2bc946bd5abbb14264ae39c105615e97939b876d6f7e3a80c0345d32a74c6780

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72c8e8b7a33ff377f2e57bb3d4ba2670_JaffaCakes118.html
Size

27KB
MD5

72c8e8b7a33ff377f2e57bb3d4ba2670
SHA1

dcc9fbb097a4e4162c2f4d9ab39dff8572f93da7
SHA256

2bc946bd5abbb14264ae39c105615e97939b876d6f7e3a80c0345d32a74c6780
SHA512

718de76c78ba6625bbf58707b82b7162282b5954f644f243fbb82936471b0c3bced1794e696539238b7153ba5b8b393cfd000875a73be91028036e91d607af36
SSDEEP

192:uwDYb5nd+nQjxn5Q/onQieLNnmnQOkEnt0GnQTbnRnQ9eD7m60XF7Ql7MBrqnYnx:8Q/waNIFCSdJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422821630"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B87D121-1AC0-11EF-8698-5E73522EB9B5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2756	iexplore.exe
2756	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1216	2756	iexplore.exe	28
PID 2756 wrote to memory of 1216	2756	iexplore.exe	28
PID 2756 wrote to memory of 1216	2756	iexplore.exe	28
PID 2756 wrote to memory of 1216	2756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72c8e8b7a33ff377f2e57bb3d4ba2670_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93bd5f47f5bb9c4a674ed3cf3ae4a24a

SHA1
4e0622a3e2aa258b2d7b0bf9a794f644bdfb082f

SHA256
e6388dbc7bc65094384eeae2b413713b0a18a3241bfc145a0dbb040a4b770eda

SHA512
f33b5fc885ad8d4f19d28d103a8aef22b8f06081675abbeda8df85dcb50b56d7f7de8dc09e516ba50faa5c0403af146ef859903c5a625114a6c1e454f2753e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
533c776fa7058e9ac7f388de6213ccc6

SHA1
c096c8decce1c344874bd86b118a8bf103c9e51b

SHA256
a8f11d2dd7cfd201465bb5e220cd2462aad13a504bd02263f338ae729b4178e0

SHA512
26888cd5d1532ac024ef4b5699d0b423546b24b7d7c0d1a9aed44503acdd8ab25cde00a397c28bb51903a594c1453403c39b9a1c987dfd3324235ff60d10bd5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
400ae71eddb633ed63c45c6eece6c57c

SHA1
89b632c5e2cbd632083a5d35c1c4ad0156de2b7d

SHA256
1a2667132e15c504eab5df116c8fbbf2604c921d0e1f4df555977edea0d82aac

SHA512
c3053222a273a45428227ab58ce6113a26a0e463130a2bd7e6e4feaec74c58f613bf0c8a8579e3552e64b8289ab1d788dc628626802ba66498b11fadc11a1f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa3fe7de381ce9afdf3d57939cc41e4

SHA1
3502372edf09ef7c450243ea540f1ec61037501d

SHA256
915c381def20d0b107b805edf3eddd7b1bacdce5f3ff7793e9dd598ec3ce89c6

SHA512
ab1016c5d5b35deac27b6e955912c5513034ad2ddf474ddf420b34a9db2e45cdf336879b45bc9d847e3126b36a2b5076d6deb265d895049791acd69120e790c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c07a86ef0d52115b559b2927759440ed

SHA1
37c918a9c2d325e085f5ce46d9fd65e353811fa8

SHA256
f8b763d6a9bf11447268ebb8d99315e2783d9624ea507a03da89956a7cb68a92

SHA512
421f37845a142c6fcfe82a6f8a1a8209941952165a5a54c58276f6f76a58028ece210d0ce803f7d23255afda8213230df88b475b82955e1b436750a735fb38af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36a3733c40853217aaaa0baea67f69f0

SHA1
f6d71ac97dba336e6253778cf973271570888e8b

SHA256
b93507c2c463ffe1430221c0a8d9f89d224f643aa84fcd5e0584fd95f650bfcb

SHA512
8b2e18cc3253ec1f0c528f7934211b347ae72735796bba33e05af6c9d97460def9fc8a9f67ab1d1076e1089d8c801625a9bc2adda4f46394eb01b8eea6bc37f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5175f951052314d0f4d164093884934f

SHA1
2a1875126b52271b92c1f9ad0d3fdcb5108a316e

SHA256
b24c41b17cff84602c91c5d42bdb25c7bec141ef8fd151c8a517ce6761ca47e9

SHA512
9f247095fd4c60f2586f5f0b0489ff3963307eb7a4490f6aa56c32510e21906e00cd15e6066fb3587bd6d795e598325709c1cd15708bba205b62b25c2db1593e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0a786127604b0421929aabfdaa95df9

SHA1
cbd6f62557b1f8daa60248d698bae617daac21f7

SHA256
8515ef4440b65c5fa3009bb2bc4681d5cd347a0f400867401b08337618eda2aa

SHA512
67ba1dc17ce79c6037766c6d807b511f8f1231d344a2f58b8907cf56dc081105d5055b015e82f44c11377125de942ac87babeeb3d3a810d31fece4c656af98c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
018f58de2254e56e3a07a7bd155ee7cd

SHA1
66659dff43fffee290b64bb2bcba670b92abc537

SHA256
63249627d655722699d3038c7b1c88332171c864923cbe4d25122a3ea59bc760

SHA512
a081bbabb3cd77b629776250bc184b22816707eda1290934007d6aa8260842e17fe6086c86f5d9a8d3df8ad74008b27f8b357ff8c5c56f538c93b4ee6eb29aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c7ccb5e16c11b47cf027f15db613a2d

SHA1
39c9d75ef865c76858b5ba4035f6246d9fbbc649

SHA256
4721f89e5ab89630a5e0626aa4bc5af07cda9a272d7a5d2abea21d13c57c292e

SHA512
c7ae5cef88cff43aa4a86c973157f722c987ce8ddcafb9d0ac992b605af08ef0c310a2ecabcb1062a48d6d04c01090607874836c855bcfdc645c403a1b96d77a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77D1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar79BC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit