9cc3e121ea996e718505d55f456b445aa485161751160c9423dd27d5c9a8932f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76f0ad767b224b0111699d90b7e4b407_JaffaCakes118.html
Size

34KB
MD5

76f0ad767b224b0111699d90b7e4b407
SHA1

f52dd0f525e52b35cea3490e9b47fea59bad3591
SHA256

9cc3e121ea996e718505d55f456b445aa485161751160c9423dd27d5c9a8932f
SHA512

02263fbfd20a0adb58e2d6c59111681d7be965cb9b24534daecc20e643190d2b01162952a2e5d2f6312c4bdce58d93858116aa05797765246c710aa97ec84e4a
SSDEEP

384:0lGmArmhdmPcky0/eAV85bZaiCn/qb/vACr32oJUtQ/krTmgbIY1gFsZgVNTltSZ:xXcky0235bZBJUtmg7EF0BEhmPi1Un

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E45C1B1-1BAC-11EF-84D8-C2F93164A635} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422923101"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2336	1760	iexplore.exe	28
PID 1760 wrote to memory of 2336	1760	iexplore.exe	28
PID 1760 wrote to memory of 2336	1760	iexplore.exe	28
PID 1760 wrote to memory of 2336	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76f0ad767b224b0111699d90b7e4b407_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ed8b2412a3d050ccb179e967b9fbddf2

SHA1
273c5673ccfd03fcf063b8a38f7814c5fcaf743a

SHA256
58ee51d1005e6bba1be7c1fd44d6d3fcaf73effb693b52e82c8900b5f0ac26d3

SHA512
75b8e3ae1c87d741c7004590e765e199155f3cc641a5a12b58a1b8f38f4ac6715cd136ab08da67264e4ae0517da66a7729f54f1a8d45c43b8fd5614e6c9096b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
300450d6f328b2de7b3e0a4eb7626f11

SHA1
0820754efb01f0be37395d3ed090779aa35452c8

SHA256
4a381a1139433eb090a825f93cdc37c301c0e668a97ab87656a6c770e26e6a88

SHA512
644b92c7aa8a2e2fee93e92cd9d276ac04698ba8aeee55fda8a3d35e64a1d199c53fda31c8ce8b8602f8b836cfa0497f6db16ad32d89ec79fe12dddbc13f69f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfea8fed6a1684b52845450b123d1ac0

SHA1
1374e98cc2fb76940cfe7d6c1b1ada49a9b9a091

SHA256
f4f5035df5ea7faa1485870bafc5cfe09d3ff3096d62171d549bbb7154891d9f

SHA512
c6e0c258146ab0e15e40502d705d7f57e8eb409d232e25936df48877aafc82cbc9f14e2569591771a0acb0e9c672268f0ae0a288e2902e7c17d4936a9a8a7a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f0c685b2947c03c0b6b356ed0e78925

SHA1
b3fc7a5c92d7224611b8b9adb14c29d372c508ad

SHA256
2329eaf4212705c3129877c71fd5bc48e19e66a69985189571ccadd0fdb1b499

SHA512
51614bf13ab75d00d9f38c5ddf0b9963b5eeb9dbb89a034b5c2a2abe07e7fe634eb98a88d6dbb879add642a54bc280f48fc566cc012fd7e2930ad2ee429c903e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
337576cd52e23480c8d8a30a69ce7392

SHA1
89699957377053b5dcfa4f3348b493179dbc614f

SHA256
7f02ae90c960c2603eabb9c9ce217cbf111ad563560f3cd56492c34bc665440c

SHA512
6593ddfa25ae90faca3ee93004e2f630793618c0805a79a7f39f4ef8b5ea2dead19ccda4c589ef455bd4e9cd11c19f2e62e9f992f82873e2cc398e2d5912c34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb53596e2cfacbbbecc49b7bcdda9efb

SHA1
081c66f99473ecc35a565a8488aa6cb7db7f0e92

SHA256
8518457f84db547421847f6375c26bc006cce28faf5bf673a3c63e2116c67efd

SHA512
c050e7e3522616cd0086b0395a2359ce583614fa5d2eddc505f3a10f4749b14dda84dfdec4195bc312b67614894a867018435dd25e2d9dac4f1ee3f1f0de2765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acdd26c6c12f97d7d02321bb7fc75a36

SHA1
12086091ee9e7b50979be77dc84d7af62027dcb1

SHA256
2bcd1ebaf0020f65be1e7eb27e0943cf0bf4f7eeefcb4723396aa7e223a85539

SHA512
0e1136b4c92cfb35e609c38d1da5de0bb8dc1c65fda7b42d9341f297c8b7159b5fd5b4676c9210140133e5c5ffa4948f46865bb00fe70dbd8932c44b7c57799b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cdf8a409c8fc75cf35fc8c0266d3e76

SHA1
b3e730bf461ac57491fd47078a0cd80adecea91c

SHA256
dace6acccd6331a7a227ea85fc44676f56012ff31b04c088c762f2b49eb0a949

SHA512
6720d26ed8841fc5fb44ee1e5982f141fc00aa022564b7cd953a366d2369ac9e74ead5cd6ad57eefa8906a24259983fbd3fe778884531698c82aa929fda8a481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc1047d60575e2d6b1b4bcafa49337d

SHA1
0890d9949fb4f9d5f0187e49511c91c8c0a080f3

SHA256
8f8b65add314c6fdff9b38457f28774fa55f967dd526041535b514dc54d8dccb

SHA512
f3a4ee444e0a12c9e30c6c9d5f02a65b195b54fab93ccdc0f4a157b97d49597fa084c60329a6175d9163a6a30a94f8f6c3a2641cfcc26bc787dde37b82588784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197e5825aebe3351856c2fd787714a6d

SHA1
63c35daf0fced1d8c423934e7936894afa9e2465

SHA256
b36cd967e8d614215d391cc9e9098e6f645a3fb561a799cfc1a97bddd60a4853

SHA512
5cdd53ddda03290bd2b3dc1d2f8e71464f28c60964dd0bf63847cf00b8eb01ace7ea12e425adf2f5840d3a85508c6a338534e83d05ddea3e5e3e0fba7acd54bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d834ec6854c4e0e9db188f1a5cd3c4

SHA1
93c70be4032a802595d2fd3ca64205a4137786cb

SHA256
eeb58944a94ad6ecfc01ba5664d9038512572f7515d55e3885fe93a751fb6e19

SHA512
2bbdeb072f1c5a92b0655f7c149485853b3a8b504be053709eecd685888b629d3b9d9cc7c23e0fa6c3317868c4cabbbd86fdd20710e143e2eaa518cae34b1c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1d0fcf80e3ed2c7c1ffc3c772d3c9f92

SHA1
23b1db3f0c622a86371c0804a7cec7b7a77053ad

SHA256
8478c522c68925a29bebd83194d087ccb6bb86bc2b384b0561b2e6c43170aad4

SHA512
f755cdb96e1372c28b4921d87e9ce0c0d44a1a006b4fbbdda81e4dfa8e2ad7c402e45745627883a2f77191e2071c5cb1d1632619d8abb1442f775e0ac019cf19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AE2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AE3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit