dad9063cd0273b8555fcca6d1961ccdb1e11a158426251142012a8e9a5ee98df

Analysis

max time kernel
129s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

67e8775b3c5bbf0e286d8a06e5666f76_JaffaCakes118.html
Size

144KB
MD5

67e8775b3c5bbf0e286d8a06e5666f76
SHA1

5ef293d658bb8f7dba49fee93f382e48a4acec5f
SHA256

dad9063cd0273b8555fcca6d1961ccdb1e11a158426251142012a8e9a5ee98df
SHA512

8fa740fb2d0348e8244fce4c163fd54e820c07477772df73fe249911d596777ce7b1323f06e5c4424083acb0fca3d8978b40ba40b548ce0243a147695609815d
SSDEEP

1536:SoZaW3uuYjHx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:SUtYDx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7D1BED1-1859-11EF-BA8B-4EB079F7C2BA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422557830"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1780	1952	iexplore.exe	28
PID 1952 wrote to memory of 1780	1952	iexplore.exe	28
PID 1952 wrote to memory of 1780	1952	iexplore.exe	28
PID 1952 wrote to memory of 1780	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67e8775b3c5bbf0e286d8a06e5666f76_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a3255e2e9d7d68ba76e58377994562a

SHA1
820220a0a68d291f1f6a6bbf7828eac2778ed76c

SHA256
9d2d3297e7f0d601a1c6a86a426c19b2510e705dde37741ba47d299c44c8a65e

SHA512
21fc0da09a2b6b75d24ea215a6dc2f69fccd06bfe3b06e1f36901d06119aa2db6e2b0f3c6959a19f57845aae2bf34b3055d3b21f74050514835f99ad8cfef80b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
665d33b12378df949e13c654dae3d63e

SHA1
abb0da806b729d794c65ce636b09b29475c28079

SHA256
693859f261f8da2be1cbcd48a31810f8e181ceae017616846caa1425992ea4d5

SHA512
68e49ad0736b708d12395604abf87d1f5afe9b7d310bf3d05515e47009342a81497a1d340afd5f6fb6e66ac88d42909ab9377d0f9f676a61a09e4601dff68ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26b5abf4e071bb232be810725a2b48cd

SHA1
c6c9c1bca8cb4c0527f621bd0521393eba26b5ca

SHA256
09919925663f99f57097c51e5c2a282604db1d5d5b3ec349d782da1519b10eeb

SHA512
56994f343708d9d286bfa12a37ac2c48c8f44439ad3e5462bdd0c0b156d84047ab4a8f3002e2e8692ed458620f34297ff7580680a22c4f697e4f21491aabf334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cd85767f17e5e6a86685101e3cbfec4

SHA1
5db6a7acf9526f151a29c26f91287fb38ce347e4

SHA256
18c9521298a41c210937c5d91af4a49969573fdb304885ead2b825a081af346a

SHA512
2e2adf7b688eb0baafc612800d42aad87d3fb69df030daf9f0a270c6d365e393889817e244136ca5b2d8845fc85bfa46fba915132198816c4538b7b5731d851c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95a2bfaa22136771ce62552a0a880fe7

SHA1
3057354150b4c4a6d655b8e47dbb1bee905c2023

SHA256
1d81b67a1434e3ed49fd4b7643186b5d8eed03ef065307000e338331ba3af282

SHA512
db1ca3301a310cf3f39669d3b63909f7bcf905ce3d7fa4c91e82b80beb0879bd08c63f01b6b81f049806a9da2256bcad6b074957dfdeb31f099f5697b8021868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7457929ef4e6ea19e2b0c06d4e0304c

SHA1
8cf3427d9d3851a6b0a4b849dca7d12d478c9f32

SHA256
0e00abebce3704cb6ed904d927f69acb47ddea4ab1d266149ab7c238e5b0427e

SHA512
adb530f8bb7a43ccc0d0dd95f696cb163e619df7174c223565bb021368f5d781a4333dcb6f4cd819ef617583a4e2863898cd0ecd469481d66ad2fc2fa4a97475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0583fc74d479bd8a96342d57601396f5

SHA1
82f909500c87f08e19adf9a5f823786301cfcf27

SHA256
4e7c754b6dd9fe607cded410bbacd98518aac8cd13d6ebb5720abf20b785c315

SHA512
117de0b35e4e409a544339da66bb4bf74cc7969c60cb43e656c2a2b552f9db5302c358335545189f641ebd68c3bac6365e795eec540f4157c9ced231590a630a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9540caa4d8f3b7648c983ed87f9fdae

SHA1
0b94edd27cf10c776964494515be17de4f6e9ea2

SHA256
4358e652f0c7d8d78385a07ed9527dbdf097e749cac8993ef42e95b0b111104f

SHA512
7928e2b728230b022a8888b2700d66c94f4f5eaa6c5b82582d0021c7081351950e4ad14a8a4d513bb3615689e9d890e85a294e7f64aaab1e666372f045a2ef65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c32e328ac7fdd33acf5fd74fc1ae81cd

SHA1
a1c6e4d258365b74374dd52b8121d00716ccfcd3

SHA256
1a2715b6bbeda61993db97b676b162477890c5f3e89b0bb1c0a308041a6132ae

SHA512
e47a91998c14b922f9b556b0e952b05b235505be59b97a5537e74827435d5255393f8a9921e6cdcc0bca4a8d60ffbf26a5579bf86cf68bb982edab5de8b463a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db12d33ae1786a395527165b85087c22

SHA1
aa6897b6846f2a3d31eb0f03e9ae127d9fffa794

SHA256
ea45e465bd43e77b6f502237a26bbed381432dedec461cd36b2481d3e43e8665

SHA512
dce2dcef7a3f69142c9e9db982631b841a791d0a3ffd444ca1367225dcc11d2675012cdf77e8ae9242fd67a9e560c84fb799008356488036fa52a9293963b448

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EE8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F77.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit