76f8a7051088f3fc9239e007951592a7f322478b5e9ae5e7ebd95d03f539e9a1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1561ac6a8f749a7da1c76d20269d305e_JaffaCakes118.html
Size

8KB
MD5

1561ac6a8f749a7da1c76d20269d305e
SHA1

878e7fb442babee386853df437d4c1623091e29a
SHA256

76f8a7051088f3fc9239e007951592a7f322478b5e9ae5e7ebd95d03f539e9a1
SHA512

63b4d4a983fe71bdc690a94510f017b55c61b3ca30dab331f0a226d65f060f51d5dcf2138625442b2c62398333f1ebff0a0db0054e863fbbdd5df9eeffbbc3ce
SSDEEP

96:SIxftKjOnAKuiwk3gGmQZDxcdp35I/opR280d5X8omd5X8+CjeYF4vIta6:SIxftKytuinvmQ3eamsd5Xed5Xhe4Ga6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421034624"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AD0B3B1-0A7F-11EF-80DF-F60046394256} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2420	2896	iexplore.exe	28
PID 2896 wrote to memory of 2420	2896	iexplore.exe	28
PID 2896 wrote to memory of 2420	2896	iexplore.exe	28
PID 2896 wrote to memory of 2420	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1561ac6a8f749a7da1c76d20269d305e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6206cd86bb49dc6acf6eee9fe2f7aee

SHA1
a3a8b141c7fe2637525eb378e078d4dad92ec91e

SHA256
524e2f3aa9a9f797c41fcd522817e0f7cbdfaab39a8b8704b87f542a44cf58c4

SHA512
2fe602314ea6e4bb32cee30e87d092e5c2dcee4834929f661a2af3b97c072bbeb92947f4337106312a45ebf0a8fe8948afc36e5498c0fdcffc52e7683550ea16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45ae94e215166fba1848727352ed4cfe

SHA1
89be741af539a1cd37d8e32533bfcf1e0cda34a2

SHA256
60464a2db98a91ceb1e709036dcb474db7b2418d10045ea9a2eec6f2f1dd0921

SHA512
d27f5ac83fd66d8deb2d7e84aed26c401edaf6999244439a2240e9aa8adc1a70faba5363a1ab4f8c02c0fd76d8682010f2e06c3ca52e2a60805ee9d4d35ffa89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2583155f68e39ec2f9a63e30100bf54

SHA1
862fa7ac714d360cad4136c86bec8dbe34162e19

SHA256
6df3a741cda00aa8d6d4fd14109000d78a8d469d2c96011c897081006e97d369

SHA512
5b1964fdbc344a413100bf70782bd28cddbe986982a6a9a4137cd41878e9ef4813ea5242fdd7e3429b5c7cd40b6ad97dfa7309844a71d3da9aafe528f6ad6f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52f54d94e411575f0ccbe020e08ff411

SHA1
40a129655672c75f40ce134f15386695108e70a4

SHA256
bbe89bd95c77c27ca2bd18cf5b438cca05cdf8105ecd6474f4128037c3a0a502

SHA512
ac71cc62d638cc4d91e926a1e2f649d55937cac03be64fb8e9b7c6483e4f71d9901b3c584fc61f1593c3fae2cc8a7805945a3c5d21ea9e20c55fbe06f1d5aa96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df75ca055be4f7a32fcae3125f630519

SHA1
852579fdbda90a2aad336cf86a679c99199c84f8

SHA256
6b9760381958c920cd314a34cfbe35a5ce19e1a4c9c9cb523b068fc3800a1dad

SHA512
7d73e0a973a40611200751aa845e1ff37d866d5490bdd1f65b8470dde56858768845d21170939309c0641f5ab03246bf0a4ab4552711a062b007f9c2e102dc7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2bb5b167f4355d3d5fca52dfde6b48e

SHA1
d2540ecea5d604979c937ab22ce160806394c6c3

SHA256
64318dafcaca23c4a74aff914ce5fcd212948c96d6e50908aea621dc3848c879

SHA512
b098f30e9464ee6bf5ea454d783ad098358193e53c7959a753fdd960261ed5d87d9d05d62a1470f064bce33f209702fa34c1b747b3eb39af66287c8562d7122b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
718e4b95537b08c2c9a7797d92a6add0

SHA1
83afcdc8940cd8d4697105b1ee50daa690b51e6c

SHA256
17c6084aa57f09793e224b9322b544863de322bb8edc867015be3f017b5d8f84

SHA512
7618eb1758d13e9bbf54790bf43ee21b3c10640809a72aad0db92dfbfaab7da324d745b8d976d5022ddd13a2934bbdc15a39e5660c4376728e6f2b6079fc632b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec4faa8ba5569d2735d9dc6bbd608aa0

SHA1
9cf36497939e10c813b8bc13dba7664e914cfc38

SHA256
00e259d9d2dedce02f38611a30594f7e1bd9e8aa5da53f9985a1978cf37b6a96

SHA512
d1c5e0fa194e06f4d4dd8576ca434b9667ce1585153ba28232dc9212672ede96645aed2f2577f4c24963a62a33aedcef9c93c22d896af078a1043e16364ca07a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5fab5345996ecf6d087a9a2c200b52a

SHA1
72423a412dd417326a8937d6ea56ea2ce47ff107

SHA256
9ef4845d2d4b6c142a1a99d5a3685c01253e8c535a36b92b7a52b86a8c22a617

SHA512
ed8fb9e1ef1a31dba59407d859b1cfa851c2b2c68d2c6bf5a420bb7ee8aa09cd64eef3944902184a8a952528c6d4774f0b1ef293b9236a065568ad162b9f2cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1851.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1910.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1916.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit