36b230df8cd074d2950ab17a45d898865265a374

SHA256
9a4382422be6ca713b458e1307f3811def595ca20e6cf428f5d86acec49f13c4

SHA512
73345fbebf823eca6e8b0a458814af230bf9ea2a23d7a9eec04fd7669db6feb7dad7a4ec701e211141108db61008d33b3e5b9f2981c0bed52de9c7c969ee3e0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e09bd1cdcf238c70a3f77bf5d798512f

SHA1
6c84b68d3c42d7cdf33d0c1add54682c836e49a5

SHA256
c5922904615150101032e7282713ac5e4316f879bc861ccc0cc5000944346742

SHA512
67ff59552c0c1697a70ac3247428393f4ccbefa0b4ead3d02c7e48d655fdae7f17205fe3d4ad23d779f28b894effb0f6ecdf3b477de1e2a6409e8c204961b7c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dcea1c6ec7482cde3fe537770e9bd02

SHA1
2aa4beea13d81e3a6b7c9e5c8b2b620a8a535f54

SHA256
62d8d567c39569c227051a9015fb9aad150a1a307cf41f4186d8b90b9e9e1532

SHA512
5e7e4a3fe438747e707aef7b3cc29ebba69534fbcd71952d91fc1f0a911de67b57351ae299abbd045b235231c9976e7059b6a9ef4c5003053d4e8874ebb070c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18B1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit